Merge WebKit at r62496: Initial merge by git

Change-Id: Ie3da0770eca22a70a632e3571f31cfabc80facb2

902 files changed, 33671 insertions, 11465 deletions

diff --git a/JavaScriptCore/API/tests/testapi.c b/JavaScriptCore/API/tests/testapi.c
index 780e996..183abf5 100644
--- a/JavaScriptCore/API/tests/testapi.c
+++ b/JavaScriptCore/API/tests/testapi.c
@@ -927,7 +927,8 @@ int main(int argc, char* argv[])
     JSStringRelease(EmptyObjectIString);
     
     JSStringRef lengthStr = JSStringCreateWithUTF8CString("length");
-    aHeapRef = JSObjectMakeArray(context, 0, 0, 0);
+    JSObjectRef aStackRef = JSObjectMakeArray(context, 0, 0, 0);
+    aHeapRef = aStackRef;
     JSObjectSetProperty(context, aHeapRef, lengthStr, JSValueMakeNumber(context, 10), 0, 0);
     JSStringRef privatePropertyName = JSStringCreateWithUTF8CString("privateProperty");
     if (!JSObjectSetPrivateProperty(context, myObject, privatePropertyName, aHeapRef)) {
@@ -936,6 +937,7 @@ int main(int argc, char* argv[])
     } else {
         printf("PASS: Set private property.\n");
     }
+    aStackRef = 0;
     if (JSObjectSetPrivateProperty(context, aHeapRef, privatePropertyName, aHeapRef)) {
         printf("FAIL: JSObjectSetPrivateProperty should fail on non-API objects.\n");
         failed = 1;        
@@ -964,6 +966,7 @@ int main(int argc, char* argv[])
     for (int i = 0; i < 10000; i++)
         JSObjectMake(context, 0, 0);
 
+    aHeapRef = JSValueToObject(context, JSObjectGetPrivateProperty(context, myObject, privatePropertyName), 0);
     if (JSValueToNumber(context, JSObjectGetProperty(context, aHeapRef, lengthStr, 0), 0) != 10) {
         printf("FAIL: Private property has been collected.\n");
         failed = 1;
diff --git a/JavaScriptCore/Android.mk b/JavaScriptCore/Android.mk
index ded912e..42df087 100644
--- a/JavaScriptCore/Android.mk
+++ b/JavaScriptCore/Android.mk
@@ -196,14 +196,6 @@ LOCAL_SRC_FILES := \
 	yarr/RegexInterpreter.cpp \
 	yarr/RegexJIT.cpp
 
-# Rule to build grammar.y with our custom bison.
-GEN := $(intermediates)/parser/Grammar.cpp
-$(GEN) : PRIVATE_YACCFLAGS := -p jscyy
-$(GEN) : $(LOCAL_PATH)/parser/Grammar.y
-	$(call local-transform-y-to-cpp,.cpp)
-$(GEN) : $(LOCAL_BISON)
-LOCAL_GENERATED_SOURCES += $(GEN)
-
 # generated headers
 JSC_OBJECTS := $(addprefix $(intermediates)/runtime/, \
 				ArrayPrototype.lut.h \
diff --git a/JavaScriptCore/CMakeLists.txt b/JavaScriptCore/CMakeLists.txt
index c1946ff..bdb1467 100644
--- a/JavaScriptCore/CMakeLists.txt
+++ b/JavaScriptCore/CMakeLists.txt
@@ -203,17 +203,6 @@ ENDFOREACH ()
 GENERATE_HASH_LUT(${JAVASCRIPTCORE_DIR}/parser/Keywords.table ${DERIVED_SOURCES_DIR}/Lexer.lut.h MAIN_DEPENDENCY)
 LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_DIR}/Lexer.lut.h)
 
-# GENERATOR 2: bison grammar
-ADD_CUSTOM_COMMAND(
-    OUTPUT ${DERIVED_SOURCES_DIR}/Grammar.cpp ${DERIVED_SOURCES_DIR}/Grammar.h
-    MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/parser/Grammar.y
-    COMMAND ${BISON_EXECUTABLE} -d -p jscyy ${JAVASCRIPTCORE_DIR}/parser/Grammar.y -o ${DERIVED_SOURCES_DIR}/Grammar.cpp --defines=${DERIVED_SOURCES_DIR}/Grammar.h
-    COMMENT "[BISON][JSCYY] Building parser with bison"
-    VERBATIM)
-LIST(APPEND JavaScriptCore_HEADERS ${DERIVED_SOURCES_DIR}/Grammar.h)
-LIST(APPEND JavaScriptCore_SOURCES ${DERIVED_SOURCES_DIR}/Grammar.cpp)
-
-
 # GENERATOR: "chartables.c": compile and execute the chartables generator (and add it to sources)
 IF (MSVC)
     SET(JSC_DFTABLES_PREPROCESSOR --preprocessor=cl.exe)
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index ff017ca..c6cbd6d 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,811 @@
+2010-07-05  Steve Block  <steveblock@google.com>
+
+        Reviewed by Darin Adler.
+
+        ThreadingPthreads.cpp should use JNIUtility.h on Android, not outdated jni_utility.h
+        https://bugs.webkit.org/show_bug.cgi?id=41594
+
+        * wtf/ThreadingPthreads.cpp:
+
+2010-07-04  Mark Rowe  <mrowe@apple.com>
+
+        Build fix after r62456.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Be slightly more consistent in using uint32_t to prevent
+        warnings about comparisons between signed and unsigned types, and attempts to call an overload
+        of std::min that doesn't exist.
+
+2010-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41553
+        Make StringExtras.h versions of snprintf and vsnprintf match the unix versions.
+
+        - MSVC does not ensure the buffers are null terminated as the unix versions do.
+
+        * runtime/JSGlobalObjectFunctions.cpp: Cleanup includes.
+        * runtime/UString.cpp: Clean up includes.
+        (JSC::UString::from): Don't pass sizeof(buf) - 1, that is wrong.
+        * wtf/StringExtras.h:
+        (snprintf): Ensure null termination of buffer.
+        (vsnprintf): Ditto.
+
+2010-07-03  Yong Li  <yoli@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Make Arguments::MaxArguments clamping work for numbers >= 0x80000000 in
+        the interpreter as well as the JIT.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41351
+        rdar://problem/8142141
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute): Fix signed integer overflow problem
+        in op_load_varargs handling. 0xFFFFFFFF was read as -1.
+
+2010-06-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dumitru Daniliuc.
+
+        Support for keys and in-memory storage for IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=41252
+
+        Set the role to Private.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Move BOM handling out of the lexer and parser
+        https://bugs.webkit.org/show_bug.cgi?id=41539
+
+        Doing the BOM stripping in the lexer meant that we could
+        end up having to strip the BOMs from a source multiple times.
+        To deal with this we now require all strings provided by
+        a SourceProvider to already have had the BOMs stripped.
+        This also simplifies some of the lexer logic.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::sourceCode):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::getRange):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::copyStringWithoutBOMs):
+
+2010-07-03  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Kent Tamura.
+
+        [WINCE] Implement Unicode::isAlphanumeric and Unicode::isArabicChar.
+        https://bugs.webkit.org/show_bug.cgi?id=41411
+
+        * wtf/unicode/wince/UnicodeWince.cpp:
+        (WTF::Unicode::isAlphanumeric):
+        * wtf/unicode/wince/UnicodeWince.h:
+        (WTF::Unicode::isArabicChar):
+
+2010-07-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Change the CRASH() macro to print "WebKit CRASH" log.
+        https://bugs.webkit.org/show_bug.cgi?id=41524
+
+        Print "WebKit CRASH" before crashing.
+
+        * wtf/Assertions.h:
+
+2010-07-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 41565 - Repatching in ARMv7Assembler::repatchLoadPtrToLEA is broken
+
+        This method tried to repatch a LDR (T2) into an ADD (T3) - but it only
+        repatches the first instruction word.  The layout of the fields in the
+        second word is different, and also needs repatching.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::repatchLoadPtrToLEA):
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Clamp the number of arguments supported by function.apply
+        https://bugs.webkit.org/show_bug.cgi?id=41351
+        <rdar://problem/8142141>
+
+        Add clamping logic to function.apply similar to that
+        enforced by firefox.  We have a smaller clamp than
+        firefox as our calling convention means that stack
+        usage is proportional to argument count -- the firefox
+        limit is larger than you could actually call.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * runtime/Arguments.h:
+        (JSC::Arguments::):
+
+2010-07-02  Chao-ying Fu  <fu@mips.com>
+
+        Reviewed by Oliver Hunt.
+
+        Re-enable JIT_OPTIMIZE_NATIVE_CALL on MIPS
+        https://bugs.webkit.org/show_bug.cgi?id=40179
+
+        Add the MIPS part to re-enable JIT_OPTIMIZE_NATIVE_CALL.
+
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::privateCompileCTINativeCall):
+        * wtf/Platform.h:
+
+2010-07-02  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 41552 - Clean up ARMv7 vfp code generation
+        Emit separate opcode individually, remove magic numbers.
+
+        Also remove invalid assert from JSImmediate (number cells are not CELL_MASK aligned).
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::vadd_F64):
+        (JSC::ARMv7Assembler::vcmp_F64):
+        (JSC::ARMv7Assembler::vcvt_F64_S32):
+        (JSC::ARMv7Assembler::vcvtr_S32_F64):
+        (JSC::ARMv7Assembler::vdiv_F64):
+        (JSC::ARMv7Assembler::vldr):
+        (JSC::ARMv7Assembler::vmov_F64_0):
+        (JSC::ARMv7Assembler::vmov):
+        (JSC::ARMv7Assembler::vmrs):
+        (JSC::ARMv7Assembler::vmul_F64):
+        (JSC::ARMv7Assembler::vstr):
+        (JSC::ARMv7Assembler::vsub_F64):
+        (JSC::ARMv7Assembler::VFPOperand::VFPOperand):
+        (JSC::ARMv7Assembler::VFPOperand::bits1):
+        (JSC::ARMv7Assembler::VFPOperand::bits4):
+        (JSC::ARMv7Assembler::vcvtOp):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::vfpOp):
+        (JSC::ARMv7Assembler::ARMInstructionFormatter::vfpMemOp):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::branchDouble):
+        * runtime/JSImmediate.h:
+        (JSC::JSValue::isCell):
+
+2010-07-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62410.
+        http://trac.webkit.org/changeset/62410
+        https://bugs.webkit.org/show_bug.cgi?id=41549
+
+        accursed last minute changes (Requested by olliej on #webkit).
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::copyCodeWithoutBOMs):
+        (JSC::Lexer::sourceCode):
+        * parser/SourceProvider.h:
+        (JSC::):
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::SourceProvider::hasBOMs):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::getRange):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+
+2010-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41548
+        Use snprintf instead of sprintf everywhere in JavaScriptCore
+
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::encode):
+        (JSC::globalFuncEscape):
+        * runtime/UString.cpp:
+        (JSC::UString::from):
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Move BOM handling out of the lexer and parser
+        https://bugs.webkit.org/show_bug.cgi?id=41539
+
+        Doing the BOM stripping in the lexer meant that we could
+        end up having to strip the BOMs from a source multiple times.
+        To deal with this we now require all strings provided by
+        a SourceProvider to already have had the BOMs stripped.
+        This also simplifies some of the lexer logic.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::sourceCode):
+        * parser/SourceProvider.h:
+        (JSC::SourceProvider::SourceProvider):
+        (JSC::UStringSourceProvider::create):
+        (JSC::UStringSourceProvider::getRange):
+        (JSC::UStringSourceProvider::UStringSourceProvider):
+        * wtf/text/StringImpl.h:
+        (WebCore::StringImpl::copyStringWithoutBOMs):
+
+2010-07-02  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+        
+        [ Updated after rollout. ]
+
+        Merged RegExp constructor and RegExp::create methods.
+        Both functions are called with three parameters and check whether 
+        flags (the third param) is given or not.
+        Avoid extra hash lookups in RegExpCache::create by passing a pre-computed
+        iterator parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=41055
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-07-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed. Build fix for GTK+.
+
+        Build Lexer.lut.h with the rest of the .lut.h files. Later these should
+        all probably be moved to DerivedSources.
+
+        * GNUmakefile.am:
+
+2010-06-23  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Separate DerivedSources per-project
+        https://bugs.webkit.org/show_bug.cgi?id=41109
+
+        Generate JavaScriptCore derived sources in <builddir>/DerivedSources/JavaScriptCore.
+
+        * GNUmakefile.am:
+
+2010-07-02  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Oliver Hunt.
+
+        The alternativeFrameLocation value is wrong in the emitDisjunction function in
+        case of PatternTerm::TypeParentheticalAssertion. This value needs to be
+        computed from term.frameLocation instead of term.inputPosition. This mistake caused glibc
+        memory corruption in some cases.
+        Layout test added for checking of TypeParentheticalAssertion case.
+        https://bugs.webkit.org/show_bug.cgi?id=41458
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2010-07-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a FixedArray template to encapsulate fixed length arrays
+        https://bugs.webkit.org/show_bug.cgi?id=41506
+
+        This new type is used in place of fixed length C arrays so
+        that debug builds can guard against attempts to go beyond
+        the end of the array.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/Opcode.cpp:
+        (JSC::OpcodeStats::~OpcodeStats):
+        * pcre/pcre_compile.cpp:
+        (calculateCompiledPatternLength):
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+        (JSC::Heap::allocate):
+        * runtime/Collector.h:
+        (JSC::CollectorBitmap::clearAll):
+        * runtime/CollectorHeapIterator.h:
+        (JSC::CollectorHeapIterator::operator*):
+        * runtime/DateInstanceCache.h:
+        * runtime/JSString.cpp:
+        (JSC::JSString::replaceCharacter):
+        * runtime/JSString.h:
+        (JSC::RopeBuilder::JSStringFinalizerStruct::):
+        * runtime/NumericStrings.h:
+        * runtime/RegExpCache.h:
+        * runtime/SmallStrings.h:
+        (JSC::SmallStrings::singleCharacterStrings):
+        * wtf/AVLTree.h:
+        * wtf/FixedArray.h: Added.
+        (WTF::FixedArray::operator[]):
+        (WTF::FixedArray::data):
+
+2010-07-01  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Improve the main lexer switch by mapping input characters to their type
+        https://bugs.webkit.org/show_bug.cgi?id=41459
+
+        Sunsipder: no change (from 532.9ms to 531.5ms)
+        SunSpider --parse-only: 1.025x as fast (from 33.1ms to 32.3ms)
+
+        * parser/Lexer.cpp:
+        (JSC::):
+        (JSC::Lexer::lex):
+
+2010-07-01  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Ander Carlsson.
+
+        Define HAVE_HOSTED_CORE_ANIMATION on Snow Leopard.
+
+        * wtf/Platform.h:
+
+2010-07-01  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 41490 - Add missing operations to MacroAssemblerARMv7
+        Also, make single, double, quad register numbers in ARMv7Assembler distinct & strongly typed.
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMRegisters::):
+        (JSC::ARMRegisters::asSingle):
+        (JSC::ARMRegisters::asDouble):
+        (JSC::VFPImmediate::VFPImmediate):
+        (JSC::VFPImmediate::isValid):
+        (JSC::VFPImmediate::value):
+        (JSC::ARMv7Assembler::singleRegisterMask):
+        (JSC::ARMv7Assembler::doubleRegisterMask):
+        (JSC::ARMv7Assembler::):
+        (JSC::ARMv7Assembler::add_S):
+        (JSC::ARMv7Assembler::neg):
+        (JSC::ARMv7Assembler::orr_S):
+        (JSC::ARMv7Assembler::sub):
+        (JSC::ARMv7Assembler::sub_S):
+        (JSC::ARMv7Assembler::vadd_F64):
+        (JSC::ARMv7Assembler::vcmp_F64):
+        (JSC::ARMv7Assembler::vcvt_F64_S32):
+        (JSC::ARMv7Assembler::vcvtr_S32_F64):
+        (JSC::ARMv7Assembler::vdiv_F64):
+        (JSC::ARMv7Assembler::vldr):
+        (JSC::ARMv7Assembler::vmov_F64_0):
+        (JSC::ARMv7Assembler::vmov):
+        (JSC::ARMv7Assembler::vmul_F64):
+        (JSC::ARMv7Assembler::vstr):
+        (JSC::ARMv7Assembler::vsub_F64):
+        (JSC::ARMv7Assembler::vcvt):
+        (JSC::ARMv7Assembler::vmem):
+        * assembler/AbstractMacroAssembler.h:
+        * assembler/MacroAssemblerARM.h:
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::fpTempRegisterAsSingle):
+        (JSC::MacroAssemblerARMv7::neg32):
+        (JSC::MacroAssemblerARMv7::loadDouble):
+        (JSC::MacroAssemblerARMv7::divDouble):
+        (JSC::MacroAssemblerARMv7::convertInt32ToDouble):
+        (JSC::MacroAssemblerARMv7::branchConvertDoubleToInt32):
+        (JSC::MacroAssemblerARMv7::zeroDouble):
+        (JSC::MacroAssemblerARMv7::branchOr32):
+        (JSC::MacroAssemblerARMv7::set32):
+        (JSC::MacroAssemblerARMv7::set8):
+        * assembler/MacroAssemblerMIPS.h:
+        * assembler/MacroAssemblerX86Common.h:
+
+2010-07-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Improve reentrancy logic in polymorphic cache stubs
+        <https://bugs.webkit.org/show_bug.cgi?id=41482>
+        <rdar://problem/8094380>
+
+        Make the polymorphic cache stubs handle reentrancy
+        better.
+
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        (JSC::getPolymorphicAccessStructureListSlot):
+
+2010-07-01  Antti Koivisto  <koivisto@iki.fi>
+
+        Revert accidental commit.
+
+        * runtime/Collector.cpp:
+        (JSC::Heap::allocateBlock):
+
+2010-06-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Add assertion, off by default, for when you forget to do adoptRef
+        https://bugs.webkit.org/show_bug.cgi?id=41422
+
+        * wtf/PassRefPtr.h: Tweaked formatting. Added a new adopted
+        function, called on the pointer by adoptRef, with an empty inline
+        default version, meant to be overloaded. Unified the inlining
+        with a macro named REF_DEREF_INLINE to make it clearer what's
+        going on in the refIfNotNull/derefIfNotNull functions. Renamed
+        releaseRef to leakRef, but left the old name in for compatibility
+        for now.
+
+        * wtf/RefCounted.h: Added code to require adoption and assert if
+        you don't call adoptRef. For now, it is turned off because of the
+        LOOSE_REF_COUNTED define in this header. Later we can turn it on
+        once we get everything working without asserting.
+
+2010-06-29  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Bug 41238 - RegExp performance slow on Dromaeo benchmark
+
+        Other javascript engines appear to cache prior results of regular 
+        expression operations.
+
+        Suggest adding some sort of caching mechanism to regular expression 
+        processing.
+
+        Added a single entry cache of match() results to RegExp class.
+
+        Also added performance improvements to UString == operator.
+        First check the impls for equality.  Then get the length of
+        each of the non-null impls.  Next check the sizes for equality.
+        Then check the data for the case of different impls that point 
+        to the same data (most likely due to substrings from the beginning of
+        another string).  Lastly we check the underlying data for equality.
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::match):
+        * runtime/RegExp.h:
+        * runtime/UString.h:
+        (JSC::operator==):
+
+2010-06-29  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        WTF::HashSet iterators are quasi-mutable.  Changing the value through
+        dereferencing an iterator will not change the behavior of methods like
+        contains or find, but will change the behavior of iterating.
+
+        * wtf/HashSet.h:
+        (WTF::::begin):
+        (WTF::::end):
+        (WTF::::find):
+        (WTF::::remove):
+        * wtf/HashTable.h:
+
+2010-06-29  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Clean up the source lists in the GNUMakefile.am files
+        https://bugs.webkit.org/show_bug.cgi?id=41229
+
+        Clean up the GNUMakefile.am a little bit. Alphabetize and conglomerate
+        the source lists.
+
+        * GNUmakefile.am:
+
+2010-06-29  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fix QtScript build after QScriptValuePrivate ctor changes
+        https://bugs.webkit.org/show_bug.cgi?id=41307
+
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::prototype):
+        * qt/benchmarks/qscriptengine/qscriptengine.pro:
+
+2010-06-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QScriptEngine API should contain a newArray function
+        https://bugs.webkit.org/show_bug.cgi?id=39115
+
+        * qt/api/qscriptengine.cpp:
+        (QScriptEngine::newArray):
+        * qt/api/qscriptengine.h:
+        * qt/api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::newArray):
+        * qt/api/qscriptengine_p.h:
+        * qt/tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::newArray):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Install jsc as jsc-X where X is the major API version to allow
+        parallel installation of both GTK+ 2.x and 3.x versions.
+
+        * GNUmakefile.am:
+
+2010-06-28  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Kent Tamura.
+
+        add ENABLE_DIRECTORY_UPLOAD build support
+        https://bugs.webkit.org/show_bug.cgi?id=41100
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Revert to build jsc, since the tests expect this.
+
+        * GNUmakefile.am:
+
+2010-06-28  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Only one character lookahead should be enough for the lexer
+        https://bugs.webkit.org/show_bug.cgi?id=41213
+
+        The lexer had 4 character lookahead before, which required
+        a complex shifting mechanism. This can be improved by using
+        only one character lookahead for most decisions, and a
+        peek() function as a fallback when it is absolutely necessary.
+
+        * parser/Lexer.cpp:
+        (JSC::Lexer::currentCharacter):
+        (JSC::Lexer::currentOffset):
+        (JSC::Lexer::setCode):
+        (JSC::Lexer::shift):
+        (JSC::Lexer::peek):
+        (JSC::Lexer::getUnicodeCharacter):
+        (JSC::Lexer::shiftLineTerminator):
+        (JSC::Lexer::lastTokenWasRestrKeyword):
+        (JSC::Lexer::lex):
+        (JSC::Lexer::scanRegExp):
+        (JSC::Lexer::skipRegExp):
+        * parser/Lexer.h:
+
+2010-06-28  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Unreviewed build fix.
+
+        [EFL] Build fix for latest version of Ecore library.
+        Ecore recently changed return type of callbacks from int to Eina_Bool.
+
+        * wtf/efl/MainThreadEfl.cpp:
+        (WTF::timeoutFired): Return Eina_Bool instead of int.
+
+2010-06-28  Caio Marcelo de Oliveira Filho  <caio.oliveira@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QScriptValue should have API for accessing object properties
+        https://bugs.webkit.org/show_bug.cgi?id=40903
+
+        Make possible to access properties inside QScriptValues. While this
+        still doesn't support the ResolveLocal parameter, it is already useful
+        for testing the API.
+
+        The tests from upstream QtScript weren't imported since most of them
+        depend on the setProperty() function as well. A simple test was created.
+
+        * qt/api/qscriptvalue.cpp:
+        (QScriptValue::property):
+        * qt/api/qscriptvalue.h:
+        (QScriptValue::):
+        * qt/api/qscriptvalue_p.h:
+        (QScriptValuePrivate::property):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.cpp:
+        (tst_QScriptValue::propertySimple):
+        * qt/tests/qscriptvalue/tst_qscriptvalue.h:
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Add support for GTK+3
+        https://bugs.webkit.org/show_bug.cgi?id=41253
+
+        Suffix jsc with the API version of the library, so that
+        libwebkitgtk 1.x and 3.x can install jsc.
+
+        * GNUmakefile.am:
+
+2010-06-27  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Turn ENABLE(SINGLE_THREADED) on.
+        https://bugs.webkit.org/show_bug.cgi?id=41135
+
+        Brew MP does not support preemptive multi-threading.
+        Disable threading for Brew MP.
+
+        * wtf/Platform.h:
+
+2010-06-26  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add an ENABLE_WEB_TIMING option for enabling Web Timing support.
+        https://bugs.webkit.org/show_bug.cgi?id=38924
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-25  Nathan Lawrence  <nlawrence@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        We assume in testapi.c that the value aHeapRef refers to will not be
+        moved.  When we have movable objects, this will not be the case.
+
+        * API/tests/testapi.c:
+        (main):
+
+2010-06-25  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r61924.
+        http://trac.webkit.org/changeset/61924
+        https://bugs.webkit.org/show_bug.cgi?id=41240
+
+        It was rolled out, but cq+ wasn't removed (Requested by Ossy_
+        on #webkit).
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        (JSC::RegExp::create):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-06-25  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Geoffrey Garen.
+
+        Merge RegExp constructor and RegExp::create methods into one.
+        Both of function are called with tree parameters and check whether 
+        flags (the third param) is given or not.
+        Simplify hash lookups in RegExpCache::create with giving them an extra 
+        iterator parameter.
+        https://bugs.webkit.org/show_bug.cgi?id=41055
+
+        * runtime/RegExp.cpp:
+        (JSC::RegExp::RegExp):
+        * runtime/RegExp.h:
+        * runtime/RegExpCache.cpp:
+        (JSC::RegExpCache::lookupOrCreate):
+        (JSC::RegExpCache::create):
+        * runtime/RegExpCache.h:
+
+2010-06-25  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Introduce QtScript benchmarks.
+
+        The QtScript performance should be tested regularly. The patch introduces
+        micro benchmarks for existing API.
+
+        [Qt] Performance of the QtScript API is not tested.
+        https://bugs.webkit.org/show_bug.cgi?id=40911
+
+        * qt/benchmarks/benchmarks.pri: Copied from JavaScriptCore/qt/tests/tests.pri.
+        * qt/benchmarks/benchmarks.pro: Added.
+        * qt/benchmarks/qscriptengine/qscriptengine.pro: Added.
+        * qt/benchmarks/qscriptengine/tst_qscriptengine.cpp: Added.
+        (tst_QScriptEngine::checkSyntax_data):
+        (tst_QScriptEngine::checkSyntax):
+        (tst_QScriptEngine::constructor):
+        (tst_QScriptEngine::evaluateString_data):
+        (tst_QScriptEngine::evaluateString):
+        (tst_QScriptEngine::evaluateProgram_data):
+        (tst_QScriptEngine::evaluateProgram):
+        (tst_QScriptEngine::newObject):
+        (tst_QScriptEngine::nullValue):
+        (tst_QScriptEngine::undefinedValue):
+        (tst_QScriptEngine::globalObject):
+        (tst_QScriptEngine::toStringHandle):
+        * qt/benchmarks/qscriptvalue/qscriptvalue.pro: Added.
+        * qt/benchmarks/qscriptvalue/tst_qscriptvalue.cpp: Added.
+        (tst_QScriptValue::tst_QScriptValue):
+        (tst_QScriptValue::~tst_QScriptValue):
+        (tst_QScriptValue::values_data):
+        (tst_QScriptValue::ctorBool):
+        (tst_QScriptValue::ctorReal):
+        (tst_QScriptValue::ctorNumber):
+        (tst_QScriptValue::ctorQString):
+        (tst_QScriptValue::ctorCString):
+        (tst_QScriptValue::ctorSpecial):
+        (tst_QScriptValue::ctorQScriptValue):
+        (tst_QScriptValue::isValid_data):
+        (tst_QScriptValue::isValid):
+        (tst_QScriptValue::isBool_data):
+        (tst_QScriptValue::isBool):
+        (tst_QScriptValue::isNumber_data):
+        (tst_QScriptValue::isNumber):
+        (tst_QScriptValue::isFunction_data):
+        (tst_QScriptValue::isFunction):
+        (tst_QScriptValue::isNull_data):
+        (tst_QScriptValue::isNull):
+        (tst_QScriptValue::isString_data):
+        (tst_QScriptValue::isString):
+        (tst_QScriptValue::isUndefined_data):
+        (tst_QScriptValue::isUndefined):
+        (tst_QScriptValue::isObject_data):
+        (tst_QScriptValue::isObject):
+        (tst_QScriptValue::isError_data):
+        (tst_QScriptValue::isError):
+        (tst_QScriptValue::toString_data):
+        (tst_QScriptValue::toString):
+        (tst_QScriptValue::toNumber_data):
+        (tst_QScriptValue::toNumber):
+        (tst_QScriptValue::toBool_data):
+        (tst_QScriptValue::toBool):
+        (tst_QScriptValue::toInteger_data):
+        (tst_QScriptValue::toInteger):
+        (tst_QScriptValue::toInt32_data):
+        (tst_QScriptValue::toInt32):
+        (tst_QScriptValue::toUInt32_data):
+        (tst_QScriptValue::toUInt32):
+        (tst_QScriptValue::toUInt16_data):
+        (tst_QScriptValue::toUInt16):
+        (tst_QScriptValue::toObject_data):
+        (tst_QScriptValue::toObject):
+        (tst_QScriptValue::equals_data):
+        (tst_QScriptValue::equals):
+        (tst_QScriptValue::strictlyEquals_data):
+        (tst_QScriptValue::strictlyEquals):
+        (tst_QScriptValue::instanceOf_data):
+        (tst_QScriptValue::instanceOf):
+
+2010-06-25  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove old js parser
+        https://bugs.webkit.org/show_bug.cgi?id=41222
+
+        Remove the old yacc parser, this also solves the tiger problem.  Which
+        was a conflict between yacc generated token values and those in the
+        custom parser
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * DerivedSources.pro:
+        * GNUmakefile.am:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * parser/Grammar.y: Removed.
+        * parser/JSParser.cpp:
+        * parser/JSParser.h:
+        * parser/Lexer.cpp:
+        * parser/NodeConstructors.h:
+        (JSC::Node::Node):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * wtf/Platform.h:
+
 2010-06-25  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 08d9ef9..8f86fc3 100644
--- a/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -48,6 +48,7 @@ ENABLE_DATABASE = ENABLE_DATABASE;
 ENABLE_DATAGRID = ;
 ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DEVICE_ORIENTATION = ;
+ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
 ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
 ENABLE_FILTERS = ENABLE_FILTERS;
@@ -76,10 +77,12 @@ ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
+ENABLE_WEB_TIMING = ;
 ENABLE_WML = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB_SLICE) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_READER) $(ENABLE_FILE_WRITER) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB_SLICE) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_READER) $(ENABLE_FILE_WRITER) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+
diff --git a/JavaScriptCore/Configurations/Version.xcconfig b/JavaScriptCore/Configurations/Version.xcconfig
index f775a54..2749545 100644
--- a/JavaScriptCore/Configurations/Version.xcconfig
+++ b/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 2;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/JavaScriptCore/DerivedSources.make b/JavaScriptCore/DerivedSources.make
index 37020f1..2e8adb4 100644
--- a/JavaScriptCore/DerivedSources.make
+++ b/JavaScriptCore/DerivedSources.make
@@ -39,7 +39,6 @@ all : \
     ArrayPrototype.lut.h \
     chartables.c \
     DatePrototype.lut.h \
-    Grammar.cpp \
     JSONObject.lut.h \
     Lexer.lut.h \
     MathObject.lut.h \
@@ -61,16 +60,6 @@ all : \
 Lexer.lut.h: create_hash_table Keywords.table
 	$^ > $@
 
-# JavaScript language grammar
-
-Grammar.cpp: Grammar.y
-	bison -d -p jscyy $< -o $@ > bison_out.txt 2>&1
-	perl -p -e 'END { if ($$conflict) { unlink "Grammar.cpp"; die; } } $$conflict ||= /conflict/' < bison_out.txt
-	touch Grammar.cpp.h
-	touch Grammar.hpp
-	cat Grammar.cpp.h Grammar.hpp > Grammar.h
-	rm -f Grammar.cpp.h Grammar.hpp bison_out.txt
-
 # character tables for PCRE
 
 chartables.c : dftables
diff --git a/JavaScriptCore/DerivedSources.pro b/JavaScriptCore/DerivedSources.pro
index 7c5aad8..f358c8b 100644
--- a/JavaScriptCore/DerivedSources.pro
+++ b/JavaScriptCore/DerivedSources.pro
@@ -26,9 +26,6 @@ LUT_FILES += \
 KEYWORDLUT_FILES += \
     parser/Keywords.table
 
-JSCBISON += \
-    parser/Grammar.y
-
 RVCT_STUB_FILES += \
     jit/JITStubs.cpp
 
@@ -68,13 +65,6 @@ keywordlut.commands = perl $$keywordlut.wkScript ${QMAKE_FILE_NAME} -i > ${QMAKE
 keywordlut.depends = ${QMAKE_FILE_NAME}
 addExtraCompiler(keywordlut)
 
-# GENERATOR 2: bison grammar
-jscbison.output = $${JSC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.cpp
-jscbison.input = JSCBISON
-jscbison.commands = bison -d -p jscyy ${QMAKE_FILE_NAME} -o $${JSC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c && $(MOVE) $${JSC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.c ${QMAKE_FILE_OUT} && $(MOVE) $${JSC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.tab.h $${JSC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}${QMAKE_FILE_BASE}.h
-jscbison.depends = ${QMAKE_FILE_NAME}
-addExtraCompiler(jscbison)
-
 # GENERATOR 3: JIT Stub functions for RVCT
 rvctstubs.output = $${JSC_GENERATED_SOURCES_DIR}$${QMAKE_DIR_SEP}Generated${QMAKE_FILE_BASE}_RVCT.h
 rvctstubs.wkScript = $$PWD/create_jit_stubs
diff --git a/JavaScriptCore/GNUmakefile.am b/JavaScriptCore/GNUmakefile.am
index 957c743..aefc4fb 100644
--- a/JavaScriptCore/GNUmakefile.am
+++ b/JavaScriptCore/GNUmakefile.am
@@ -34,7 +34,7 @@ javascriptcore_h_api += \
 	JavaScriptCore/API/WebKitAvailability.h
 
 javascriptcore_built_nosources += \
-	DerivedSources/Lexer.lut.h \
+	JavaScriptCore/Lexer.lut.h \
 	JavaScriptCore/RegExpJitTables.h \
 	JavaScriptCore/runtime/ArrayPrototype.lut.h \
 	JavaScriptCore/runtime/DatePrototype.lut.h \
@@ -56,8 +56,8 @@ javascriptcore_sources += \
 	JavaScriptCore/API/JSCallbackFunction.cpp \
 	JavaScriptCore/API/JSCallbackFunction.h \
 	JavaScriptCore/API/JSCallbackObject.cpp \
-	JavaScriptCore/API/JSCallbackObject.h \
 	JavaScriptCore/API/JSCallbackObjectFunctions.h \
+	JavaScriptCore/API/JSCallbackObject.h \
 	JavaScriptCore/API/JSClassRef.cpp \
 	JavaScriptCore/API/JSClassRef.h \
 	JavaScriptCore/API/JSContextRef.cpp \
@@ -70,68 +70,65 @@ javascriptcore_sources += \
 	JavaScriptCore/API/JSWeakObjectMapRefInternal.h \
 	JavaScriptCore/API/OpaqueJSString.cpp \
 	JavaScriptCore/API/OpaqueJSString.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/APICast.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSBase.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSContextRef.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSObjectRef.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSRetainPtr.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRef.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRefCF.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSValueRef.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScript.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScriptCore.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/OpaqueJSString.h \
-	JavaScriptCore/ForwardingHeaders/JavaScriptCore/WebKitAvailability.h \
-	JavaScriptCore/JavaScriptCorePrefix.h \
-	JavaScriptCore/jit/ExecutableAllocator.h \
-	JavaScriptCore/jit/JIT.cpp \
-	JavaScriptCore/jit/JITOpcodes.cpp \
-	JavaScriptCore/jit/JITOpcodes32_64.cpp \
-	JavaScriptCore/jit/JITCall.cpp \
-	JavaScriptCore/jit/JITCall32_64.cpp \
-	JavaScriptCore/jit/JITCode.h \
-	JavaScriptCore/jit/JITPropertyAccess.cpp \
-	JavaScriptCore/jit/JITPropertyAccess32_64.cpp \
-	JavaScriptCore/jit/JITArithmetic.cpp \
-	JavaScriptCore/jit/JITArithmetic32_64.cpp \
-	JavaScriptCore/jit/ExecutableAllocator.cpp \
-	JavaScriptCore/jit/JIT.h \
-	JavaScriptCore/jit/JITInlineMethods.h \
-	JavaScriptCore/jit/JITStubs.cpp \
-	JavaScriptCore/jit/JITStubs.h \
-	JavaScriptCore/jit/JITStubCall.h \
-	JavaScriptCore/jit/JSInterfaceJIT.h \
-	JavaScriptCore/jit/SpecializedThunkJIT.h \
-	JavaScriptCore/jit/ThunkGenerators.cpp \
-	JavaScriptCore/jit/ThunkGenerators.h \
-	JavaScriptCore/bytecode/StructureStubInfo.cpp \
-	JavaScriptCore/bytecode/StructureStubInfo.h \
+	JavaScriptCore/assembler/AbstractMacroAssembler.h \
+	JavaScriptCore/assembler/ARMAssembler.cpp \
+	JavaScriptCore/assembler/ARMAssembler.h \
+	JavaScriptCore/assembler/AssemblerBuffer.h \
+	JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h \
+	JavaScriptCore/assembler/CodeLocation.h \
+	JavaScriptCore/assembler/LinkBuffer.h \
+	JavaScriptCore/assembler/MacroAssemblerARM.cpp \
+	JavaScriptCore/assembler/MacroAssemblerARM.h \
+	JavaScriptCore/assembler/MacroAssemblerCodeRef.h \
+	JavaScriptCore/assembler/MacroAssembler.h \
+	JavaScriptCore/assembler/MacroAssemblerX86_64.h \
+	JavaScriptCore/assembler/MacroAssemblerX86Common.h \
+	JavaScriptCore/assembler/MacroAssemblerX86.h \
+	JavaScriptCore/assembler/RepatchBuffer.h \
+	JavaScriptCore/assembler/X86Assembler.h \
 	JavaScriptCore/bytecode/CodeBlock.cpp \
 	JavaScriptCore/bytecode/CodeBlock.h \
-	JavaScriptCore/bytecode/JumpTable.cpp \
-	JavaScriptCore/bytecode/JumpTable.h \
 	JavaScriptCore/bytecode/EvalCodeCache.h \
 	JavaScriptCore/bytecode/Instruction.h \
-	JavaScriptCore/bytecompiler/Label.h \
-	JavaScriptCore/interpreter/Interpreter.cpp \
-	JavaScriptCore/interpreter/Interpreter.h \
+	JavaScriptCore/bytecode/JumpTable.cpp \
+	JavaScriptCore/bytecode/JumpTable.h \
 	JavaScriptCore/bytecode/Opcode.cpp \
 	JavaScriptCore/bytecode/Opcode.h \
-	JavaScriptCore/interpreter/Register.h \
-	JavaScriptCore/bytecompiler/RegisterID.h \
 	JavaScriptCore/bytecode/SamplingTool.cpp \
 	JavaScriptCore/bytecode/SamplingTool.h \
+	JavaScriptCore/bytecode/StructureStubInfo.cpp \
+	JavaScriptCore/bytecode/StructureStubInfo.h \
+	JavaScriptCore/bytecompiler/BytecodeGenerator.cpp \
+	JavaScriptCore/bytecompiler/BytecodeGenerator.h \
+	JavaScriptCore/bytecompiler/Label.h \
+	JavaScriptCore/bytecompiler/LabelScope.h \
+	JavaScriptCore/bytecompiler/NodesCodegen.cpp \
+	JavaScriptCore/bytecompiler/RegisterID.h \
 	JavaScriptCore/config.h \
 	JavaScriptCore/debugger/DebuggerActivation.cpp \
 	JavaScriptCore/debugger/DebuggerActivation.h \
 	JavaScriptCore/debugger/DebuggerCallFrame.cpp \
 	JavaScriptCore/debugger/DebuggerCallFrame.h \
+	JavaScriptCore/debugger/Debugger.cpp \
+	JavaScriptCore/debugger/Debugger.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/APICast.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScriptCore.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JavaScript.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSBase.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSContextRef.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSObjectRef.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSRetainPtr.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRefCF.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSStringRef.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/JSValueRef.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/OpaqueJSString.h \
+	JavaScriptCore/ForwardingHeaders/JavaScriptCore/WebKitAvailability.h \
 	JavaScriptCore/icu/unicode/parseerr.h \
 	JavaScriptCore/icu/unicode/platform.h \
 	JavaScriptCore/icu/unicode/putil.h \
 	JavaScriptCore/icu/unicode/uchar.h \
-	JavaScriptCore/icu/unicode/ucnv.h \
 	JavaScriptCore/icu/unicode/ucnv_err.h \
+	JavaScriptCore/icu/unicode/ucnv.h \
 	JavaScriptCore/icu/unicode/ucol.h \
 	JavaScriptCore/icu/unicode/uconfig.h \
 	JavaScriptCore/icu/unicode/uenum.h \
@@ -142,245 +139,45 @@ javascriptcore_sources += \
 	JavaScriptCore/icu/unicode/urename.h \
 	JavaScriptCore/icu/unicode/uset.h \
 	JavaScriptCore/icu/unicode/ustring.h \
-	JavaScriptCore/icu/unicode/utf.h \
 	JavaScriptCore/icu/unicode/utf16.h \
 	JavaScriptCore/icu/unicode/utf8.h \
+	JavaScriptCore/icu/unicode/utf.h \
 	JavaScriptCore/icu/unicode/utf_old.h \
 	JavaScriptCore/icu/unicode/utypes.h \
 	JavaScriptCore/icu/unicode/uversion.h \
-	JavaScriptCore/assembler/ARMAssembler.h \
-	JavaScriptCore/assembler/ARMAssembler.cpp \
-	JavaScriptCore/assembler/X86Assembler.h \
-	JavaScriptCore/assembler/AbstractMacroAssembler.h \
-	JavaScriptCore/assembler/AssemblerBuffer.h \
-	JavaScriptCore/assembler/AssemblerBufferWithConstantPool.h \
-	JavaScriptCore/assembler/CodeLocation.h \
-	JavaScriptCore/assembler/LinkBuffer.h \
-	JavaScriptCore/assembler/MacroAssembler.h \
-	JavaScriptCore/assembler/MacroAssemblerARM.h \
-	JavaScriptCore/assembler/MacroAssemblerARM.cpp \
-	JavaScriptCore/assembler/MacroAssemblerCodeRef.h \
-	JavaScriptCore/assembler/MacroAssemblerX86.h \
-	JavaScriptCore/assembler/MacroAssemblerX86_64.h \
-	JavaScriptCore/assembler/MacroAssemblerX86Common.h \
-	JavaScriptCore/assembler/RepatchBuffer.h \
-	JavaScriptCore/os-win32/stdbool.h \
-	JavaScriptCore/os-win32/stdint.h \
-	JavaScriptCore/pcre/pcre.h \
-	JavaScriptCore/pcre/pcre_compile.cpp \
-	JavaScriptCore/pcre/pcre_exec.cpp \
-	JavaScriptCore/pcre/pcre_internal.h \
-	JavaScriptCore/pcre/pcre_tables.cpp \
-	JavaScriptCore/pcre/pcre_ucp_searchfuncs.cpp \
-	JavaScriptCore/pcre/pcre_xclass.cpp \
-	JavaScriptCore/pcre/ucpinternal.h \
-	JavaScriptCore/profiler/CallIdentifier.h \
-	JavaScriptCore/profiler/Profile.cpp \
-	JavaScriptCore/profiler/Profile.h \
-	JavaScriptCore/profiler/ProfileGenerator.cpp \
-	JavaScriptCore/profiler/ProfileGenerator.h \
-	JavaScriptCore/profiler/ProfileNode.cpp \
-	JavaScriptCore/profiler/ProfileNode.h \
-	JavaScriptCore/profiler/Profiler.cpp \
-	JavaScriptCore/profiler/Profiler.h \
 	JavaScriptCore/interpreter/CachedCall.h \
+	JavaScriptCore/interpreter/CallFrameClosure.h \
 	JavaScriptCore/interpreter/CallFrame.cpp \
 	JavaScriptCore/interpreter/CallFrame.h \
-	JavaScriptCore/interpreter/CallFrameClosure.h \
-	JavaScriptCore/runtime/CachedTranscendentalFunction.h \
-	JavaScriptCore/runtime/ExceptionHelpers.cpp \
-	JavaScriptCore/runtime/ExceptionHelpers.h \
-	JavaScriptCore/runtime/Executable.cpp \
-	JavaScriptCore/runtime/Executable.h \
-	JavaScriptCore/runtime/InitializeThreading.cpp \
-	JavaScriptCore/runtime/InitializeThreading.h \
-	JavaScriptCore/runtime/JSActivation.cpp \
-	JavaScriptCore/runtime/JSActivation.h \
-	JavaScriptCore/runtime/JSByteArray.cpp \
-	JavaScriptCore/runtime/JSByteArray.h \
-	JavaScriptCore/runtime/JSGlobalData.cpp \
-	JavaScriptCore/runtime/JSGlobalData.h \
-	JavaScriptCore/runtime/JSNotAnObject.cpp \
-	JavaScriptCore/runtime/JSNotAnObject.h \
-	JavaScriptCore/runtime/JSONObject.cpp \
-	JavaScriptCore/runtime/JSONObject.h \
-	JavaScriptCore/runtime/JSPropertyNameIterator.cpp \
-	JavaScriptCore/runtime/JSPropertyNameIterator.h \
-	JavaScriptCore/runtime/JSStringBuilder.h \
-	JavaScriptCore/runtime/JSZombie.h \
-	JavaScriptCore/runtime/LiteralParser.cpp \
-	JavaScriptCore/runtime/LiteralParser.h \
-	JavaScriptCore/runtime/MarkStack.cpp \
-	JavaScriptCore/runtime/MarkStack.h \
-	JavaScriptCore/runtime/NumericStrings.h \
-	JavaScriptCore/runtime/PropertyDescriptor.h \
-	JavaScriptCore/runtime/PropertyDescriptor.cpp \
-	JavaScriptCore/runtime/SmallStrings.cpp \
-	JavaScriptCore/runtime/SmallStrings.h \
-	JavaScriptCore/runtime/StringBuilder.h \
-	JavaScriptCore/runtime/Structure.cpp \
-	JavaScriptCore/runtime/Structure.h \
-	JavaScriptCore/runtime/StructureChain.cpp \
-	JavaScriptCore/runtime/StructureChain.h \
-	JavaScriptCore/runtime/StructureTransitionTable.h \
-	JavaScriptCore/runtime/Terminator.h \
-	JavaScriptCore/runtime/TimeoutChecker.cpp \
-	JavaScriptCore/runtime/TimeoutChecker.h \
-	JavaScriptCore/runtime/JSTypeInfo.h \
-	JavaScriptCore/runtime/WeakGCMap.h \
-	JavaScriptCore/runtime/WeakGCPtr.h \
-	JavaScriptCore/wtf/ASCIICType.h \
-	JavaScriptCore/wtf/AVLTree.h \
-	JavaScriptCore/wtf/AlwaysInline.h \
-	JavaScriptCore/wtf/Assertions.cpp \
-	JavaScriptCore/wtf/Assertions.h \
-	JavaScriptCore/wtf/Atomics.h \
-	JavaScriptCore/wtf/ByteArray.cpp \
-	JavaScriptCore/wtf/ByteArray.h \
-	JavaScriptCore/wtf/CrossThreadRefCounted.h \
-	JavaScriptCore/wtf/CurrentTime.cpp \
-	JavaScriptCore/wtf/CurrentTime.h \
-	JavaScriptCore/wtf/DateMath.cpp \
-	JavaScriptCore/wtf/DateMath.h \
-	JavaScriptCore/wtf/Deque.h \
-	JavaScriptCore/wtf/DisallowCType.h \
-	JavaScriptCore/wtf/Forward.h \
-	JavaScriptCore/wtf/GetPtr.h \
-	JavaScriptCore/wtf/HashCountedSet.h \
-	JavaScriptCore/wtf/HashFunctions.h \
-	JavaScriptCore/wtf/HashIterators.h \
-	JavaScriptCore/wtf/HashMap.h \
-	JavaScriptCore/wtf/HashSet.h \
-	JavaScriptCore/wtf/HashTable.cpp \
-	JavaScriptCore/wtf/HashTable.h \
-	JavaScriptCore/wtf/HashTraits.h \
-	JavaScriptCore/wtf/ListHashSet.h \
-	JavaScriptCore/wtf/ListRefPtr.h \
-	JavaScriptCore/wtf/Locker.h \
-	JavaScriptCore/wtf/MD5.cpp \
-	JavaScriptCore/wtf/MD5.h \
-	JavaScriptCore/wtf/MainThread.cpp \
-	JavaScriptCore/wtf/MainThread.h \
-	JavaScriptCore/wtf/MathExtras.h \
-	JavaScriptCore/wtf/MessageQueue.h \
-	JavaScriptCore/wtf/Noncopyable.h \
-	JavaScriptCore/wtf/NotFound.h \
-	JavaScriptCore/wtf/OwnArrayPtr.h \
-	JavaScriptCore/wtf/OwnFastMallocPtr.h \
-	JavaScriptCore/wtf/OwnPtr.h \
-	JavaScriptCore/wtf/OwnPtrCommon.h \
-	JavaScriptCore/wtf/PassOwnPtr.h \
-	JavaScriptCore/wtf/PassRefPtr.h \
-	JavaScriptCore/wtf/Platform.h \
-	JavaScriptCore/wtf/PossiblyNull.h \
-	JavaScriptCore/wtf/RandomNumber.cpp \
-	JavaScriptCore/wtf/RandomNumber.h \
-	JavaScriptCore/wtf/RandomNumberSeed.h \
-	JavaScriptCore/wtf/RefCounted.h \
-	JavaScriptCore/wtf/RefCountedLeakCounter.cpp \
-	JavaScriptCore/wtf/RefCountedLeakCounter.h \
-	JavaScriptCore/wtf/RefPtr.h \
-	JavaScriptCore/wtf/RefPtrHashMap.h \
-	JavaScriptCore/wtf/RetainPtr.h \
-	JavaScriptCore/wtf/SegmentedVector.h \
-	JavaScriptCore/wtf/StaticConstructors.h \
-	JavaScriptCore/wtf/StdLibExtras.h \
-	JavaScriptCore/wtf/StringExtras.h \
-	JavaScriptCore/wtf/StringHashFunctions.h \
-	JavaScriptCore/wtf/TCPackedCache.h \
-	JavaScriptCore/wtf/TCPageMap.h \
-	JavaScriptCore/wtf/TCSpinLock.h \
-	JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp \
-	JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h \
-	JavaScriptCore/wtf/Threading.cpp \
-	JavaScriptCore/wtf/Threading.h \
-	JavaScriptCore/wtf/ThreadingPrimitives.h \
-	JavaScriptCore/wtf/ThreadingPthreads.cpp \
-	JavaScriptCore/wtf/ThreadSafeShared.h \
-	JavaScriptCore/wtf/ThreadSpecific.h \
-	JavaScriptCore/wtf/TypeTraits.cpp \
-	JavaScriptCore/wtf/TypeTraits.h \
-	JavaScriptCore/wtf/UnusedParam.h \
-	JavaScriptCore/wtf/ValueCheck.h \
-	JavaScriptCore/wtf/Vector.h \
-	JavaScriptCore/wtf/VectorTraits.h \
-	JavaScriptCore/wtf/WTFThreadData.cpp \
-	JavaScriptCore/wtf/WTFThreadData.h \
-	JavaScriptCore/wtf/gobject/GOwnPtr.cpp \
-	JavaScriptCore/wtf/gobject/GOwnPtr.h \
-	JavaScriptCore/wtf/gobject/GRefPtr.cpp \
-	JavaScriptCore/wtf/gobject/GRefPtr.h \
-	JavaScriptCore/wtf/gtk/MainThreadGtk.cpp \
-	JavaScriptCore/wtf/gtk/ThreadingGtk.cpp \
-	JavaScriptCore/wtf/text/AtomicString.cpp \
-	JavaScriptCore/wtf/text/AtomicString.h \
-	JavaScriptCore/wtf/text/AtomicStringImpl.h \
-	JavaScriptCore/wtf/text/CString.cpp \
-	JavaScriptCore/wtf/text/CString.h \
-	JavaScriptCore/wtf/text/StringBuffer.h \
-	JavaScriptCore/wtf/text/StringHash.h \
-	JavaScriptCore/wtf/text/StringImpl.cpp \
-	JavaScriptCore/wtf/text/StringImpl.h \
-	JavaScriptCore/wtf/text/StringImplBase.h \
-	JavaScriptCore/wtf/text/StringStatics.cpp \
-	JavaScriptCore/wtf/text/WTFString.cpp \
-	JavaScriptCore/wtf/text/WTFString.h \
-	JavaScriptCore/wtf/unicode/Collator.h \
-	JavaScriptCore/wtf/unicode/CollatorDefault.cpp \
-	JavaScriptCore/wtf/unicode/UTF8.cpp \
-	JavaScriptCore/wtf/unicode/UTF8.h \
-	JavaScriptCore/wtf/unicode/Unicode.h
-
-if TARGET_WIN32
-javascriptcore_sources += \
-	JavaScriptCore/wtf/ThreadSpecificWin.cpp \
-	JavaScriptCore/jit/ExecutableAllocatorWin.cpp \
-	JavaScriptCore/runtime/MarkStackWin.cpp
-else
-javascriptcore_sources += \
-	JavaScriptCore/jit/ExecutableAllocatorPosix.cpp \
-	JavaScriptCore/runtime/MarkStackPosix.cpp
-endif
-
-# ----
-# icu unicode backend
-# ----
-if USE_ICU_UNICODE
-javascriptcore_sources += \
-	JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp \
-	JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
-endif # USE_ICU_UNICODE
-
-# ----
-# glib unicode backend
-# ----
-if USE_GLIB_UNICODE
-javascriptcore_sources += \
-	JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h \
-	JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp \
-	JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h
-endif
-
-javascriptcore_sources += \
-	JavaScriptCore/wtf/VMTags.h \
-	JavaScriptCore/yarr/RegexCompiler.cpp \
-	JavaScriptCore/yarr/RegexCompiler.h \
-	JavaScriptCore/yarr/RegexInterpreter.cpp \
-	JavaScriptCore/yarr/RegexInterpreter.h \
-	JavaScriptCore/yarr/RegexJIT.cpp \
-	JavaScriptCore/yarr/RegexJIT.h \
-	JavaScriptCore/yarr/RegexParser.h \
-	JavaScriptCore/yarr/RegexPattern.h
-
-javascriptcore_sources += \
+	JavaScriptCore/interpreter/Interpreter.cpp \
+	JavaScriptCore/interpreter/Interpreter.h \
 	JavaScriptCore/interpreter/RegisterFile.cpp \
 	JavaScriptCore/interpreter/RegisterFile.h \
-	JavaScriptCore/bytecompiler/BytecodeGenerator.cpp \
-	JavaScriptCore/bytecompiler/BytecodeGenerator.h \
-	JavaScriptCore/bytecompiler/NodesCodegen.cpp \
-	JavaScriptCore/bytecompiler/LabelScope.h \
-	JavaScriptCore/debugger/Debugger.cpp \
-	JavaScriptCore/debugger/Debugger.h \
+	JavaScriptCore/interpreter/Register.h \
+	JavaScriptCore/JavaScriptCorePrefix.h \
+	JavaScriptCore/jit/ExecutableAllocator.cpp \
+	JavaScriptCore/jit/ExecutableAllocator.h \
+	JavaScriptCore/jit/JITArithmetic32_64.cpp \
+	JavaScriptCore/jit/JITArithmetic.cpp \
+	JavaScriptCore/jit/JITCall32_64.cpp \
+	JavaScriptCore/jit/JITCall.cpp \
+	JavaScriptCore/jit/JITCode.h \
+	JavaScriptCore/jit/JIT.cpp \
+	JavaScriptCore/jit/JIT.h \
+	JavaScriptCore/jit/JITInlineMethods.h \
+	JavaScriptCore/jit/JITOpcodes32_64.cpp \
+	JavaScriptCore/jit/JITOpcodes.cpp \
+	JavaScriptCore/jit/JITPropertyAccess32_64.cpp \
+	JavaScriptCore/jit/JITPropertyAccess.cpp \
+	JavaScriptCore/jit/JITStubCall.h \
+	JavaScriptCore/jit/JITStubs.cpp \
+	JavaScriptCore/jit/JITStubs.h \
+	JavaScriptCore/jit/JSInterfaceJIT.h \
+	JavaScriptCore/jit/SpecializedThunkJIT.h \
+	JavaScriptCore/jit/ThunkGenerators.cpp \
+	JavaScriptCore/jit/ThunkGenerators.h \
+	JavaScriptCore/os-win32/stdbool.h \
+	JavaScriptCore/os-win32/stdint.h \
 	JavaScriptCore/parser/ASTBuilder.h \
 	JavaScriptCore/parser/JSParser.cpp \
 	JavaScriptCore/parser/JSParser.h \
@@ -390,14 +187,31 @@ javascriptcore_sources += \
 	JavaScriptCore/parser/NodeInfo.h \
 	JavaScriptCore/parser/Nodes.cpp \
 	JavaScriptCore/parser/Nodes.h \
-	JavaScriptCore/parser/Parser.cpp \
-	JavaScriptCore/parser/Parser.h \
 	JavaScriptCore/parser/ParserArena.cpp \
 	JavaScriptCore/parser/ParserArena.h \
+	JavaScriptCore/parser/Parser.cpp \
+	JavaScriptCore/parser/Parser.h \
 	JavaScriptCore/parser/ResultType.h \
 	JavaScriptCore/parser/SourceCode.h \
 	JavaScriptCore/parser/SourceProvider.h \
 	JavaScriptCore/parser/SyntaxChecker.h \
+	JavaScriptCore/pcre/pcre_compile.cpp \
+	JavaScriptCore/pcre/pcre_exec.cpp \
+	JavaScriptCore/pcre/pcre.h \
+	JavaScriptCore/pcre/pcre_internal.h \
+	JavaScriptCore/pcre/pcre_tables.cpp \
+	JavaScriptCore/pcre/pcre_ucp_searchfuncs.cpp \
+	JavaScriptCore/pcre/pcre_xclass.cpp \
+	JavaScriptCore/pcre/ucpinternal.h \
+	JavaScriptCore/profiler/CallIdentifier.h \
+	JavaScriptCore/profiler/Profile.cpp \
+	JavaScriptCore/profiler/ProfileGenerator.cpp \
+	JavaScriptCore/profiler/ProfileGenerator.h \
+	JavaScriptCore/profiler/Profile.h \
+	JavaScriptCore/profiler/ProfileNode.cpp \
+	JavaScriptCore/profiler/ProfileNode.h \
+	JavaScriptCore/profiler/Profiler.cpp \
+	JavaScriptCore/profiler/Profiler.h \
 	JavaScriptCore/runtime/ArgList.cpp \
 	JavaScriptCore/runtime/ArgList.h \
 	JavaScriptCore/runtime/Arguments.cpp \
@@ -413,6 +227,7 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/BooleanObject.h \
 	JavaScriptCore/runtime/BooleanPrototype.cpp \
 	JavaScriptCore/runtime/BooleanPrototype.h \
+	JavaScriptCore/runtime/CachedTranscendentalFunction.h \
 	JavaScriptCore/runtime/CallData.cpp \
 	JavaScriptCore/runtime/CallData.h \
 	JavaScriptCore/runtime/ClassInfo.h \
@@ -421,6 +236,7 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/CollectorHeapIterator.h \
 	JavaScriptCore/runtime/CommonIdentifiers.cpp \
 	JavaScriptCore/runtime/CommonIdentifiers.h \
+	JavaScriptCore/runtime/Completion.cpp \
 	JavaScriptCore/runtime/Completion.h \
 	JavaScriptCore/runtime/ConstructData.cpp \
 	JavaScriptCore/runtime/ConstructData.h \
@@ -428,19 +244,23 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/DateConstructor.h \
 	JavaScriptCore/runtime/DateConversion.cpp \
 	JavaScriptCore/runtime/DateConversion.h \
+	JavaScriptCore/runtime/DateInstanceCache.h \
 	JavaScriptCore/runtime/DateInstance.cpp \
 	JavaScriptCore/runtime/DateInstance.h \
-	JavaScriptCore/runtime/DateInstanceCache.h \
 	JavaScriptCore/runtime/DatePrototype.cpp \
 	JavaScriptCore/runtime/DatePrototype.h \
-	JavaScriptCore/runtime/Error.cpp \
-	JavaScriptCore/runtime/Error.h \
 	JavaScriptCore/runtime/ErrorConstructor.cpp \
 	JavaScriptCore/runtime/ErrorConstructor.h \
+	JavaScriptCore/runtime/Error.cpp \
+	JavaScriptCore/runtime/Error.h \
 	JavaScriptCore/runtime/ErrorInstance.cpp \
 	JavaScriptCore/runtime/ErrorInstance.h \
 	JavaScriptCore/runtime/ErrorPrototype.cpp \
 	JavaScriptCore/runtime/ErrorPrototype.h \
+	JavaScriptCore/runtime/ExceptionHelpers.cpp \
+	JavaScriptCore/runtime/ExceptionHelpers.h \
+	JavaScriptCore/runtime/Executable.cpp \
+	JavaScriptCore/runtime/Executable.h \
 	JavaScriptCore/runtime/FunctionConstructor.cpp \
 	JavaScriptCore/runtime/FunctionConstructor.h \
 	JavaScriptCore/runtime/FunctionPrototype.cpp \
@@ -451,44 +271,64 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/GlobalEvalFunction.h \
 	JavaScriptCore/runtime/Identifier.cpp \
 	JavaScriptCore/runtime/Identifier.h \
+	JavaScriptCore/runtime/InitializeThreading.cpp \
+	JavaScriptCore/runtime/InitializeThreading.h \
 	JavaScriptCore/runtime/InternalFunction.cpp \
 	JavaScriptCore/runtime/InternalFunction.h \
-	JavaScriptCore/runtime/Completion.cpp \
-	JavaScriptCore/runtime/JSArray.cpp \
-	JavaScriptCore/runtime/JSArray.h \
+	JavaScriptCore/runtime/JSActivation.cpp \
+	JavaScriptCore/runtime/JSActivation.h \
 	JavaScriptCore/runtime/JSAPIValueWrapper.cpp \
 	JavaScriptCore/runtime/JSAPIValueWrapper.h \
+	JavaScriptCore/runtime/JSArray.cpp \
+	JavaScriptCore/runtime/JSArray.h \
+	JavaScriptCore/runtime/JSByteArray.cpp \
+	JavaScriptCore/runtime/JSByteArray.h \
 	JavaScriptCore/runtime/JSCell.cpp \
 	JavaScriptCore/runtime/JSCell.h \
 	JavaScriptCore/runtime/JSFunction.cpp \
 	JavaScriptCore/runtime/JSFunction.h \
+	JavaScriptCore/runtime/JSGlobalData.cpp \
+	JavaScriptCore/runtime/JSGlobalData.h \
 	JavaScriptCore/runtime/JSGlobalObject.cpp \
-	JavaScriptCore/runtime/JSGlobalObject.h \
 	JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp \
 	JavaScriptCore/runtime/JSGlobalObjectFunctions.h \
+	JavaScriptCore/runtime/JSGlobalObject.h \
 	JavaScriptCore/runtime/JSImmediate.cpp \
 	JavaScriptCore/runtime/JSImmediate.h \
 	JavaScriptCore/runtime/JSLock.cpp \
 	JavaScriptCore/runtime/JSLock.h \
+	JavaScriptCore/runtime/JSNotAnObject.cpp \
+	JavaScriptCore/runtime/JSNotAnObject.h \
 	JavaScriptCore/runtime/JSNumberCell.cpp \
 	JavaScriptCore/runtime/JSNumberCell.h \
 	JavaScriptCore/runtime/JSObject.cpp \
+	JavaScriptCore/runtime/JSObject.h \
 	JavaScriptCore/runtime/JSObjectWithGlobalObject.cpp \
 	JavaScriptCore/runtime/JSObjectWithGlobalObject.h \
-	JavaScriptCore/runtime/JSObject.h \
+	JavaScriptCore/runtime/JSONObject.cpp \
+	JavaScriptCore/runtime/JSONObject.h \
+	JavaScriptCore/runtime/JSPropertyNameIterator.cpp \
+	JavaScriptCore/runtime/JSPropertyNameIterator.h \
 	JavaScriptCore/runtime/JSStaticScopeObject.cpp \
 	JavaScriptCore/runtime/JSStaticScopeObject.h \
+	JavaScriptCore/runtime/JSStringBuilder.h \
 	JavaScriptCore/runtime/JSString.cpp \
 	JavaScriptCore/runtime/JSString.h \
 	JavaScriptCore/runtime/JSType.h \
+	JavaScriptCore/runtime/JSTypeInfo.h \
 	JavaScriptCore/runtime/JSValue.cpp \
 	JavaScriptCore/runtime/JSValue.h \
 	JavaScriptCore/runtime/JSVariableObject.cpp \
 	JavaScriptCore/runtime/JSVariableObject.h \
 	JavaScriptCore/runtime/JSWrapperObject.cpp \
 	JavaScriptCore/runtime/JSWrapperObject.h \
+	JavaScriptCore/runtime/JSZombie.h \
+	JavaScriptCore/runtime/LiteralParser.cpp \
+	JavaScriptCore/runtime/LiteralParser.h \
 	JavaScriptCore/runtime/Lookup.cpp \
 	JavaScriptCore/runtime/Lookup.h \
+	JavaScriptCore/runtime/MarkStack.cpp \
+	JavaScriptCore/runtime/MarkStack.h \
 	JavaScriptCore/runtime/MathObject.cpp \
 	JavaScriptCore/runtime/MathObject.h \
 	JavaScriptCore/runtime/NativeErrorConstructor.cpp \
@@ -502,12 +342,15 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/NumberObject.h \
 	JavaScriptCore/runtime/NumberPrototype.cpp \
 	JavaScriptCore/runtime/NumberPrototype.h \
+	JavaScriptCore/runtime/NumericStrings.h \
 	JavaScriptCore/runtime/ObjectConstructor.cpp \
 	JavaScriptCore/runtime/ObjectConstructor.h \
 	JavaScriptCore/runtime/ObjectPrototype.cpp \
 	JavaScriptCore/runtime/ObjectPrototype.h \
 	JavaScriptCore/runtime/Operations.cpp \
 	JavaScriptCore/runtime/Operations.h \
+	JavaScriptCore/runtime/PropertyDescriptor.cpp \
+	JavaScriptCore/runtime/PropertyDescriptor.h \
 	JavaScriptCore/runtime/PropertyMapHashTable.h \
 	JavaScriptCore/runtime/PropertyNameArray.cpp \
 	JavaScriptCore/runtime/PropertyNameArray.h \
@@ -517,12 +360,12 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/PrototypeFunction.cpp \
 	JavaScriptCore/runtime/PrototypeFunction.h \
 	JavaScriptCore/runtime/PutPropertySlot.h \
-	JavaScriptCore/runtime/RegExp.cpp \
-	JavaScriptCore/runtime/RegExp.h \
 	JavaScriptCore/runtime/RegExpCache.cpp \
 	JavaScriptCore/runtime/RegExpCache.h \
 	JavaScriptCore/runtime/RegExpConstructor.cpp \
 	JavaScriptCore/runtime/RegExpConstructor.h \
+	JavaScriptCore/runtime/RegExp.cpp \
+	JavaScriptCore/runtime/RegExp.h \
 	JavaScriptCore/runtime/RegExpKey.h \
 	JavaScriptCore/runtime/RegExpMatchesArray.h \
 	JavaScriptCore/runtime/RegExpObject.cpp \
@@ -534,6 +377,9 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/ScopeChain.cpp \
 	JavaScriptCore/runtime/ScopeChain.h \
 	JavaScriptCore/runtime/ScopeChainMark.h \
+	JavaScriptCore/runtime/SmallStrings.cpp \
+	JavaScriptCore/runtime/SmallStrings.h \
+	JavaScriptCore/runtime/StringBuilder.h \
 	JavaScriptCore/runtime/StringConstructor.cpp \
 	JavaScriptCore/runtime/StringConstructor.h \
 	JavaScriptCore/runtime/StringObject.cpp \
@@ -541,34 +387,172 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/StringObjectThatMasqueradesAsUndefined.h \
 	JavaScriptCore/runtime/StringPrototype.cpp \
 	JavaScriptCore/runtime/StringPrototype.h \
+	JavaScriptCore/runtime/StructureChain.cpp \
+	JavaScriptCore/runtime/StructureChain.h \
+	JavaScriptCore/runtime/Structure.cpp \
+	JavaScriptCore/runtime/Structure.h \
+	JavaScriptCore/runtime/StructureTransitionTable.h \
 	JavaScriptCore/runtime/SymbolTable.h \
+	JavaScriptCore/runtime/Terminator.h \
+	JavaScriptCore/runtime/TimeoutChecker.cpp \
+	JavaScriptCore/runtime/TimeoutChecker.h \
 	JavaScriptCore/runtime/Tracing.h \
 	JavaScriptCore/runtime/UString.cpp \
 	JavaScriptCore/runtime/UString.h \
 	JavaScriptCore/runtime/UStringImpl.h \
+	JavaScriptCore/runtime/WeakGCMap.h \
+	JavaScriptCore/runtime/WeakGCPtr.h \
 	JavaScriptCore/runtime/WeakRandom.h \
+	JavaScriptCore/wtf/AlwaysInline.h \
+	JavaScriptCore/wtf/ASCIICType.h \
+	JavaScriptCore/wtf/Assertions.cpp \
+	JavaScriptCore/wtf/Assertions.h \
+	JavaScriptCore/wtf/Atomics.h \
+	JavaScriptCore/wtf/AVLTree.h \
+	JavaScriptCore/wtf/ByteArray.cpp \
+	JavaScriptCore/wtf/ByteArray.h \
+	JavaScriptCore/wtf/CrossThreadRefCounted.h \
+	JavaScriptCore/wtf/CurrentTime.cpp \
+	JavaScriptCore/wtf/CurrentTime.h \
+	JavaScriptCore/wtf/DateMath.cpp \
+	JavaScriptCore/wtf/DateMath.h \
+	JavaScriptCore/wtf/Deque.h \
+	JavaScriptCore/wtf/DisallowCType.h \
+	JavaScriptCore/wtf/dtoa.cpp \
+	JavaScriptCore/wtf/dtoa.h \
 	JavaScriptCore/wtf/FastAllocBase.h \
 	JavaScriptCore/wtf/FastMalloc.cpp \
 	JavaScriptCore/wtf/FastMalloc.h \
+	JavaScriptCore/wtf/Forward.h \
+	JavaScriptCore/wtf/GetPtr.h \
+	JavaScriptCore/wtf/gobject/GOwnPtr.cpp \
+	JavaScriptCore/wtf/gobject/GOwnPtr.h \
+	JavaScriptCore/wtf/gobject/GRefPtr.cpp \
+	JavaScriptCore/wtf/gobject/GRefPtr.h \
+	JavaScriptCore/wtf/gtk/MainThreadGtk.cpp \
+	JavaScriptCore/wtf/gtk/ThreadingGtk.cpp \
+	JavaScriptCore/wtf/HashCountedSet.h \
+	JavaScriptCore/wtf/HashFunctions.h \
+	JavaScriptCore/wtf/HashIterators.h \
+	JavaScriptCore/wtf/HashMap.h \
+	JavaScriptCore/wtf/HashSet.h \
+	JavaScriptCore/wtf/HashTable.cpp \
+	JavaScriptCore/wtf/HashTable.h \
+	JavaScriptCore/wtf/HashTraits.h \
+	JavaScriptCore/wtf/ListHashSet.h \
+	JavaScriptCore/wtf/ListRefPtr.h \
+	JavaScriptCore/wtf/Locker.h \
+	JavaScriptCore/wtf/MainThread.cpp \
+	JavaScriptCore/wtf/MainThread.h \
 	JavaScriptCore/wtf/MallocZoneSupport.h \
+	JavaScriptCore/wtf/MathExtras.h \
+	JavaScriptCore/wtf/MD5.cpp \
+	JavaScriptCore/wtf/MD5.h \
+	JavaScriptCore/wtf/MessageQueue.h \
+	JavaScriptCore/wtf/Noncopyable.h \
+	JavaScriptCore/wtf/NotFound.h \
+	JavaScriptCore/wtf/OwnArrayPtr.h \
+	JavaScriptCore/wtf/OwnFastMallocPtr.h \
+	JavaScriptCore/wtf/OwnPtrCommon.h \
+	JavaScriptCore/wtf/OwnPtr.h \
+	JavaScriptCore/wtf/PassOwnPtr.h \
+	JavaScriptCore/wtf/PassRefPtr.h \
+	JavaScriptCore/wtf/Platform.h \
+	JavaScriptCore/wtf/PossiblyNull.h \
+	JavaScriptCore/wtf/RandomNumber.cpp \
+	JavaScriptCore/wtf/RandomNumber.h \
+	JavaScriptCore/wtf/RandomNumberSeed.h \
+	JavaScriptCore/wtf/RefCounted.h \
+	JavaScriptCore/wtf/RefCountedLeakCounter.cpp \
+	JavaScriptCore/wtf/RefCountedLeakCounter.h \
+	JavaScriptCore/wtf/RefPtr.h \
+	JavaScriptCore/wtf/RefPtrHashMap.h \
+	JavaScriptCore/wtf/RetainPtr.h \
+	JavaScriptCore/wtf/SegmentedVector.h \
+	JavaScriptCore/wtf/StaticConstructors.h \
+	JavaScriptCore/wtf/StdLibExtras.h \
+	JavaScriptCore/wtf/StringExtras.h \
+	JavaScriptCore/wtf/StringHashFunctions.h \
+	JavaScriptCore/wtf/TCPackedCache.h \
+	JavaScriptCore/wtf/TCPageMap.h \
+	JavaScriptCore/wtf/TCSpinLock.h \
 	JavaScriptCore/wtf/TCSystemAlloc.cpp \
 	JavaScriptCore/wtf/TCSystemAlloc.h \
-	JavaScriptCore/wtf/dtoa.cpp \
-	JavaScriptCore/wtf/dtoa.h
+	JavaScriptCore/wtf/text/AtomicString.cpp \
+	JavaScriptCore/wtf/text/AtomicString.h \
+	JavaScriptCore/wtf/text/AtomicStringImpl.h \
+	JavaScriptCore/wtf/text/CString.cpp \
+	JavaScriptCore/wtf/text/CString.h \
+	JavaScriptCore/wtf/text/StringBuffer.h \
+	JavaScriptCore/wtf/text/StringHash.h \
+	JavaScriptCore/wtf/text/StringImplBase.h \
+	JavaScriptCore/wtf/text/StringImpl.cpp \
+	JavaScriptCore/wtf/text/StringImpl.h \
+	JavaScriptCore/wtf/text/StringStatics.cpp \
+	JavaScriptCore/wtf/text/WTFString.cpp \
+	JavaScriptCore/wtf/text/WTFString.h \
+	JavaScriptCore/wtf/ThreadIdentifierDataPthreads.cpp \
+	JavaScriptCore/wtf/ThreadIdentifierDataPthreads.h \
+	JavaScriptCore/wtf/Threading.cpp \
+	JavaScriptCore/wtf/Threading.h \
+	JavaScriptCore/wtf/ThreadingPrimitives.h \
+	JavaScriptCore/wtf/ThreadingPthreads.cpp \
+	JavaScriptCore/wtf/ThreadSafeShared.h \
+	JavaScriptCore/wtf/ThreadSpecific.h \
+	JavaScriptCore/wtf/TypeTraits.cpp \
+	JavaScriptCore/wtf/TypeTraits.h \
+	JavaScriptCore/wtf/unicode/CollatorDefault.cpp \
+	JavaScriptCore/wtf/unicode/Collator.h \
+	JavaScriptCore/wtf/unicode/Unicode.h \
+	JavaScriptCore/wtf/unicode/UTF8.cpp \
+	JavaScriptCore/wtf/unicode/UTF8.h \
+	JavaScriptCore/wtf/UnusedParam.h \
+	JavaScriptCore/wtf/ValueCheck.h \
+	JavaScriptCore/wtf/Vector.h \
+	JavaScriptCore/wtf/VectorTraits.h \
+	JavaScriptCore/wtf/VMTags.h \
+	JavaScriptCore/wtf/WTFThreadData.cpp \
+	JavaScriptCore/wtf/WTFThreadData.h \
+	JavaScriptCore/yarr/RegexCompiler.cpp \
+	JavaScriptCore/yarr/RegexCompiler.h \
+	JavaScriptCore/yarr/RegexInterpreter.cpp \
+	JavaScriptCore/yarr/RegexInterpreter.h \
+	JavaScriptCore/yarr/RegexJIT.cpp \
+	JavaScriptCore/yarr/RegexJIT.h \
+	JavaScriptCore/yarr/RegexParser.h \
+	JavaScriptCore/yarr/RegexPattern.h
 
-javascriptcore_built_sources += \
-	DerivedSources/Grammar.cpp \
-	DerivedSources/Grammar.h
+if TARGET_WIN32
+javascriptcore_sources += \
+	JavaScriptCore/wtf/ThreadSpecificWin.cpp \
+	JavaScriptCore/jit/ExecutableAllocatorWin.cpp \
+	JavaScriptCore/runtime/MarkStackWin.cpp
+else
+javascriptcore_sources += \
+	JavaScriptCore/jit/ExecutableAllocatorPosix.cpp \
+	JavaScriptCore/runtime/MarkStackPosix.cpp
+endif
 
-DerivedSources/Grammar.h: DerivedSources/Grammar.cpp;
+# ----
+# icu unicode backend
+# ----
+if USE_ICU_UNICODE
+javascriptcore_sources += \
+	JavaScriptCore/wtf/unicode/icu/CollatorICU.cpp \
+	JavaScriptCore/wtf/unicode/icu/UnicodeIcu.h
+endif # USE_ICU_UNICODE
 
-DerivedSources/Grammar.cpp: $(srcdir)/JavaScriptCore/parser/Grammar.y
-	$(BISON) -d -p jscyy $(srcdir)/JavaScriptCore/parser/Grammar.y -o $@ > bison_out.txt 2>&1
-	$(PERL) -p -e 'END { if ($$conflict) { unlink "Grammar.cpp"; die; } } $$conflict ||= /conflict/' < bison_out.txt
-	cat $(GENSOURCES)/Grammar.hpp > $(GENSOURCES)/Grammar.h
-	rm -f $(GENSOURCES)/Grammar.hpp bison_out.txt
+# ----
+# glib unicode backend
+# ----
+if USE_GLIB_UNICODE
+javascriptcore_sources += \
+	JavaScriptCore/wtf/unicode/glib/UnicodeGLib.h \
+	JavaScriptCore/wtf/unicode/glib/UnicodeGLib.cpp \
+	JavaScriptCore/wtf/unicode/glib/UnicodeMacrosFromICU.h
+endif
 
-DerivedSources/Lexer.lut.h: $(CREATE_HASH_TABLE) $(srcdir)/JavaScriptCore/parser/Keywords.table
+JavaScriptCore/Lexer.lut.h: $(CREATE_HASH_TABLE) $(srcdir)/JavaScriptCore/parser/Keywords.table
 	$(PERL) $^ > $@
 
 JavaScriptCore/%.lut.h: $(CREATE_HASH_TABLE) $(srcdir)/JavaScriptCore/%.cpp
@@ -581,9 +565,10 @@ JavaScriptCore/pcre/chartables.c: $(srcdir)/JavaScriptCore/pcre/dftables
 	$(PERL) $^ $@
 
 bin_PROGRAMS += \
-	Programs/jsc
+	Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@
 
 noinst_PROGRAMS += \
+	Programs/jsc \
 	Programs/minidom
 
 # minidom
@@ -618,6 +603,11 @@ Programs_minidom_LDFLAGS = \
 	-no-fast-install
 
 # jsc
+Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@: Programs/jsc
+	$(AM_V_GEN)cp -f Programs/jsc Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@
+Programs_jsc_@WEBKITGTK_API_MAJOR_VERSION@_LDADD =
+Programs_jsc_@WEBKITGTK_API_MAJOR_VERSION@_SOURCES =
+
 Programs_jsc_SOURCES = \
 	JavaScriptCore/jsc.cpp
 
@@ -648,7 +638,6 @@ javascriptcore_dist += \
 	JavaScriptCore/pcre/AUTHORS \
 	JavaScriptCore/pcre/dftables \
 	JavaScriptCore/pcre/ucptable.cpp \
-	JavaScriptCore/parser/Grammar.y \
 	JavaScriptCore/parser/Keywords.table
 
 # Clean rules for JavaScriptCore
@@ -663,4 +652,5 @@ CLEANFILES += \
 	JavaScriptCore/runtime/StringPrototype.lut.h \
 	JavaScriptCore/pcre/chartables.c \
 	Programs/jsc \
+	Programs/jsc-@WEBKITGTK_API_MAJOR_VERSION@ \
 	Programs/minidom
diff --git a/JavaScriptCore/JavaScriptCore.pro b/JavaScriptCore/JavaScriptCore.pro
index 8ee4f09..84ce83c 100644
--- a/JavaScriptCore/JavaScriptCore.pro
+++ b/JavaScriptCore/JavaScriptCore.pro
@@ -235,8 +235,6 @@ SOURCES += \
     yarr/RegexJIT.cpp
 
 # Generated files, simply list them for JavaScriptCore
-SOURCES += \
-    $${JSC_GENERATED_SOURCES_DIR}/Grammar.cpp
 
 !contains(DEFINES, USE_SYSTEM_MALLOC) {
     SOURCES += wtf/TCSystemAlloc.cpp
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 8117f78..dbddfe0 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -1881,78 +1881,6 @@
 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\Grammar.cpp"

-				>

-				<FileConfiguration

-					Name="Debug|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						DisableSpecificWarnings="4701"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						DisableSpecificWarnings="4701"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_Internal|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						DisableSpecificWarnings="4701"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_PGOInstrument|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						DisableSpecificWarnings="4701"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_PGOOptimize|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						DisableSpecificWarnings="4701"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_CFLite|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						DisableSpecificWarnings="4701"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Release_CFLite|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						DisableSpecificWarnings="4701"

-					/>

-				</FileConfiguration>

-				<FileConfiguration

-					Name="Debug_All|Win32"

-					>

-					<Tool

-						Name="VCCLCompilerTool"

-						DisableSpecificWarnings="4701"

-					/>

-				</FileConfiguration>

-			</File>

-			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\Grammar.h"

-				>

-			</File>

-			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\lexer.lut.h"

 				>

 			</File>

diff --git a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index bc58f5d..2dd4abd 100644
--- a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -145,7 +145,6 @@
 		1482B74E0A43032800517CFC /* JSStringRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1482B74C0A43032800517CFC /* JSStringRef.cpp */; };
 		1482B7E40A43076000517CFC /* JSObjectRef.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1482B7E20A43076000517CFC /* JSObjectRef.cpp */; };
 		148CD1D8108CF902008163C6 /* JSContextRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 148CD1D7108CF902008163C6 /* JSContextRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		148F21A3107EC5310042EC2C /* Grammar.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 65FB3F4809D11B2400F49DEB /* Grammar.cpp */; };
 		148F21AA107EC53A0042EC2C /* BytecodeGenerator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 969A07200ED1CE3300F1F681 /* BytecodeGenerator.cpp */; };
 		148F21B0107EC5410042EC2C /* Lexer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A8650255597D01FF60F7 /* Lexer.cpp */; };
 		148F21B7107EC5470042EC2C /* Nodes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F692A86D0255597D01FF60F7 /* Nodes.cpp */; };
@@ -330,6 +329,7 @@
 		A7D649AA1015224E009B2E1B /* PossiblyNull.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D649A91015224E009B2E1B /* PossiblyNull.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7E2EA6B0FB460CF00601F06 /* LiteralParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A7E2EA690FB460CF00601F06 /* LiteralParser.h */; };
 		A7E2EA6C0FB460CF00601F06 /* LiteralParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */; };
+		A7F19ECE11DD490900931E70 /* FixedArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F19ECD11DD490900931E70 /* FixedArray.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A7F9935F0FD7325100A0B2D0 /* JSONObject.h in Headers */ = {isa = PBXBuildFile; fileRef = A7F9935D0FD7325100A0B2D0 /* JSONObject.h */; };
 		A7F993600FD7325100A0B2D0 /* JSONObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7F9935E0FD7325100A0B2D0 /* JSONObject.cpp */; };
 		A7FB60A4103F7DC20017A286 /* PropertyDescriptor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7FB60A3103F7DC20017A286 /* PropertyDescriptor.cpp */; };
@@ -350,7 +350,7 @@
 		BC18C3E70E16F5CD00B34460 /* ArrayPrototype.h in Headers */ = {isa = PBXBuildFile; fileRef = F692A84E0255597D01FF60F7 /* ArrayPrototype.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3E90E16F5CD00B34460 /* ASCIICType.h in Headers */ = {isa = PBXBuildFile; fileRef = 938C4F690CA06BC700D9310A /* ASCIICType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3EA0E16F5CD00B34460 /* Assertions.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E217B708E7EECC0023E5F6 /* Assertions.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		BC18C3EB0E16F5CD00B34460 /* AVLTree.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A596370DE3E1C300C17E37 /* AVLTree.h */; };
+		BC18C3EB0E16F5CD00B34460 /* AVLTree.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A596370DE3E1C300C17E37 /* AVLTree.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3EC0E16F5CD00B34460 /* BooleanObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 704FD35305697E6D003DBED9 /* BooleanObject.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3ED0E16F5CD00B34460 /* CallData.h in Headers */ = {isa = PBXBuildFile; fileRef = 145C507F0D9DF63B0088F6B9 /* CallData.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC18C3F00E16F5CD00B34460 /* Collator.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A862AA0D7EBB7D001EC6AA /* Collator.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -476,7 +476,6 @@
 		BC18C52A0E16FCC200B34460 /* MathObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C5290E16FCC200B34460 /* MathObject.lut.h */; };
 		BC18C52C0E16FCD200B34460 /* RegExpObject.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52B0E16FCD200B34460 /* RegExpObject.lut.h */; };
 		BC18C52E0E16FCE100B34460 /* Lexer.lut.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52D0E16FCE100B34460 /* Lexer.lut.h */; };
-		BC18C5300E16FCEB00B34460 /* Grammar.h in Headers */ = {isa = PBXBuildFile; fileRef = BC18C52F0E16FCEB00B34460 /* Grammar.h */; };
 		BC257DE80E1F51C50016B6C9 /* Arguments.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DE60E1F51C50016B6C9 /* Arguments.h */; };
 		BC257DF00E1F52ED0016B6C9 /* GlobalEvalFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DEE0E1F52ED0016B6C9 /* GlobalEvalFunction.h */; };
 		BC257DF40E1F53740016B6C9 /* PrototypeFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = BC257DF20E1F53740016B6C9 /* PrototypeFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -758,7 +757,6 @@
 		65EA4C9A092AF9E20093D800 /* JSLock.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = JSLock.h; sourceTree = "<group>"; tabWidth = 8; };
 		65EA73620BAE35D1001BB560 /* CommonIdentifiers.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CommonIdentifiers.cpp; sourceTree = "<group>"; };
 		65EA73630BAE35D1001BB560 /* CommonIdentifiers.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CommonIdentifiers.h; sourceTree = "<group>"; };
-		65FB3F4809D11B2400F49DEB /* Grammar.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Grammar.cpp; sourceTree = "<group>"; };
 		704FD35305697E6D003DBED9 /* BooleanObject.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = BooleanObject.h; sourceTree = "<group>"; tabWidth = 8; };
 		7E2C6C980D31C6B6002D44E2 /* ScopeChainMark.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScopeChainMark.h; sourceTree = "<group>"; };
 		7E4EE7080EBB7963005934AA /* StructureChain.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StructureChain.h; sourceTree = "<group>"; };
@@ -843,7 +841,6 @@
 		932F5BE10822A1C700736975 /* jsc */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = jsc; sourceTree = BUILT_PRODUCTS_DIR; };
 		93303FE80E6A72B500786E6A /* SmallStrings.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SmallStrings.cpp; sourceTree = "<group>"; };
 		93303FEA0E6A72C000786E6A /* SmallStrings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SmallStrings.h; sourceTree = "<group>"; };
-		933A3499038AE7C6008635CE /* Grammar.y */ = {isa = PBXFileReference; explicitFileType = sourcecode.yacc; fileEncoding = 4; indentWidth = 4; path = Grammar.y; sourceTree = "<group>"; tabWidth = 8; };
 		933A349A038AE7C6008635CE /* Identifier.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Identifier.h; sourceTree = "<group>"; tabWidth = 8; };
 		933A349D038AE80F008635CE /* Identifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Identifier.cpp; sourceTree = "<group>"; tabWidth = 8; };
 		935AF46909E9D9DB00ACD1D8 /* Forward.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Forward.h; sourceTree = "<group>"; };
@@ -938,6 +935,7 @@
 		A7E2EA6A0FB460CF00601F06 /* LiteralParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LiteralParser.cpp; sourceTree = "<group>"; };
 		A7E42C180E3938830065A544 /* JSStaticScopeObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStaticScopeObject.h; sourceTree = "<group>"; };
 		A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStaticScopeObject.cpp; sourceTree = "<group>"; };
+		A7F19ECD11DD490900931E70 /* FixedArray.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FixedArray.h; sourceTree = "<group>"; };
 		A7F8690E0F9584A100558697 /* CachedCall.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedCall.h; sourceTree = "<group>"; };
 		A7F869EC0F95C2EC00558697 /* CallFrameClosure.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CallFrameClosure.h; sourceTree = "<group>"; };
 		A7F9935D0FD7325100A0B2D0 /* JSONObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSONObject.h; sourceTree = "<group>"; };
@@ -979,7 +977,6 @@
 		BC18C5290E16FCC200B34460 /* MathObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MathObject.lut.h; sourceTree = "<group>"; };
 		BC18C52B0E16FCD200B34460 /* RegExpObject.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpObject.lut.h; sourceTree = "<group>"; };
 		BC18C52D0E16FCE100B34460 /* Lexer.lut.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Lexer.lut.h; sourceTree = "<group>"; };
-		BC18C52F0E16FCEB00B34460 /* Grammar.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Grammar.h; sourceTree = "<group>"; };
 		BC22A3980E16E14800AF21C8 /* JSObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSObject.cpp; sourceTree = "<group>"; };
 		BC22A3990E16E14800AF21C8 /* JSObject.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSObject.h; sourceTree = "<group>"; };
 		BC22A39A0E16E14800AF21C8 /* JSVariableObject.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSVariableObject.cpp; sourceTree = "<group>"; };
@@ -1381,8 +1378,6 @@
 				BC18C5230E16FC8A00B34460 /* ArrayPrototype.lut.h */,
 				65B174BE09D1000200820339 /* chartables.c */,
 				BCD203E70E1718F4002C7E82 /* DatePrototype.lut.h */,
-				65FB3F4809D11B2400F49DEB /* Grammar.cpp */,
-				BC18C52F0E16FCEB00B34460 /* Grammar.h */,
 				BC87CDB810712ACA000614CF /* JSONObject.lut.h */,
 				BC18C52D0E16FCE100B34460 /* Lexer.lut.h */,
 				BC18C5290E16FCC200B34460 /* MathObject.lut.h */,
@@ -1491,6 +1486,7 @@
 				96DD73780F9DA3100027FBCC /* VMTags.h */,
 				86D08D5111793613006E5ED0 /* WTFThreadData.cpp */,
 				86D08D5211793613006E5ED0 /* WTFThreadData.h */,
+				A7F19ECD11DD490900931E70 /* FixedArray.h */,
 			);
 			path = wtf;
 			sourceTree = "<group>";
@@ -1531,7 +1527,6 @@
 			isa = PBXGroup;
 			children = (
 				A7A7EE7411B98B8D0065A14F /* ASTBuilder.h */,
-				933A3499038AE7C6008635CE /* Grammar.y */,
 				A7A7EE7511B98B8D0065A14F /* JSParser.cpp */,
 				A7A7EE7611B98B8D0065A14F /* JSParser.h */,
 				93F1981A08245AAE001E9ABC /* Keywords.table */,
@@ -1967,7 +1962,6 @@
 				BC18C4050E16F5CD00B34460 /* FunctionPrototype.h in Headers */,
 				BC18C4060E16F5CD00B34460 /* GetPtr.h in Headers */,
 				BC257DF00E1F52ED0016B6C9 /* GlobalEvalFunction.h in Headers */,
-				BC18C5300E16FCEB00B34460 /* Grammar.h in Headers */,
 				BC18C4080E16F5CD00B34460 /* HashCountedSet.h in Headers */,
 				BC18C4090E16F5CD00B34460 /* HashFunctions.h in Headers */,
 				BC18C40A0E16F5CD00B34460 /* HashIterators.h in Headers */,
@@ -2192,6 +2186,7 @@
 				A784A26111D16622005776AC /* ASTBuilder.h in Headers */,
 				A784A26311D16622005776AC /* JSParser.h in Headers */,
 				A784A26411D16622005776AC /* SyntaxChecker.h in Headers */,
+				A7F19ECE11DD490900931E70 /* FixedArray.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2505,7 +2500,6 @@
 				147F39CC107EC37600427A48 /* FunctionPrototype.cpp in Sources */,
 				14280855107EC0E70013E7B2 /* GetterSetter.cpp in Sources */,
 				147F39CD107EC37600427A48 /* GlobalEvalFunction.cpp in Sources */,
-				148F21A3107EC5310042EC2C /* Grammar.cpp in Sources */,
 				65DFC93308EA173A00F7300B /* HashTable.cpp in Sources */,
 				147F39CE107EC37600427A48 /* Identifier.cpp in Sources */,
 				E178636D0D9BEEC300D74E75 /* InitializeThreading.cpp in Sources */,
diff --git a/JavaScriptCore/assembler/ARMv7Assembler.h b/JavaScriptCore/assembler/ARMv7Assembler.h
index f910d15..48eef53 100644
--- a/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -56,107 +56,122 @@ namespace ARMRegisters {
         r15, pc = r15,
     } RegisterID;
 
-    // s0 == d0 == q0
-    // s4 == d2 == q1
-    // etc
     typedef enum {
-        s0 = 0,
-        s1 = 1,
-        s2 = 2,
-        s3 = 3,
-        s4 = 4,
-        s5 = 5,
-        s6 = 6,
-        s7 = 7,
-        s8 = 8,
-        s9 = 9,
-        s10 = 10,
-        s11 = 11,
-        s12 = 12,
-        s13 = 13,
-        s14 = 14,
-        s15 = 15,
-        s16 = 16,
-        s17 = 17,
-        s18 = 18,
-        s19 = 19,
-        s20 = 20,
-        s21 = 21,
-        s22 = 22,
-        s23 = 23,
-        s24 = 24,
-        s25 = 25,
-        s26 = 26,
-        s27 = 27,
-        s28 = 28,
-        s29 = 29,
-        s30 = 30,
-        s31 = 31,
-        d0 = 0 << 1,
-        d1 = 1 << 1,
-        d2 = 2 << 1,
-        d3 = 3 << 1,
-        d4 = 4 << 1,
-        d5 = 5 << 1,
-        d6 = 6 << 1,
-        d7 = 7 << 1,
-        d8 = 8 << 1,
-        d9 = 9 << 1,
-        d10 = 10 << 1,
-        d11 = 11 << 1,
-        d12 = 12 << 1,
-        d13 = 13 << 1,
-        d14 = 14 << 1,
-        d15 = 15 << 1,
-        d16 = 16 << 1,
-        d17 = 17 << 1,
-        d18 = 18 << 1,
-        d19 = 19 << 1,
-        d20 = 20 << 1,
-        d21 = 21 << 1,
-        d22 = 22 << 1,
-        d23 = 23 << 1,
-        d24 = 24 << 1,
-        d25 = 25 << 1,
-        d26 = 26 << 1,
-        d27 = 27 << 1,
-        d28 = 28 << 1,
-        d29 = 29 << 1,
-        d30 = 30 << 1,
-        d31 = 31 << 1,
-        q0 = 0 << 2,
-        q1 = 1 << 2,
-        q2 = 2 << 2,
-        q3 = 3 << 2,
-        q4 = 4 << 2,
-        q5 = 5 << 2,
-        q6 = 6 << 2,
-        q7 = 7 << 2,
-        q8 = 8 << 2,
-        q9 = 9 << 2,
-        q10 = 10 << 2,
-        q11 = 11 << 2,
-        q12 = 12 << 2,
-        q13 = 13 << 2,
-        q14 = 14 << 2,
-        q15 = 15 << 2,
-        q16 = 16 << 2,
-        q17 = 17 << 2,
-        q18 = 18 << 2,
-        q19 = 19 << 2,
-        q20 = 20 << 2,
-        q21 = 21 << 2,
-        q22 = 22 << 2,
-        q23 = 23 << 2,
-        q24 = 24 << 2,
-        q25 = 25 << 2,
-        q26 = 26 << 2,
-        q27 = 27 << 2,
-        q28 = 28 << 2,
-        q29 = 29 << 2,
-        q30 = 30 << 2,
-        q31 = 31 << 2,
-    } FPRegisterID;
+        s0,
+        s1,
+        s2,
+        s3,
+        s4,
+        s5,
+        s6,
+        s7,
+        s8,
+        s9,
+        s10,
+        s11,
+        s12,
+        s13,
+        s14,
+        s15,
+        s16,
+        s17,
+        s18,
+        s19,
+        s20,
+        s21,
+        s22,
+        s23,
+        s24,
+        s25,
+        s26,
+        s27,
+        s28,
+        s29,
+        s30,
+        s31,
+    } FPSingleRegisterID;
+
+    typedef enum {
+        d0,
+        d1,
+        d2,
+        d3,
+        d4,
+        d5,
+        d6,
+        d7,
+        d8,
+        d9,
+        d10,
+        d11,
+        d12,
+        d13,
+        d14,
+        d15,
+        d16,
+        d17,
+        d18,
+        d19,
+        d20,
+        d21,
+        d22,
+        d23,
+        d24,
+        d25,
+        d26,
+        d27,
+        d28,
+        d29,
+        d30,
+        d31,
+    } FPDoubleRegisterID;
+
+    typedef enum {
+        q0,
+        q1,
+        q2,
+        q3,
+        q4,
+        q5,
+        q6,
+        q7,
+        q8,
+        q9,
+        q10,
+        q11,
+        q12,
+        q13,
+        q14,
+        q15,
+        q16,
+        q17,
+        q18,
+        q19,
+        q20,
+        q21,
+        q22,
+        q23,
+        q24,
+        q25,
+        q26,
+        q27,
+        q28,
+        q29,
+        q30,
+        q31,
+    } FPQuadRegisterID;
+
+    inline FPSingleRegisterID asSingle(FPDoubleRegisterID reg)
+    {
+        ASSERT(reg < d16);
+        return (FPSingleRegisterID)(reg << 1);
+    }
+
+    inline FPDoubleRegisterID asDouble(FPSingleRegisterID reg)
+    {
+        ASSERT(!(reg & 1));
+        return (FPDoubleRegisterID)(reg >> 1);
+    }
 }
 
 class ARMv7Assembler;
@@ -354,6 +369,39 @@ private:
     ThumbImmediateValue m_value;
 };
 
+class VFPImmediate {
+public:
+    VFPImmediate(double d)
+        : m_value(-1)
+    {
+        union {
+            uint64_t i;
+            double d;
+        } u;
+
+        u.d = d;
+
+        int sign = (u.i >> 63);
+        int exponent = (u.i >> 52) & 0x7ff;
+        uint64_t mantissa = u.i & 0x000fffffffffffffull;
+
+        if ((exponent >= 0x3fc) && (exponent <= 0x403) && !(mantissa & 0x0000ffffffffffffull))
+            m_value = (sign << 7) | ((exponent & 7) << 4) | (int)(mantissa >> 48);
+    }
+
+    bool isValid()
+    {
+        return m_value != -1;
+    }
+    
+    uint8_t value()
+    {
+        return (uint8_t)m_value;
+    }
+
+private:
+    int m_value;
+};
 
 typedef enum {
     SRType_LSL,
@@ -398,17 +446,6 @@ private:
 };
 
 
-/*
-Some features of the Thumb instruction set are deprecated in ARMv7. Deprecated features affecting 
-instructions supported by ARMv7-M are as follows: 
-• use of the PC as <Rd> or <Rm> in a 16-bit ADD (SP plus register) instruction 
-• use of the SP as <Rm> in a 16-bit ADD (SP plus register) instruction 
-• use of the SP as <Rm> in a 16-bit CMP (register) instruction 
-• use of MOV (register) instructions in which <Rd> is the SP or PC and <Rm> is also the SP or PC. 
-• use of <Rn> as the lowest-numbered register in the register list of a 16-bit STM instruction with base 
-register writeback 
-*/
-
 class ARMv7Assembler {
 public:
     ~ARMv7Assembler()
@@ -417,7 +454,9 @@ public:
     }
 
     typedef ARMRegisters::RegisterID RegisterID;
-    typedef ARMRegisters::FPRegisterID FPRegisterID;
+    typedef ARMRegisters::FPSingleRegisterID FPSingleRegisterID;
+    typedef ARMRegisters::FPDoubleRegisterID FPDoubleRegisterID;
+    typedef ARMRegisters::FPQuadRegisterID FPQuadRegisterID;
 
     // (HS, LO, HI, LS) -> (AE, B, A, BE)
     // (VS, VC) -> (O, NO)
@@ -503,53 +542,16 @@ private:
         return (reg == ARMRegisters::sp) || (reg == ARMRegisters::pc);
     }
 
-    bool isSingleRegister(FPRegisterID reg)
-    {
-        // Check that the high bit isn't set (q16+), and that the low bit isn't (s1, s3, etc).
-        return !(reg & ~31);
-    }
-
-    bool isDoubleRegister(FPRegisterID reg)
-    {
-        // Check that the high bit isn't set (q16+), and that the low bit isn't (s1, s3, etc).
-        return !(reg & ~(31 << 1));
-    }
-
-    bool isQuadRegister(FPRegisterID reg)
-    {
-        return !(reg & ~(31 << 2));
-    }
-
-    uint32_t singleRegisterNum(FPRegisterID reg)
-    {
-        ASSERT(isSingleRegister(reg));
-        return reg;
-    }
-
-    uint32_t doubleRegisterNum(FPRegisterID reg)
-    {
-        ASSERT(isDoubleRegister(reg));
-        return reg >> 1;
-    }
-
-    uint32_t quadRegisterNum(FPRegisterID reg)
-    {
-        ASSERT(isQuadRegister(reg));
-        return reg >> 2;
-    }
-
-    uint32_t singleRegisterMask(FPRegisterID rd, int highBitsShift, int lowBitShift)
+    uint32_t singleRegisterMask(FPSingleRegisterID rdNum, int highBitsShift, int lowBitShift)
     {
-        uint32_t rdNum = singleRegisterNum(rd);
         uint32_t rdMask = (rdNum >> 1) << highBitsShift;
         if (rdNum & 1)
             rdMask |= 1 << lowBitShift;
         return rdMask;
     }
 
-    uint32_t doubleRegisterMask(FPRegisterID rd, int highBitShift, int lowBitsShift)
+    uint32_t doubleRegisterMask(FPDoubleRegisterID rdNum, int highBitShift, int lowBitsShift)
     {
-        uint32_t rdNum = doubleRegisterNum(rd);
         uint32_t rdMask = (rdNum & 0xf) << lowBitsShift;
         if (rdNum & 16)
             rdMask |= 1 << highBitShift;
@@ -558,22 +560,17 @@ private:
 
     typedef enum {
         OP_ADD_reg_T1       = 0x1800,
-        OP_ADD_S_reg_T1     = 0x1800,
         OP_SUB_reg_T1       = 0x1A00,
-        OP_SUB_S_reg_T1     = 0x1A00,
         OP_ADD_imm_T1       = 0x1C00,
-        OP_ADD_S_imm_T1     = 0x1C00,
         OP_SUB_imm_T1       = 0x1E00,
-        OP_SUB_S_imm_T1     = 0x1E00,
         OP_MOV_imm_T1       = 0x2000,
         OP_CMP_imm_T1       = 0x2800,
         OP_ADD_imm_T2       = 0x3000,
-        OP_ADD_S_imm_T2     = 0x3000,
         OP_SUB_imm_T2       = 0x3800,
-        OP_SUB_S_imm_T2     = 0x3800,
         OP_AND_reg_T1       = 0x4000,
         OP_EOR_reg_T1       = 0x4040,
         OP_TST_reg_T1       = 0x4200,
+        OP_RSB_imm_T1       = 0x4240,
         OP_CMP_reg_T1       = 0x4280,
         OP_ORR_reg_T1       = 0x4300,
         OP_MVN_reg_T1       = 0x43C0,
@@ -603,6 +600,7 @@ private:
         OP_AND_reg_T2   = 0xEA00,
         OP_TST_reg_T2   = 0xEA10,
         OP_ORR_reg_T2   = 0xEA40,
+        OP_ORR_S_reg_T2 = 0xEA50,
         OP_ASR_imm_T1   = 0xEA4F,
         OP_LSL_imm_T1   = 0xEA4F,
         OP_LSR_imm_T1   = 0xEA4F,
@@ -614,6 +612,18 @@ private:
         OP_SUB_reg_T2   = 0xEBA0,
         OP_SUB_S_reg_T2 = 0xEBB0,
         OP_CMP_reg_T2   = 0xEBB0,
+        OP_VSTR         = 0xED00,
+        OP_VLDR         = 0xED10,
+        OP_VMOV_StoC    = 0xEE00,
+        OP_VMOV_CtoS    = 0xEE10,
+        OP_VMUL_T2      = 0xEE20,
+        OP_VADD_T2      = 0xEE30,
+        OP_VSUB_T2      = 0xEE30,
+        OP_VDIV         = 0xEE80,
+        OP_VCMP_T1      = 0xEEB0,
+        OP_VCVT_FPIVFP  = 0xEEB0,
+        OP_VMOV_IMM_T2  = 0xEEB0,
+        OP_VMRS         = 0xEEB0,
         OP_B_T4a        = 0xF000,
         OP_AND_imm_T1   = 0xF000,
         OP_TST_imm      = 0xF010,
@@ -627,6 +637,7 @@ private:
         OP_SUB_imm_T3   = 0xF1A0,
         OP_SUB_S_imm_T3 = 0xF1B0,
         OP_CMP_imm_T2   = 0xF1B0,
+        OP_RSB_imm_T2   = 0xF1C0,
         OP_ADD_imm_T4   = 0xF200,
         OP_MOV_imm_T3   = 0xF240,
         OP_SUB_imm_T4   = 0xF2A0,
@@ -652,8 +663,20 @@ private:
     } OpcodeID1;
 
     typedef enum {
-        OP_B_T4b        = 0x9000,
+        OP_VADD_T2b     = 0x0A00,
+        OP_VDIVb        = 0x0A00,
+        OP_VLDRb        = 0x0A00,
+        OP_VMOV_IMM_T2b = 0x0A00,
+        OP_VMUL_T2b     = 0x0A00,
+        OP_VSTRb        = 0x0A00,
+        OP_VMOV_CtoSb   = 0x0A10,
+        OP_VMOV_StoCb   = 0x0A10,
+        OP_VMRSb        = 0x0A10,
+        OP_VCMP_T1b     = 0x0A40,
+        OP_VCVT_FPIVFPb = 0x0A40,
+        OP_VSUB_T2b     = 0x0A40,
         OP_NOP_T2b      = 0x8000,
+        OP_B_T4b        = 0x9000,
     } OpcodeID2;
 
     struct FourFours {
@@ -784,10 +807,10 @@ public:
 
         if (!((rd | rn) & 8)) {
             if (imm.isUInt3()) {
-                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_S_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
                 return;
             } else if ((rd == rn) && imm.isUInt8()) {
-                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_S_imm_T2, rd, imm.getUInt8());
+                m_formatter.oneWordOp5Reg3Imm8(OP_ADD_imm_T2, rd, imm.getUInt8());
                 return;
             }
         }
@@ -809,7 +832,7 @@ public:
     void add_S(RegisterID rd, RegisterID rn, RegisterID rm)
     {
         if (!((rd | rn | rm) & 8))
-            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_S_reg_T1, rm, rn, rd);
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_ADD_reg_T1, rm, rn, rd);
         else
             add_S(rd, rn, rm, ShiftTypeAndAmount());
     }
@@ -1219,6 +1242,12 @@ public:
             mvn(rd, rm, ShiftTypeAndAmount());
     }
 
+    void neg(RegisterID rd, RegisterID rm)
+    {
+        ARMThumbImmediate zero = ARMThumbImmediate::makeUInt12(0);
+        sub(rd, zero, rm);
+    }
+
     void orr(RegisterID rd, RegisterID rn, ARMThumbImmediate imm)
     {
         ASSERT(!BadReg(rd));
@@ -1245,6 +1274,24 @@ public:
             orr(rd, rn, rm, ShiftTypeAndAmount());
     }
 
+    void orr_S(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
+    {
+        ASSERT(!BadReg(rd));
+        ASSERT(!BadReg(rn));
+        ASSERT(!BadReg(rm));
+        m_formatter.twoWordOp12Reg4FourFours(OP_ORR_S_reg_T2, rn, FourFours(shift.hi4(), rd, shift.lo4(), rm));
+    }
+
+    void orr_S(RegisterID rd, RegisterID rn, RegisterID rm)
+    {
+        if ((rd == rn) && !((rd | rm) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_ORR_reg_T1, rm, rd);
+        else if ((rd == rm) && !((rd | rn) & 8))
+            m_formatter.oneWordOp10Reg3Reg3(OP_ORR_reg_T1, rn, rd);
+        else
+            orr_S(rd, rn, rm, ShiftTypeAndAmount());
+    }
+
     void ror(RegisterID rd, RegisterID rm, int32_t shiftAmount)
     {
         ASSERT(!BadReg(rd));
@@ -1361,6 +1408,19 @@ public:
         }
     }
 
+    void sub(RegisterID rd, ARMThumbImmediate imm, RegisterID rn)
+    {
+        ASSERT(rd != ARMRegisters::pc);
+        ASSERT(rn != ARMRegisters::pc);
+        ASSERT(imm.isValid());
+        ASSERT(imm.isUInt12());
+
+        if (!((rd | rn) & 8) && !imm.getUInt12())
+            m_formatter.oneWordOp10Reg3Reg3(OP_RSB_imm_T1, rn, rd);
+        else
+            m_formatter.twoWordOp5i6Imm4Reg4EncodedImm(OP_RSB_imm_T2, rn, rd, imm);
+    }
+
     void sub(RegisterID rd, RegisterID rn, RegisterID rm, ShiftTypeAndAmount shift)
     {
         ASSERT((rd != ARMRegisters::sp) || (rn == ARMRegisters::sp));
@@ -1393,10 +1453,10 @@ public:
             return;
         } else if (!((rd | rn) & 8)) {
             if (imm.isUInt3()) {
-                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_S_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
+                m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_imm_T1, (RegisterID)imm.getUInt3(), rn, rd);
                 return;
             } else if ((rd == rn) && imm.isUInt8()) {
-                m_formatter.oneWordOp5Reg3Imm8(OP_SUB_S_imm_T2, rd, imm.getUInt8());
+                m_formatter.oneWordOp5Reg3Imm8(OP_SUB_imm_T2, rd, imm.getUInt8());
                 return;
             }
         }
@@ -1418,7 +1478,7 @@ public:
     void sub_S(RegisterID rd, RegisterID rn, RegisterID rm)
     {
         if (!((rd | rn | rm) & 8))
-            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_S_reg_T1, rm, rn, rd);
+            m_formatter.oneWordOp7Reg3Reg3Reg3(OP_SUB_reg_T1, rm, rn, rd);
         else
             sub_S(rd, rn, rm, ShiftTypeAndAmount());
     }
@@ -1446,62 +1506,75 @@ public:
             m_formatter.oneWordOp10Reg3Reg3(OP_TST_reg_T1, rm, rn);
     }
 
-    void vadd_F64(FPRegisterID rd, FPRegisterID rn, FPRegisterID rm)
+    void vadd_F64(FPDoubleRegisterID rd, FPDoubleRegisterID rn, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VADD_T2, OP_VADD_T2b, true, rn, rd, rm);
+    }
+
+    void vcmp_F64(FPDoubleRegisterID rd, FPDoubleRegisterID rm)
     {
-        m_formatter.vfpOp(0x0b00ee30 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rn, 23, 0) | doubleRegisterMask(rm, 21, 16));
+        m_formatter.vfpOp(OP_VCMP_T1, OP_VCMP_T1b, true, VFPOperand(4), rd, rm);
     }
 
-    void vcmp_F64(FPRegisterID rd, FPRegisterID rm)
+    void vcvt_F64_S32(FPDoubleRegisterID rd, FPSingleRegisterID rm)
     {
-        m_formatter.vfpOp(0x0bc0eeb4 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rm, 21, 16));
+        // boolean values are 64bit (toInt, unsigned, roundZero)
+        m_formatter.vfpOp(OP_VCVT_FPIVFP, OP_VCVT_FPIVFPb, true, vcvtOp(false, false, false), rd, rm);
     }
 
-    void vcvt_F64_S32(FPRegisterID fd, FPRegisterID sm)
+    void vcvtr_S32_F64(FPSingleRegisterID rd, FPDoubleRegisterID rm)
     {
-        m_formatter.vfpOp(0x0bc0eeb8 | doubleRegisterMask(fd, 6, 28) | singleRegisterMask(sm, 16, 21));
+        // boolean values are 64bit (toInt, unsigned, roundZero)
+        m_formatter.vfpOp(OP_VCVT_FPIVFP, OP_VCVT_FPIVFPb, true, vcvtOp(true, false, true), rd, rm);
     }
 
-    void vcvt_S32_F64(FPRegisterID sd, FPRegisterID fm)
+    void vdiv_F64(FPDoubleRegisterID rd, FPDoubleRegisterID rn, FPDoubleRegisterID rm)
     {
-        m_formatter.vfpOp(0x0bc0eebd | singleRegisterMask(sd, 28, 6) | doubleRegisterMask(fm, 21, 16));
+        m_formatter.vfpOp(OP_VDIV, OP_VDIVb, true, rn, rd, rm);
     }
 
-    void vldr(FPRegisterID rd, RegisterID rn, int32_t imm)
+    void vldr(FPDoubleRegisterID rd, RegisterID rn, int32_t imm)
     {
-        vmem(rd, rn, imm, true);
+        m_formatter.vfpMemOp(OP_VLDR, OP_VLDRb, true, rn, rd, imm);
     }
 
-    void vmov(RegisterID rd, FPRegisterID sn)
+    void vmov_F64_0(FPDoubleRegisterID rd)
     {
-        m_formatter.vfpOp(0x0a10ee10 | (rd << 28) | singleRegisterMask(sn, 0, 23));
+        m_formatter.vfpOp(OP_VMOV_IMM_T2, OP_VMOV_IMM_T2b, true, VFPOperand(0), rd, VFPOperand(0));
     }
 
-    void vmov(FPRegisterID sn, RegisterID rd)
+    void vmov(RegisterID rd, FPSingleRegisterID rn)
     {
-        m_formatter.vfpOp(0x0a10ee00 | (rd << 28) | singleRegisterMask(sn, 0, 23));
+        ASSERT(!BadReg(rd));
+        m_formatter.vfpOp(OP_VMOV_CtoS, OP_VMOV_CtoSb, false, rn, rd, VFPOperand(0));
     }
 
-    // move FPSCR flags to APSR.
-    void vmrs_APSR_nzcv_FPSCR()
+    void vmov(FPSingleRegisterID rd, RegisterID rn)
     {
-        m_formatter.vfpOp(0xfa10eef1);
+        ASSERT(!BadReg(rn));
+        m_formatter.vfpOp(OP_VMOV_StoC, OP_VMOV_StoCb, false, rd, rn, VFPOperand(0));
     }
 
-    void vmul_F64(FPRegisterID rd, FPRegisterID rn, FPRegisterID rm)
+    void vmrs(RegisterID reg = ARMRegisters::pc)
     {
-        m_formatter.vfpOp(0x0b00ee20 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rn, 23, 0) | doubleRegisterMask(rm, 21, 16));
+        ASSERT(reg != ARMRegisters::sp);
+        m_formatter.vfpOp(OP_VMRS, OP_VMRSb, false, VFPOperand(1), VFPOperand(0x10 | reg), VFPOperand(0));
     }
 
-    void vstr(FPRegisterID rd, RegisterID rn, int32_t imm)
+    void vmul_F64(FPDoubleRegisterID rd, FPDoubleRegisterID rn, FPDoubleRegisterID rm)
     {
-        vmem(rd, rn, imm, false);
+        m_formatter.vfpOp(OP_VMUL_T2, OP_VMUL_T2b, true, rn, rd, rm);
     }
 
-    void vsub_F64(FPRegisterID rd, FPRegisterID rn, FPRegisterID rm)
+    void vstr(FPDoubleRegisterID rd, RegisterID rn, int32_t imm)
     {
-        m_formatter.vfpOp(0x0b40ee30 | doubleRegisterMask(rd, 6, 28) | doubleRegisterMask(rn, 23, 0) | doubleRegisterMask(rm, 21, 16));
+        m_formatter.vfpMemOp(OP_VSTR, OP_VSTRb, true, rn, rd, imm);
     }
 
+    void vsub_F64(FPDoubleRegisterID rd, FPDoubleRegisterID rn, FPDoubleRegisterID rm)
+    {
+        m_formatter.vfpOp(OP_VSUB_T2, OP_VSUB_T2b, true, rn, rd, rm);
+    }
 
     JmpDst label()
     {
@@ -1654,36 +1727,83 @@ public:
     static void repatchLoadPtrToLEA(void* where)
     {
         ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
-
         uint16_t* loadOp = reinterpret_cast<uint16_t*>(where) + 4;
-        ASSERT((*loadOp & 0xfff0) == OP_LDR_reg_T2);
 
-        *loadOp = OP_ADD_reg_T3 | (*loadOp & 0xf);
-        ExecutableAllocator::cacheFlush(loadOp, sizeof(uint16_t));
+        ASSERT((loadOp[0] & 0xfff0) == OP_LDR_reg_T2);
+        ASSERT((loadOp[1] & 0x0ff0) == 0);
+        int rn = loadOp[0] & 0xf;
+        int rt = loadOp[1] >> 12;
+        int rm = loadOp[1] & 0xf;
+
+        loadOp[0] = OP_ADD_reg_T3 | rn;
+        loadOp[1] = rt << 8 | rm;
+        ExecutableAllocator::cacheFlush(loadOp, sizeof(uint32_t));
     }
 
 private:
+    // VFP operations commonly take one or more 5-bit operands, typically representing a
+    // floating point register number.  This will commonly be encoded in the instruction
+    // in two parts, with one single bit field, and one 4-bit field.  In the case of
+    // double precision operands the high bit of the register number will be encoded
+    // separately, and for single precision operands the high bit of the register number
+    // will be encoded individually.
+    // VFPOperand encapsulates a 5-bit VFP operand, with bits 0..3 containing the 4-bit
+    // field to be encoded together in the instruction (the low 4-bits of a double
+    // register number, or the high 4-bits of a single register number), and bit 4
+    // contains the bit value to be encoded individually.
+    struct VFPOperand {
+        explicit VFPOperand(uint32_t value)
+            : m_value(value)
+        {
+            ASSERT(!(m_value & ~0x1f));
+        }
 
-    // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
-    // (i.e. +/-(0..255) 32-bit words)
-    void vmem(FPRegisterID rd, RegisterID rn, int32_t imm, bool isLoad)
-    {
-        bool up;
-        uint32_t offset;
-        if (imm < 0) {
-            offset = -imm;
-            up = false;
-        } else {
-            offset = imm;
-            up = true;
+        VFPOperand(FPDoubleRegisterID reg)
+            : m_value(reg)
+        {
+        }
+
+        VFPOperand(RegisterID reg)
+            : m_value(reg)
+        {
         }
 
-        // offset is effectively leftshifted by 2 already (the bottom two bits are zero, and not
-        // reperesented in the instruction.  Left shift by 14, to mov it into position 0x00AA0000.
-        ASSERT((offset & ~(0xff << 2)) == 0);
-        offset <<= 14;
+        VFPOperand(FPSingleRegisterID reg)
+            : m_value(((reg & 1) << 4) | (reg >> 1)) // rotate the lowest bit of 'reg' to the top.
+        {
+        }
+
+        uint32_t bits1()
+        {
+            return m_value >> 4;
+        }
 
-        m_formatter.vfpOp(0x0b00ed00 | offset | (up << 7) | (isLoad << 4) | doubleRegisterMask(rd, 6, 28) | rn);
+        uint32_t bits4()
+        {
+            return m_value & 0xf;
+        }
+
+        uint32_t m_value;
+    };
+
+    VFPOperand vcvtOp(bool toInteger, bool isUnsigned, bool isRoundZero)
+    {
+        // Cannot specify rounding when converting to float.
+        ASSERT(toInteger || !isRoundZero);
+
+        uint32_t op = 0x8;
+        if (toInteger) {
+            // opc2 indicates both toInteger & isUnsigned.
+            op |= isUnsigned ? 0x4 : 0x5;
+            // 'op' field in instruction is isRoundZero
+            if (isRoundZero)
+                op |= 0x10;
+        } else {
+            // 'op' field in instruction is isUnsigned
+            if (!isUnsigned)
+                op |= 0x10;
+        }
+        return VFPOperand(op);
     }
 
     static void setInt32(void* code, uint32_t value)
@@ -1873,11 +1993,35 @@ private:
             m_buffer.putShort((reg2 << 12) | imm);
         }
 
-        void vfpOp(int32_t op)
+        // Formats up instructions of the pattern:
+        //    111111111B11aaaa:bbbb222SA2C2cccc
+        // Where 1s in the pattern come from op1, 2s in the pattern come from op2, S is the provided size bit.
+        // Operands provide 5 bit values of the form Aaaaa, Bbbbb, Ccccc.
+        void vfpOp(OpcodeID1 op1, OpcodeID2 op2, bool size, VFPOperand a, VFPOperand b, VFPOperand c)
         {
-            m_buffer.putInt(op);
+            ASSERT(!(op1 & 0x004f));
+            ASSERT(!(op2 & 0xf1af));
+            m_buffer.putShort(op1 | b.bits1() << 6 | a.bits4());
+            m_buffer.putShort(op2 | b.bits4() << 12 | size << 8 | a.bits1() << 7 | c.bits1() << 5 | c.bits4());
         }
 
+        // Arm vfp addresses can be offset by a 9-bit ones-comp immediate, left shifted by 2.
+        // (i.e. +/-(0..255) 32-bit words)
+        void vfpMemOp(OpcodeID1 op1, OpcodeID2 op2, bool size, RegisterID rn, VFPOperand rd, int32_t imm)
+        {
+            bool up = true;
+            if (imm < 0) {
+                imm = -imm;
+                up = false;
+            }
+            
+            uint32_t offset = imm;
+            ASSERT(!(offset & ~0x3fc));
+            offset >>= 2;
+
+            m_buffer.putShort(op1 | (up << 7) | rd.bits1() << 6 | rn);
+            m_buffer.putShort(op2 | rd.bits4() << 12 | size << 8 | offset);
+        }
 
         // Administrative methods:
 
diff --git a/JavaScriptCore/assembler/AbstractMacroAssembler.h b/JavaScriptCore/assembler/AbstractMacroAssembler.h
index 1c7f269..aab9089 100644
--- a/JavaScriptCore/assembler/AbstractMacroAssembler.h
+++ b/JavaScriptCore/assembler/AbstractMacroAssembler.h
@@ -49,7 +49,6 @@ public:
     class Jump;
 
     typedef typename AssemblerType::RegisterID RegisterID;
-    typedef typename AssemblerType::FPRegisterID FPRegisterID;
     typedef typename AssemblerType::JmpSrc JmpSrc;
     typedef typename AssemblerType::JmpDst JmpDst;
 
diff --git a/JavaScriptCore/assembler/MacroAssemblerARM.h b/JavaScriptCore/assembler/MacroAssemblerARM.h
index 7f11ca9..1c64071 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARM.h
+++ b/JavaScriptCore/assembler/MacroAssemblerARM.h
@@ -40,6 +40,8 @@ class MacroAssemblerARM : public AbstractMacroAssembler<ARMAssembler> {
     static const int DoubleConditionBitSpecial = 0x10;
     COMPILE_ASSERT(!(DoubleConditionBitSpecial & DoubleConditionMask), DoubleConditionBitSpecial_should_not_interfere_with_ARMAssembler_Condition_codes);
 public:
+    typedef ARMRegisters::FPRegisterID FPRegisterID;
+
     enum Condition {
         Equal = ARMAssembler::EQ,
         NotEqual = ARMAssembler::NE,
diff --git a/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index 380d5f8..64513fd 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -38,10 +38,13 @@ class MacroAssemblerARMv7 : public AbstractMacroAssembler<ARMv7Assembler> {
     // FIXME: switch dataTempRegister & addressTempRegister, or possibly use r7?
     //        - dTR is likely used more than aTR, and we'll get better instruction
     //        encoding if it's in the low 8 registers.
-    static const ARMRegisters::RegisterID dataTempRegister = ARMRegisters::ip;
+    static const RegisterID dataTempRegister = ARMRegisters::ip;
     static const RegisterID addressTempRegister = ARMRegisters::r3;
-    static const FPRegisterID fpTempRegister = ARMRegisters::d7;
 
+    static const ARMRegisters::FPDoubleRegisterID fpTempRegister = ARMRegisters::d7;
+    inline ARMRegisters::FPSingleRegisterID fpTempRegisterAsSingle() { return ARMRegisters::asSingle(fpTempRegister); }
+
+public:
     struct ArmAddress {
         enum AddressType {
             HasOffset,
@@ -73,6 +76,7 @@ class MacroAssemblerARMv7 : public AbstractMacroAssembler<ARMv7Assembler> {
     };
     
 public:
+    typedef ARMRegisters::FPDoubleRegisterID FPRegisterID;
 
     static const Scale ScalePtr = TimesFour;
 
@@ -222,6 +226,11 @@ public:
         m_assembler.smull(dest, dataTempRegister, src, dataTempRegister);
     }
 
+    void neg32(RegisterID srcDest)
+    {
+        m_assembler.neg(srcDest, srcDest);
+    }
+
     void not32(RegisterID srcDest)
     {
         m_assembler.mvn(srcDest, srcDest);
@@ -540,6 +549,12 @@ public:
         m_assembler.vldr(dest, base, offset);
     }
 
+    void loadDouble(const void* address, FPRegisterID dest)
+    {
+        move(ImmPtr(address), addressTempRegister);
+        m_assembler.vldr(dest, addressTempRegister, 0);
+    }
+
     void storeDouble(FPRegisterID src, ImplicitAddress address)
     {
         RegisterID base = address.base;
@@ -566,6 +581,11 @@ public:
         addDouble(fpTempRegister, dest);
     }
 
+    void divDouble(FPRegisterID src, FPRegisterID dest)
+    {
+        m_assembler.vdiv_F64(dest, dest, src);
+    }
+
     void subDouble(FPRegisterID src, FPRegisterID dest)
     {
         m_assembler.vsub_F64(dest, dest, src);
@@ -595,14 +615,30 @@ public:
 
     void convertInt32ToDouble(RegisterID src, FPRegisterID dest)
     {
-        m_assembler.vmov(fpTempRegister, src);
-        m_assembler.vcvt_F64_S32(dest, fpTempRegister);
+        m_assembler.vmov(fpTempRegisterAsSingle(), src);
+        m_assembler.vcvt_F64_S32(dest, fpTempRegisterAsSingle());
+    }
+
+    void convertInt32ToDouble(Address address, FPRegisterID dest)
+    {
+        // Fixme: load directly into the fpr!
+        load32(address, dataTempRegister);
+        m_assembler.vmov(fpTempRegisterAsSingle(), dataTempRegister);
+        m_assembler.vcvt_F64_S32(dest, fpTempRegisterAsSingle());
+    }
+
+    void convertInt32ToDouble(AbsoluteAddress address, FPRegisterID dest)
+    {
+        // Fixme: load directly into the fpr!
+        load32(address.m_ptr, dataTempRegister);
+        m_assembler.vmov(fpTempRegisterAsSingle(), dataTempRegister);
+        m_assembler.vcvt_F64_S32(dest, fpTempRegisterAsSingle());
     }
 
     Jump branchDouble(DoubleCondition cond, FPRegisterID left, FPRegisterID right)
     {
         m_assembler.vcmp_F64(left, right);
-        m_assembler.vmrs_APSR_nzcv_FPSCR();
+        m_assembler.vmrs();
 
         if (cond == DoubleNotEqual) {
             // ConditionNE jumps if NotEqual *or* unordered - force the unordered cases not to jump.
@@ -629,6 +665,27 @@ public:
         return jump();
     }
 
+    // Convert 'src' to an integer, and places the resulting 'dest'.
+    // If the result is not representable as a 32 bit value, branch.
+    // May also branch for some values that are representable in 32 bits
+    // (specifically, in this case, 0).
+    void branchConvertDoubleToInt32(FPRegisterID src, RegisterID dest, JumpList& failureCases, FPRegisterID)
+    {
+        m_assembler.vcvtr_S32_F64(fpTempRegisterAsSingle(), src);
+        m_assembler.vmov(dest, fpTempRegisterAsSingle());
+
+        // Convert the integer result back to float & compare to the original value - if not equal or unordered (NaN) then jump.
+        m_assembler.vcvt_F64_S32(fpTempRegister, fpTempRegisterAsSingle());
+        failureCases.append(branchDouble(DoubleNotEqualOrUnordered, src, fpTempRegister));
+
+        // If the result is zero, it might have been -0.0, and the double comparison won't catch this!
+        failureCases.append(branchTest32(Zero, dest));
+    }
+
+    void zeroDouble(FPRegisterID dest)
+    {
+        m_assembler.vmov_F64_0(dest);
+    }
 
     // Stack manipulation operations:
     //
@@ -970,6 +1027,13 @@ public:
         return branch32(NotEqual, addressTempRegister, dataTempRegister);
     }
 
+    Jump branchOr32(Condition cond, RegisterID src, RegisterID dest)
+    {
+        ASSERT((cond == Signed) || (cond == Zero) || (cond == NonZero));
+        m_assembler.orr_S(dest, dest, src);
+        return Jump(makeBranch(cond));
+    }
+
     Jump branchSub32(Condition cond, RegisterID src, RegisterID dest)
     {
         ASSERT((cond == Overflow) || (cond == Signed) || (cond == Zero) || (cond == NonZero));
@@ -1034,6 +1098,12 @@ public:
         m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
     }
 
+    void set32(Condition cond, Address left, RegisterID right, RegisterID dest)
+    {
+        load32(left, dataTempRegister);
+        set32(cond, dataTempRegister, right, dest);
+    }
+
     void set32(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
     {
         compare32(left, right);
@@ -1042,6 +1112,21 @@ public:
         m_assembler.mov(dest, ARMThumbImmediate::makeUInt16(0));
     }
 
+    void set8(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
+    {
+        set32(cond, left, right, dest);
+    }
+
+    void set8(Condition cond, Address left, RegisterID right, RegisterID dest)
+    {
+        set32(cond, left, right, dest);
+    }
+
+    void set8(Condition cond, RegisterID left, Imm32 right, RegisterID dest)
+    {
+        set32(cond, left, right, dest);
+    }
+
     // FIXME:
     // The mask should be optional... paerhaps the argument order should be
     // dest-src, operations always have a dest? ... possibly not true, considering
diff --git a/JavaScriptCore/assembler/MacroAssemblerMIPS.h b/JavaScriptCore/assembler/MacroAssemblerMIPS.h
index 88132f7..3bb9e75 100644
--- a/JavaScriptCore/assembler/MacroAssemblerMIPS.h
+++ b/JavaScriptCore/assembler/MacroAssemblerMIPS.h
@@ -36,6 +36,7 @@ namespace JSC {
 
 class MacroAssemblerMIPS : public AbstractMacroAssembler<MIPSAssembler> {
 public:
+    typedef MIPSRegisters::FPRegisterID FPRegisterID;
 
     MacroAssemblerMIPS()
         : m_fixedWidth(false)
diff --git a/JavaScriptCore/assembler/MacroAssemblerX86Common.h b/JavaScriptCore/assembler/MacroAssemblerX86Common.h
index 7296193..cb86da7 100644
--- a/JavaScriptCore/assembler/MacroAssemblerX86Common.h
+++ b/JavaScriptCore/assembler/MacroAssemblerX86Common.h
@@ -39,6 +39,7 @@ class MacroAssemblerX86Common : public AbstractMacroAssembler<X86Assembler> {
     static const int DoubleConditionBits = DoubleConditionBitInvert | DoubleConditionBitSpecial;
 
 public:
+    typedef X86Assembler::FPRegisterID FPRegisterID;
 
     enum Condition {
         Equal = X86Assembler::ConditionE,
diff --git a/JavaScriptCore/bytecode/Opcode.cpp b/JavaScriptCore/bytecode/Opcode.cpp
index bb7696d..8f7f01f 100644
--- a/JavaScriptCore/bytecode/Opcode.cpp
+++ b/JavaScriptCore/bytecode/Opcode.cpp
@@ -101,7 +101,7 @@ OpcodeStats::~OpcodeStats()
         for (int j = 0; j < numOpcodeIDs; ++j)
             totalInstructionPairs += opcodePairCounts[i][j];
 
-    int sortedIndices[numOpcodeIDs];    
+    FixedArray<int, numOpcodeIDs> sortedIndices;
     for (int i = 0; i < numOpcodeIDs; ++i)
         sortedIndices[i] = i;
     qsort(sortedIndices, numOpcodeIDs, sizeof(int), compareOpcodeIndices);
diff --git a/JavaScriptCore/interpreter/Interpreter.cpp b/JavaScriptCore/interpreter/Interpreter.cpp
index 7c5bc6f..8160249 100644
--- a/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/JavaScriptCore/interpreter/Interpreter.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
  *
  * Redistribution and use in source and binary forms, with or without
@@ -3693,9 +3693,10 @@ skip_id_custom_self:
         int argsOffset = vPC[2].u.operand;
         
         JSValue arguments = callFrame->r(argsOffset).jsValue();
-        int32_t argCount = 0;
+        uint32_t argCount = 0;
         if (!arguments) {
             argCount = (uint32_t)(callFrame->argumentCount());
+            argCount = min<uint32_t>(argCount, Arguments::MaxArguments);
             int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
             Register* newEnd = callFrame->registers() + sizeDelta;
             if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -3703,9 +3704,9 @@ skip_id_custom_self:
                 goto vm_throw;
             }
             ASSERT(!asFunction(callFrame->callee())->isHostFunction());
-            int32_t expectedParams = asFunction(callFrame->callee())->jsExecutable()->parameterCount();
-            int32_t inplaceArgs = min(argCount, expectedParams);
-            int32_t i = 0;
+            uint32_t expectedParams = asFunction(callFrame->callee())->jsExecutable()->parameterCount();
+            uint32_t inplaceArgs = min(argCount, expectedParams);
+            uint32_t i = 0;
             Register* argStore = callFrame->registers() + argsOffset;
 
             // First step is to copy the "expected" parameters from their normal location relative to the callframe
@@ -3722,6 +3723,7 @@ skip_id_custom_self:
             if (asObject(arguments)->classInfo() == &Arguments::info) {
                 Arguments* args = asArguments(arguments);
                 argCount = args->numProvidedArguments(callFrame);
+                argCount = min<uint32_t>(argCount, Arguments::MaxArguments);
                 int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
                 Register* newEnd = callFrame->registers() + sizeDelta;
                 if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -3732,6 +3734,7 @@ skip_id_custom_self:
             } else if (isJSArray(&callFrame->globalData(), arguments)) {
                 JSArray* array = asArray(arguments);
                 argCount = array->length();
+                argCount = min<uint32_t>(argCount, Arguments::MaxArguments);
                 int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
                 Register* newEnd = callFrame->registers() + sizeDelta;
                 if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -3742,6 +3745,7 @@ skip_id_custom_self:
             } else if (asObject(arguments)->inherits(&JSArray::info)) {
                 JSObject* argObject = asObject(arguments);
                 argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+                argCount = min<uint32_t>(argCount, Arguments::MaxArguments);
                 int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
                 Register* newEnd = callFrame->registers() + sizeDelta;
                 if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -3749,7 +3753,7 @@ skip_id_custom_self:
                     goto vm_throw;
                 }
                 Register* argsBuffer = callFrame->registers() + argsOffset;
-                for (int32_t i = 0; i < argCount; ++i) {
+                for (uint32_t i = 0; i < argCount; ++i) {
                     argsBuffer[i] = asObject(arguments)->get(callFrame, i);
                     CHECK_FOR_EXCEPTION();
                 }
diff --git a/JavaScriptCore/jit/JITOpcodes.cpp b/JavaScriptCore/jit/JITOpcodes.cpp
index 9a34931..8e86d40 100644
--- a/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/JavaScriptCore/jit/JITOpcodes.cpp
@@ -241,6 +241,37 @@ JIT::Label JIT::privateCompileCTINativeCall(JSGlobalData* globalData, bool isCon
 
     restoreReturnAddressBeforeReturn(regT3);
 
+#elif CPU(MIPS)
+    // Load caller frame's scope chain into this callframe so that whatever we call can
+    // get to its global data.
+    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT0);
+    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT0);
+    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);
+
+    preserveReturnAddressAfterCall(regT3); // Callee preserved
+    emitPutToCallFrameHeader(regT3, RegisterFile::ReturnPC);
+
+    // Calling convention:      f(a0, a1, a2, a3);
+    // Host function signature: f(ExecState*);
+
+    // Allocate stack space for 16 bytes (8-byte aligned)
+    // 16 bytes (unused) for 4 arguments
+    subPtr(Imm32(16), stackPointerRegister);
+
+    // Setup arg0
+    move(callFrameRegister, MIPSRegisters::a0);
+
+    // Call
+    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, MIPSRegisters::a2);
+    loadPtr(Address(MIPSRegisters::a2, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);
+    move(regT0, callFrameRegister); // Eagerly restore caller frame register to avoid loading from stack.
+    call(Address(regT2, executableOffsetToFunction));
+
+    // Restore stack space
+    addPtr(Imm32(16), stackPointerRegister);
+
+    restoreReturnAddressBeforeReturn(regT3);
+
 #elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)
 #error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."
 #else
diff --git a/JavaScriptCore/jit/JITStubs.cpp b/JavaScriptCore/jit/JITStubs.cpp
index c4a6507..30a9898 100644
--- a/JavaScriptCore/jit/JITStubs.cpp
+++ b/JavaScriptCore/jit/JITStubs.cpp
@@ -1531,17 +1531,18 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_self_fail)
         if (stubInfo->accessType == access_get_by_id_self) {
             ASSERT(!stubInfo->stubRoutine);
             polymorphicStructureList = new PolymorphicAccessStructureList(CodeLocationLabel(), stubInfo->u.getByIdSelf.baseObjectStructure);
-            stubInfo->initGetByIdSelfList(polymorphicStructureList, 2);
+            stubInfo->initGetByIdSelfList(polymorphicStructureList, 1);
         } else {
             polymorphicStructureList = stubInfo->u.getByIdSelfList.structureList;
             listIndex = stubInfo->u.getByIdSelfList.listSize;
-            stubInfo->u.getByIdSelfList.listSize++;
         }
+        if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
+            stubInfo->u.getByIdSelfList.listSize++;
+            JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), ident, slot, slot.cachedOffset());
 
-        JIT::compileGetByIdSelfList(callFrame->scopeChain()->globalData, codeBlock, stubInfo, polymorphicStructureList, listIndex, asCell(baseValue)->structure(), ident, slot, slot.cachedOffset());
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
+            if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+                ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
+        }
     } else
         ctiPatchCallByReturnAddress(callFrame->codeBlock(), STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_generic));
     return JSValue::encode(result);
@@ -1566,13 +1567,14 @@ static PolymorphicAccessStructureList* getPolymorphicAccessStructureListSlot(Str
     case access_get_by_id_proto_list:
         prototypeStructureList = stubInfo->u.getByIdProtoList.structureList;
         listIndex = stubInfo->u.getByIdProtoList.listSize;
-        stubInfo->u.getByIdProtoList.listSize++;
+        if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE)
+            stubInfo->u.getByIdProtoList.listSize++;
         break;
     default:
         ASSERT_NOT_REACHED();
     }
     
-    ASSERT(listIndex < POLYMORPHIC_LIST_CACHE_SIZE);
+    ASSERT(listIndex <= POLYMORPHIC_LIST_CACHE_SIZE);
     return prototypeStructureList;
 }
 
@@ -1647,21 +1649,24 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_get_by_id_proto_list)
 
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+        if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
+            JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset);
 
-        JIT::compileGetByIdProtoList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, slotBaseObject->structure(), propertyName, slot, offset);
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+            if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+                ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+        }
     } else if (size_t count = normalizePrototypeChain(callFrame, baseValue, slot.slotBase(), propertyName, offset)) {
         ASSERT(!asCell(baseValue)->structure()->isDictionary());
         int listIndex;
         PolymorphicAccessStructureList* prototypeStructureList = getPolymorphicAccessStructureListSlot(stubInfo, listIndex);
+        
+        if (listIndex < POLYMORPHIC_LIST_CACHE_SIZE) {
+            StructureChain* protoChain = structure->prototypeChain(callFrame);
+            JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, propertyName, slot, offset);
 
-        StructureChain* protoChain = structure->prototypeChain(callFrame);
-        JIT::compileGetByIdChainList(callFrame->scopeChain()->globalData, callFrame, codeBlock, stubInfo, prototypeStructureList, listIndex, structure, protoChain, count, propertyName, slot, offset);
-
-        if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
-            ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+            if (listIndex == (POLYMORPHIC_LIST_CACHE_SIZE - 1))
+                ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_list_full));
+        }
     } else
         ctiPatchCallByReturnAddress(codeBlock, STUB_RETURN_ADDRESS, FunctionPtr(cti_op_get_by_id_proto_fail));
 
@@ -2452,6 +2457,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
     if (!arguments) {
         int providedParams = callFrame->registers()[RegisterFile::ArgumentCount].i() - 1;
         argCount = providedParams;
+        argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments));
         int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
         Register* newEnd = callFrame->registers() + sizeDelta;
         if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -2487,6 +2493,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
         if (asObject(arguments)->classInfo() == &Arguments::info) {
             Arguments* argsObject = asArguments(arguments);
             argCount = argsObject->numProvidedArguments(callFrame);
+            argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments));
             int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
             Register* newEnd = callFrame->registers() + sizeDelta;
             if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -2497,6 +2504,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
         } else if (isJSArray(&callFrame->globalData(), arguments)) {
             JSArray* array = asArray(arguments);
             argCount = array->length();
+            argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments));
             int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
             Register* newEnd = callFrame->registers() + sizeDelta;
             if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
@@ -2507,6 +2515,7 @@ DEFINE_STUB_FUNCTION(int, op_load_varargs)
         } else if (asObject(arguments)->inherits(&JSArray::info)) {
             JSObject* argObject = asObject(arguments);
             argCount = argObject->get(callFrame, callFrame->propertyNames().length).toUInt32(callFrame);
+            argCount = min(argCount, static_cast<uint32_t>(Arguments::MaxArguments));
             int32_t sizeDelta = argsOffset + argCount + RegisterFile::CallFrameHeaderSize;
             Register* newEnd = callFrame->registers() + sizeDelta;
             if (!registerFile->grow(newEnd) || ((newEnd - callFrame->registers()) != sizeDelta)) {
diff --git a/JavaScriptCore/parser/Grammar.y b/JavaScriptCore/parser/Grammar.y
deleted file mode 100644
index 4d6e7d1..0000000
--- a/JavaScriptCore/parser/Grammar.y
+++ /dev/null
@@ -1,2099 +0,0 @@
-%pure_parser
-
-%{
-
-/*
- *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
- *  Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
- *  Copyright (C) 2007 Eric Seidel <eric@webkit.org>
- *
- *  This library is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU Lesser General Public
- *  License as published by the Free Software Foundation; either
- *  version 2 of the License, or (at your option) any later version.
- *
- *  This library is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- *  Lesser General Public License for more details.
- *
- *  You should have received a copy of the GNU Lesser General Public
- *  License along with this library; if not, write to the Free Software
- *  Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301  USA
- *
- */
-
-#include "config.h"
-
-#include "JSObject.h"
-#include "JSString.h"
-#include "Lexer.h"
-#include "NodeConstructors.h"
-#include "NodeInfo.h"
-#include <stdlib.h>
-#include <string.h>
-#include <wtf/MathExtras.h>
-
-#define YYMALLOC fastMalloc
-#define YYFREE fastFree
-
-#define YYMAXDEPTH 10000
-#define YYENABLE_NLS 0
-
-// Default values for bison.
-#define YYDEBUG 0 // Set to 1 to debug a parse error.
-#define jscyydebug 0 // Set to 1 to debug a parse error.
-#if !OS(DARWIN)
-// Avoid triggering warnings in older bison by not setting this on the Darwin platform.
-// FIXME: Is this still needed?
-#define YYERROR_VERBOSE
-#endif
-
-int jscyyerror(const char*);
-
-static inline bool allowAutomaticSemicolon(JSC::Lexer&, int);
-
-#define GLOBAL_DATA static_cast<JSGlobalData*>(globalPtr)
-#define AUTO_SEMICOLON do { if (!allowAutomaticSemicolon(*GLOBAL_DATA->lexer, yychar)) YYABORT; } while (0)
-
-using namespace JSC;
-using namespace std;
-
-static ExpressionNode* makeAssignNode(JSGlobalData*, ExpressionNode* left, Operator, ExpressionNode* right, bool leftHasAssignments, bool rightHasAssignments, int start, int divot, int end);
-static ExpressionNode* makePrefixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
-static ExpressionNode* makePostfixNode(JSGlobalData*, ExpressionNode*, Operator, int start, int divot, int end);
-static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData*, const Identifier& getOrSet, const Identifier& name, ParameterNode*, FunctionBodyNode*, const SourceCode&);
-static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData*, ExpressionNodeInfo function, ArgumentsNodeInfo, int start, int divot, int end);
-static ExpressionNode* makeTypeOfNode(JSGlobalData*, ExpressionNode*);
-static ExpressionNode* makeDeleteNode(JSGlobalData*, ExpressionNode*, int start, int divot, int end);
-static ExpressionNode* makeNegateNode(JSGlobalData*, ExpressionNode*);
-static NumberNode* makeNumberNode(JSGlobalData*, double);
-static ExpressionNode* makeBitwiseNotNode(JSGlobalData*, ExpressionNode*);
-static ExpressionNode* makeMultNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeDivNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeAddNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeSubNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeLeftShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static ExpressionNode* makeRightShiftNode(JSGlobalData*, ExpressionNode* left, ExpressionNode* right, bool rightHasAssignments);
-static StatementNode* makeVarStatementNode(JSGlobalData*, ExpressionNode*);
-static ExpressionNode* combineCommaNodes(JSGlobalData*, ExpressionNode* list, ExpressionNode* init);
-
-#if COMPILER(MSVC)
-
-#pragma warning(disable: 4065)
-#pragma warning(disable: 4244)
-#pragma warning(disable: 4702)
-
-#endif
-
-#define YYPARSE_PARAM globalPtr
-#define YYLEX_PARAM globalPtr
-
-template <typename T> inline NodeDeclarationInfo<T> createNodeDeclarationInfo(T node,
-    ParserArenaData<DeclarationStacks::VarStack>* varDecls,
-    ParserArenaData<DeclarationStacks::FunctionStack>* funcDecls,
-    CodeFeatures info, int numConstants) 
-{
-    ASSERT((info & ~AllFeatures) == 0);
-    NodeDeclarationInfo<T> result = { node, varDecls, funcDecls, info, numConstants };
-    return result;
-}
-
-template <typename T> inline NodeInfo<T> createNodeInfo(T node, CodeFeatures info, int numConstants)
-{
-    ASSERT((info & ~AllFeatures) == 0);
-    NodeInfo<T> result = { node, info, numConstants };
-    return result;
-}
-
-template <typename T> inline T mergeDeclarationLists(T decls1, T decls2) 
-{
-    // decls1 or both are null
-    if (!decls1)
-        return decls2;
-    // only decls1 is non-null
-    if (!decls2)
-        return decls1;
-
-    // Both are non-null
-    decls1->data.append(decls2->data);
-    
-    // Manually release as much as possible from the now-defunct declaration lists
-    // to avoid accumulating so many unused heap allocated vectors.
-    decls2->data.clear();
-
-    return decls1;
-}
-
-static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, const Identifier& ident, unsigned attrs)
-{
-    if (!varDecls)
-        varDecls = new (globalData) ParserArenaData<DeclarationStacks::VarStack>;
-
-    varDecls->data.append(make_pair(&ident, attrs));
-}
-
-static inline void appendToVarDeclarationList(JSGlobalData* globalData, ParserArenaData<DeclarationStacks::VarStack>*& varDecls, ConstDeclNode* decl)
-{
-    unsigned attrs = DeclarationStacks::IsConstant;
-    if (decl->hasInitializer())
-        attrs |= DeclarationStacks::HasInitializer;        
-    appendToVarDeclarationList(globalData, varDecls, decl->ident(), attrs);
-}
-
-%}
-
-%union {
-    int                 intValue;
-    double              doubleValue;
-    const Identifier*   ident;
-
-    // expression subtrees
-    ExpressionNodeInfo  expressionNode;
-    FuncDeclNodeInfo    funcDeclNode;
-    PropertyNodeInfo    propertyNode;
-    ArgumentsNodeInfo   argumentsNode;
-    ConstDeclNodeInfo   constDeclNode;
-    CaseBlockNodeInfo   caseBlockNode;
-    CaseClauseNodeInfo  caseClauseNode;
-    FuncExprNodeInfo    funcExprNode;
-
-    // statement nodes
-    StatementNodeInfo   statementNode;
-    FunctionBodyNode*   functionBodyNode;
-    ProgramNode*        programNode;
-
-    SourceElementsInfo  sourceElements;
-    PropertyListInfo    propertyList;
-    ArgumentListInfo    argumentList;
-    VarDeclListInfo     varDeclList;
-    ConstDeclListInfo   constDeclList;
-    ClauseListInfo      clauseList;
-    ElementListInfo     elementList;
-    ParameterListInfo   parameterList;
-
-    Operator            op;
-}
-
-%{
-
-template <typename T> inline void setStatementLocation(StatementNode* statement, const T& start, const T& end)
-{
-    statement->setLoc(start.first_line, end.last_line);
-}
-
-static inline void setExceptionLocation(ThrowableExpressionData* node, unsigned start, unsigned divot, unsigned end)
-{
-    node->setExceptionSourceCode(divot, divot - start, end - divot);
-}
-
-%}
-
-%start Program
-
-/* literals */
-%token NULLTOKEN TRUETOKEN FALSETOKEN
-
-/* keywords */
-%token BREAK CASE DEFAULT FOR NEW VAR CONSTTOKEN CONTINUE
-%token FUNCTION RETURN VOIDTOKEN DELETETOKEN
-%token IF THISTOKEN DO WHILE INTOKEN INSTANCEOF TYPEOF
-%token SWITCH WITH RESERVED
-%token THROW TRY CATCH FINALLY
-%token DEBUGGER
-
-/* give an if without an else higher precedence than an else to resolve the ambiguity */
-%nonassoc IF_WITHOUT_ELSE
-%nonassoc ELSE
-
-/* punctuators */
-%token EQEQ NE                     /* == and != */
-%token STREQ STRNEQ                /* === and !== */
-%token LE GE                       /* < and > */
-%token OR AND                      /* || and && */
-%token PLUSPLUS MINUSMINUS         /* ++ and --  */
-%token LSHIFT                      /* << */
-%token RSHIFT URSHIFT              /* >> and >>> */
-%token PLUSEQUAL MINUSEQUAL        /* += and -= */
-%token MULTEQUAL DIVEQUAL          /* *= and /= */
-%token LSHIFTEQUAL                 /* <<= */
-%token RSHIFTEQUAL URSHIFTEQUAL    /* >>= and >>>= */
-%token ANDEQUAL MODEQUAL           /* &= and %= */
-%token XOREQUAL OREQUAL            /* ^= and |= */
-%token <intValue> OPENBRACE        /* { (with char offset) */
-%token <intValue> CLOSEBRACE       /* } (with char offset) */
-
-/* terminal types */
-%token <doubleValue> NUMBER
-%token <ident> IDENT STRING
-
-/* automatically inserted semicolon */
-%token AUTOPLUSPLUS AUTOMINUSMINUS
-
-/* non-terminal types */
-%type <expressionNode>  Literal ArrayLiteral
-
-%type <expressionNode>  PrimaryExpr PrimaryExprNoBrace
-%type <expressionNode>  MemberExpr MemberExprNoBF /* BF => brace or function */
-%type <expressionNode>  NewExpr NewExprNoBF
-%type <expressionNode>  CallExpr CallExprNoBF
-%type <expressionNode>  LeftHandSideExpr LeftHandSideExprNoBF
-%type <expressionNode>  PostfixExpr PostfixExprNoBF
-%type <expressionNode>  UnaryExpr UnaryExprNoBF UnaryExprCommon
-%type <expressionNode>  MultiplicativeExpr MultiplicativeExprNoBF
-%type <expressionNode>  AdditiveExpr AdditiveExprNoBF
-%type <expressionNode>  ShiftExpr ShiftExprNoBF
-%type <expressionNode>  RelationalExpr RelationalExprNoIn RelationalExprNoBF
-%type <expressionNode>  EqualityExpr EqualityExprNoIn EqualityExprNoBF
-%type <expressionNode>  BitwiseANDExpr BitwiseANDExprNoIn BitwiseANDExprNoBF
-%type <expressionNode>  BitwiseXORExpr BitwiseXORExprNoIn BitwiseXORExprNoBF
-%type <expressionNode>  BitwiseORExpr BitwiseORExprNoIn BitwiseORExprNoBF
-%type <expressionNode>  LogicalANDExpr LogicalANDExprNoIn LogicalANDExprNoBF
-%type <expressionNode>  LogicalORExpr LogicalORExprNoIn LogicalORExprNoBF
-%type <expressionNode>  ConditionalExpr ConditionalExprNoIn ConditionalExprNoBF
-%type <expressionNode>  AssignmentExpr AssignmentExprNoIn AssignmentExprNoBF
-%type <expressionNode>  Expr ExprNoIn ExprNoBF
-
-%type <expressionNode>  ExprOpt ExprNoInOpt
-
-%type <statementNode>   Statement Block
-%type <statementNode>   VariableStatement ConstStatement EmptyStatement ExprStatement
-%type <statementNode>   IfStatement IterationStatement ContinueStatement
-%type <statementNode>   BreakStatement ReturnStatement WithStatement
-%type <statementNode>   SwitchStatement LabelledStatement
-%type <statementNode>   ThrowStatement TryStatement
-%type <statementNode>   DebuggerStatement
-
-%type <expressionNode>  Initializer InitializerNoIn
-%type <statementNode>   FunctionDeclaration
-%type <funcExprNode>    FunctionExpr
-%type <functionBodyNode> FunctionBody
-%type <sourceElements>  SourceElements
-%type <parameterList>   FormalParameterList
-%type <op>              AssignmentOperator
-%type <argumentsNode>   Arguments
-%type <argumentList>    ArgumentList
-%type <varDeclList>     VariableDeclarationList VariableDeclarationListNoIn
-%type <constDeclList>   ConstDeclarationList
-%type <constDeclNode>   ConstDeclaration
-%type <caseBlockNode>   CaseBlock
-%type <caseClauseNode>  CaseClause DefaultClause
-%type <clauseList>      CaseClauses CaseClausesOpt
-%type <intValue>        Elision ElisionOpt
-%type <elementList>     ElementList
-%type <propertyNode>    Property
-%type <propertyList>    PropertyList
-%%
-
-// FIXME: There are currently two versions of the grammar in this file, the normal one, and the NoNodes version used for
-// lazy recompilation of FunctionBodyNodes.  We should move to generating the two versions from a script to avoid bugs.
-// In the mean time, make sure to make any changes to the grammar in both versions.
-
-Literal:
-    NULLTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NullNode(GLOBAL_DATA), 0, 1); }
-  | TRUETOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, true), 0, 1); }
-  | FALSETOKEN                          { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BooleanNode(GLOBAL_DATA, false), 0, 1); }
-  | NUMBER                              { $$ = createNodeInfo<ExpressionNode*>(makeNumberNode(GLOBAL_DATA, $1), 0, 1); }
-  | STRING                              { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StringNode(GLOBAL_DATA, *$1), 0, 1); }
-  | '/' /* regexp */                    {
-                                            Lexer& l = *GLOBAL_DATA->lexer;
-                                            const Identifier* pattern;
-                                            const Identifier* flags;
-                                            if (!l.scanRegExp(pattern, flags))
-                                                YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
-                                            int size = pattern->size() + 2; // + 2 for the two /'s
-                                            setExceptionLocation(node, @1.first_column, @1.first_column + size, @1.first_column + size);
-                                            $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
-                                        }
-  | DIVEQUAL /* regexp with /= */       {
-                                            Lexer& l = *GLOBAL_DATA->lexer;
-                                            const Identifier* pattern;
-                                            const Identifier* flags;
-                                            if (!l.scanRegExp(pattern, flags, '='))
-                                                YYABORT;
-                                            RegExpNode* node = new (GLOBAL_DATA) RegExpNode(GLOBAL_DATA, *pattern, *flags);
-                                            int size = pattern->size() + 2; // + 2 for the two /'s
-                                            setExceptionLocation(node, @1.first_column, @1.first_column + size, @1.first_column + size);
-                                            $$ = createNodeInfo<ExpressionNode*>(node, 0, 0);
-                                        }
-;
-
-Property:
-    IDENT ':' AssignmentExpr            { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | STRING ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, *$1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | NUMBER ':' AssignmentExpr           { $$ = createNodeInfo<PropertyNode*>(new (GLOBAL_DATA) PropertyNode(GLOBAL_DATA, $1, $3.m_node, PropertyNode::Constant), $3.m_features, $3.m_numConstants); }
-  | IDENT IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE    { $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *$1, *$2, 0, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); setStatementLocation($6, @5, @7); if (!$$.m_node) YYABORT; }
-  | IDENT IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
-                                                             {
-                                                                 $$ = createNodeInfo<PropertyNode*>(makeGetterOrSetterPropertyNode(GLOBAL_DATA, *$1, *$2, $4.m_node.head, $7, GLOBAL_DATA->lexer->sourceCode($6, $8, @6.first_line)), $4.m_features | ClosureFeature, 0); 
-                                                                 if ($4.m_features & ArgumentsFeature)
-                                                                     $7->setUsesArguments(); 
-                                                                 setStatementLocation($7, @6, @8); 
-                                                                 if (!$$.m_node) 
-                                                                     YYABORT; 
-                                                             }
-;
-
-PropertyList:
-    Property                            { $$.m_node.head = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, $1.m_node); 
-                                          $$.m_node.tail = $$.m_node.head;
-                                          $$.m_features = $1.m_features;
-                                          $$.m_numConstants = $1.m_numConstants; }
-  | PropertyList ',' Property           { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new (GLOBAL_DATA) PropertyListNode(GLOBAL_DATA, $3.m_node, $1.m_node.tail);
-                                          $$.m_features = $1.m_features | $3.m_features;
-                                          $$.m_numConstants = $1.m_numConstants + $3.m_numConstants; }
-;
-
-PrimaryExpr:
-    PrimaryExprNoBrace
-  | OPENBRACE CLOSEBRACE                             { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA), 0, 0); }
-  | OPENBRACE PropertyList CLOSEBRACE                { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
-  /* allow extra comma, see http://bugs.webkit.org/show_bug.cgi?id=5939 */
-  | OPENBRACE PropertyList ',' CLOSEBRACE            { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ObjectLiteralNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
-;
-
-PrimaryExprNoBrace:
-    THISTOKEN                           { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ThisNode(GLOBAL_DATA), ThisFeature, 0); }
-  | Literal
-  | ArrayLiteral
-  | IDENT                               { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ResolveNode(GLOBAL_DATA, *$1, @1.first_column), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
-  | '(' Expr ')'                        { $$ = $2; }
-;
-
-ArrayLiteral:
-    '[' ElisionOpt ']'                  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $2), 0, $2 ? 1 : 0); }
-  | '[' ElementList ']'                 { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
-  | '[' ElementList ',' ElisionOpt ']'  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ArrayNode(GLOBAL_DATA, $4, $2.m_node.head), $2.m_features, $4 ? $2.m_numConstants + 1 : $2.m_numConstants); }
-;
-
-ElementList:
-    ElisionOpt AssignmentExpr           { $$.m_node.head = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, $1, $2.m_node);
-                                          $$.m_node.tail = $$.m_node.head;
-                                          $$.m_features = $2.m_features;
-                                          $$.m_numConstants = $2.m_numConstants; }
-  | ElementList ',' ElisionOpt AssignmentExpr
-                                        { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new (GLOBAL_DATA) ElementNode(GLOBAL_DATA, $1.m_node.tail, $3, $4.m_node);
-                                          $$.m_features = $1.m_features | $4.m_features;
-                                          $$.m_numConstants = $1.m_numConstants + $4.m_numConstants; }
-;
-
-ElisionOpt:
-    /* nothing */                       { $$ = 0; }
-  | Elision
-;
-
-Elision:
-    ','                                 { $$ = 1; }
-  | Elision ','                         { $$ = $1 + 1; }
-;
-
-MemberExpr:
-    PrimaryExpr
-  | FunctionExpr                        { $$ = createNodeInfo<ExpressionNode*>($1.m_node, $1.m_features, $1.m_numConstants); }
-  | MemberExpr '[' Expr ']'             { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
-                                        }
-  | MemberExpr '.' IDENT                { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
-                                        }
-  | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @3.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
-                                        }
-;
-
-MemberExprNoBF:
-    PrimaryExprNoBrace
-  | MemberExprNoBF '[' Expr ']'         { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
-                                        }
-  | MemberExprNoBF '.' IDENT            { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants);
-                                        }
-  | NEW MemberExpr Arguments            { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node, $3.m_node);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @3.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features | $3.m_features, $2.m_numConstants + $3.m_numConstants);
-                                        }
-;
-
-NewExpr:
-    MemberExpr
-  | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants); 
-                                        }
-;
-
-NewExprNoBF:
-    MemberExprNoBF
-  | NEW NewExpr                         { NewExprNode* node = new (GLOBAL_DATA) NewExprNode(GLOBAL_DATA, $2.m_node);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $2.m_features, $2.m_numConstants);
-                                        }
-;
-
-CallExpr:
-    MemberExpr Arguments                { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExpr Arguments                  { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExpr '[' Expr ']'               { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
-                                        }
-  | CallExpr '.' IDENT                  { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); }
-;
-
-CallExprNoBF:
-    MemberExprNoBF Arguments            { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExprNoBF Arguments              { $$ = makeFunctionCallNode(GLOBAL_DATA, $1, $2, @1.first_column, @1.last_column, @2.last_column); }
-  | CallExprNoBF '[' Expr ']'           { BracketAccessorNode* node = new (GLOBAL_DATA) BracketAccessorNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @4.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); 
-                                        }
-  | CallExprNoBF '.' IDENT              { DotAccessorNode* node = new (GLOBAL_DATA) DotAccessorNode(GLOBAL_DATA, $1.m_node, *$3);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @3.last_column);
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features, $1.m_numConstants); 
-                                        }
-;
-
-Arguments:
-    '(' ')'                             { $$ = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA), 0, 0); }
-  | '(' ArgumentList ')'                { $$ = createNodeInfo<ArgumentsNode*>(new (GLOBAL_DATA) ArgumentsNode(GLOBAL_DATA, $2.m_node.head), $2.m_features, $2.m_numConstants); }
-;
-
-ArgumentList:
-    AssignmentExpr                      { $$.m_node.head = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, $1.m_node);
-                                          $$.m_node.tail = $$.m_node.head;
-                                          $$.m_features = $1.m_features;
-                                          $$.m_numConstants = $1.m_numConstants; }
-  | ArgumentList ',' AssignmentExpr     { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new (GLOBAL_DATA) ArgumentListNode(GLOBAL_DATA, $1.m_node.tail, $3.m_node);
-                                          $$.m_features = $1.m_features | $3.m_features;
-                                          $$.m_numConstants = $1.m_numConstants + $3.m_numConstants; }
-;
-
-LeftHandSideExpr:
-    NewExpr
-  | CallExpr
-;
-
-LeftHandSideExprNoBF:
-    NewExprNoBF
-  | CallExprNoBF
-;
-
-PostfixExpr:
-    LeftHandSideExpr
-  | LeftHandSideExpr PLUSPLUS           { $$ = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, $1.m_node, OpPlusPlus, @1.first_column, @1.last_column, @2.last_column), $1.m_features | AssignFeature, $1.m_numConstants); }
-  | LeftHandSideExpr MINUSMINUS         { $$ = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, $1.m_node, OpMinusMinus, @1.first_column, @1.last_column, @2.last_column), $1.m_features | AssignFeature, $1.m_numConstants); }
-;
-
-PostfixExprNoBF:
-    LeftHandSideExprNoBF
-  | LeftHandSideExprNoBF PLUSPLUS       { $$ = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, $1.m_node, OpPlusPlus, @1.first_column, @1.last_column, @2.last_column), $1.m_features | AssignFeature, $1.m_numConstants); }
-  | LeftHandSideExprNoBF MINUSMINUS     { $$ = createNodeInfo<ExpressionNode*>(makePostfixNode(GLOBAL_DATA, $1.m_node, OpMinusMinus, @1.first_column, @1.last_column, @2.last_column), $1.m_features | AssignFeature, $1.m_numConstants); }
-;
-
-UnaryExprCommon:
-    DELETETOKEN UnaryExpr               { $$ = createNodeInfo<ExpressionNode*>(makeDeleteNode(GLOBAL_DATA, $2.m_node, @1.first_column, @2.last_column, @2.last_column), $2.m_features, $2.m_numConstants); }
-  | VOIDTOKEN UnaryExpr                 { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) VoidNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants + 1); }
-  | TYPEOF UnaryExpr                    { $$ = createNodeInfo<ExpressionNode*>(makeTypeOfNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
-  | PLUSPLUS UnaryExpr                  { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpPlusPlus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
-  | AUTOPLUSPLUS UnaryExpr              { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpPlusPlus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
-  | MINUSMINUS UnaryExpr                { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpMinusMinus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
-  | AUTOMINUSMINUS UnaryExpr            { $$ = createNodeInfo<ExpressionNode*>(makePrefixNode(GLOBAL_DATA, $2.m_node, OpMinusMinus, @1.first_column, @2.first_column + 1, @2.last_column), $2.m_features | AssignFeature, $2.m_numConstants); }
-  | '+' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnaryPlusNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
-  | '-' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(makeNegateNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
-  | '~' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(makeBitwiseNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
-  | '!' UnaryExpr                       { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalNotNode(GLOBAL_DATA, $2.m_node), $2.m_features, $2.m_numConstants); }
-
-UnaryExpr:
-    PostfixExpr
-  | UnaryExprCommon
-;
-
-UnaryExprNoBF:
-    PostfixExprNoBF
-  | UnaryExprCommon
-;
-
-MultiplicativeExpr:
-    UnaryExpr
-  | MultiplicativeExpr '*' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | MultiplicativeExpr '/' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | MultiplicativeExpr '%' UnaryExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-MultiplicativeExprNoBF:
-    UnaryExprNoBF
-  | MultiplicativeExprNoBF '*' UnaryExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(makeMultNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | MultiplicativeExprNoBF '/' UnaryExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(makeDivNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | MultiplicativeExprNoBF '%' UnaryExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ModNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-AdditiveExpr:
-    MultiplicativeExpr
-  | AdditiveExpr '+' MultiplicativeExpr { $$ = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | AdditiveExpr '-' MultiplicativeExpr { $$ = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-AdditiveExprNoBF:
-    MultiplicativeExprNoBF
-  | AdditiveExprNoBF '+' MultiplicativeExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(makeAddNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | AdditiveExprNoBF '-' MultiplicativeExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(makeSubNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-ShiftExpr:
-    AdditiveExpr
-  | ShiftExpr LSHIFT AdditiveExpr       { $$ = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | ShiftExpr RSHIFT AdditiveExpr       { $$ = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | ShiftExpr URSHIFT AdditiveExpr      { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-ShiftExprNoBF:
-    AdditiveExprNoBF
-  | ShiftExprNoBF LSHIFT AdditiveExpr   { $$ = createNodeInfo<ExpressionNode*>(makeLeftShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | ShiftExprNoBF RSHIFT AdditiveExpr   { $$ = createNodeInfo<ExpressionNode*>(makeRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | ShiftExprNoBF URSHIFT AdditiveExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) UnsignedRightShiftNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-RelationalExpr:
-    ShiftExpr
-  | RelationalExpr '<' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr '>' ShiftExpr        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr LE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr GE ShiftExpr         { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr INSTANCEOF ShiftExpr { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExpr INTOKEN ShiftExpr    { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-RelationalExprNoIn:
-    ShiftExpr
-  | RelationalExprNoIn '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoIn INSTANCEOF ShiftExpr
-                                        { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-RelationalExprNoBF:
-    ShiftExprNoBF
-  | RelationalExprNoBF '<' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF '>' ShiftExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF LE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LessEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF GE ShiftExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) GreaterEqNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF INSTANCEOF ShiftExpr
-                                        { InstanceOfNode* node = new (GLOBAL_DATA) InstanceOfNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | RelationalExprNoBF INTOKEN ShiftExpr 
-                                        { InNode* node = new (GLOBAL_DATA) InNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @3.first_column, @3.last_column);  
-                                          $$ = createNodeInfo<ExpressionNode*>(node, $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-EqualityExpr:
-    RelationalExpr
-  | EqualityExpr EQEQ RelationalExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr NE RelationalExpr      { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr STREQ RelationalExpr   { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExpr STRNEQ RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-EqualityExprNoIn:
-    RelationalExprNoIn
-  | EqualityExprNoIn EQEQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExprNoIn NE RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExprNoIn STREQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExprNoIn STRNEQ RelationalExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-EqualityExprNoBF:
-    RelationalExprNoBF
-  | EqualityExprNoBF EQEQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) EqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExprNoBF NE RelationalExpr  { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExprNoBF STREQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) StrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-  | EqualityExprNoBF STRNEQ RelationalExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) NotStrictEqualNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-BitwiseANDExpr:
-    EqualityExpr
-  | BitwiseANDExpr '&' EqualityExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-BitwiseANDExprNoIn:
-    EqualityExprNoIn
-  | BitwiseANDExprNoIn '&' EqualityExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-BitwiseANDExprNoBF:
-    EqualityExprNoBF
-  | BitwiseANDExprNoBF '&' EqualityExpr { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitAndNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-BitwiseXORExpr:
-    BitwiseANDExpr
-  | BitwiseXORExpr '^' BitwiseANDExpr   { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-BitwiseXORExprNoIn:
-    BitwiseANDExprNoIn
-  | BitwiseXORExprNoIn '^' BitwiseANDExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-BitwiseXORExprNoBF:
-    BitwiseANDExprNoBF
-  | BitwiseXORExprNoBF '^' BitwiseANDExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitXOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-BitwiseORExpr:
-    BitwiseXORExpr
-  | BitwiseORExpr '|' BitwiseXORExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-BitwiseORExprNoIn:
-    BitwiseXORExprNoIn
-  | BitwiseORExprNoIn '|' BitwiseXORExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-BitwiseORExprNoBF:
-    BitwiseXORExprNoBF
-  | BitwiseORExprNoBF '|' BitwiseXORExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) BitOrNode(GLOBAL_DATA, $1.m_node, $3.m_node, $3.m_features & AssignFeature), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-LogicalANDExpr:
-    BitwiseORExpr
-  | LogicalANDExpr AND BitwiseORExpr    { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-LogicalANDExprNoIn:
-    BitwiseORExprNoIn
-  | LogicalANDExprNoIn AND BitwiseORExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-LogicalANDExprNoBF:
-    BitwiseORExprNoBF
-  | LogicalANDExprNoBF AND BitwiseORExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalAnd), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-LogicalORExpr:
-    LogicalANDExpr
-  | LogicalORExpr OR LogicalANDExpr     { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-LogicalORExprNoIn:
-    LogicalANDExprNoIn
-  | LogicalORExprNoIn OR LogicalANDExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-LogicalORExprNoBF:
-    LogicalANDExprNoBF
-  | LogicalORExprNoBF OR LogicalANDExpr { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) LogicalOpNode(GLOBAL_DATA, $1.m_node, $3.m_node, OpLogicalOr), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-ConditionalExpr:
-    LogicalORExpr
-  | LogicalORExpr '?' AssignmentExpr ':' AssignmentExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
-;
-
-ConditionalExprNoIn:
-    LogicalORExprNoIn
-  | LogicalORExprNoIn '?' AssignmentExprNoIn ':' AssignmentExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
-;
-
-ConditionalExprNoBF:
-    LogicalORExprNoBF
-  | LogicalORExprNoBF '?' AssignmentExpr ':' AssignmentExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(new (GLOBAL_DATA) ConditionalNode(GLOBAL_DATA, $1.m_node, $3.m_node, $5.m_node), $1.m_features | $3.m_features | $5.m_features, $1.m_numConstants + $3.m_numConstants + $5.m_numConstants); }
-;
-
-AssignmentExpr:
-    ConditionalExpr
-  | LeftHandSideExpr AssignmentOperator AssignmentExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, $1.m_node, $2, $3.m_node, $1.m_features & AssignFeature, $3.m_features & AssignFeature, 
-                                                                                                     @1.first_column, @2.first_column + 1, @3.last_column), $1.m_features | $3.m_features | AssignFeature, $1.m_numConstants + $3.m_numConstants); 
-                                        }
-;
-
-AssignmentExprNoIn:
-    ConditionalExprNoIn
-  | LeftHandSideExpr AssignmentOperator AssignmentExprNoIn
-                                        { $$ = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, $1.m_node, $2, $3.m_node, $1.m_features & AssignFeature, $3.m_features & AssignFeature, 
-                                                                                                     @1.first_column, @2.first_column + 1, @3.last_column), $1.m_features | $3.m_features | AssignFeature, $1.m_numConstants + $3.m_numConstants);
-                                        }
-;
-
-AssignmentExprNoBF:
-    ConditionalExprNoBF
-  | LeftHandSideExprNoBF AssignmentOperator AssignmentExpr
-                                        { $$ = createNodeInfo<ExpressionNode*>(makeAssignNode(GLOBAL_DATA, $1.m_node, $2, $3.m_node, $1.m_features & AssignFeature, $3.m_features & AssignFeature,
-                                                                                                     @1.first_column, @2.first_column + 1, @3.last_column), $1.m_features | $3.m_features | AssignFeature, $1.m_numConstants + $3.m_numConstants); 
-                                        }
-;
-
-AssignmentOperator:
-    '='                                 { $$ = OpEqual; }
-  | PLUSEQUAL                           { $$ = OpPlusEq; }
-  | MINUSEQUAL                          { $$ = OpMinusEq; }
-  | MULTEQUAL                           { $$ = OpMultEq; }
-  | DIVEQUAL                            { $$ = OpDivEq; }
-  | LSHIFTEQUAL                         { $$ = OpLShift; }
-  | RSHIFTEQUAL                         { $$ = OpRShift; }
-  | URSHIFTEQUAL                        { $$ = OpURShift; }
-  | ANDEQUAL                            { $$ = OpAndEq; }
-  | XOREQUAL                            { $$ = OpXOrEq; }
-  | OREQUAL                             { $$ = OpOrEq; }
-  | MODEQUAL                            { $$ = OpModEq; }
-;
-
-Expr:
-    AssignmentExpr
-  | Expr ',' AssignmentExpr             { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-ExprNoIn:
-    AssignmentExprNoIn
-  | ExprNoIn ',' AssignmentExprNoIn     { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-ExprNoBF:
-    AssignmentExprNoBF
-  | ExprNoBF ',' AssignmentExpr         { $$ = createNodeInfo<ExpressionNode*>(combineCommaNodes(GLOBAL_DATA, $1.m_node, $3.m_node), $1.m_features | $3.m_features, $1.m_numConstants + $3.m_numConstants); }
-;
-
-Statement:
-    Block
-  | VariableStatement
-  | ConstStatement
-  | FunctionDeclaration
-  | EmptyStatement
-  | ExprStatement
-  | IfStatement
-  | IterationStatement
-  | ContinueStatement
-  | BreakStatement
-  | ReturnStatement
-  | WithStatement
-  | SwitchStatement
-  | LabelledStatement
-  | ThrowStatement
-  | TryStatement
-  | DebuggerStatement
-;
-
-Block:
-    OPENBRACE CLOSEBRACE                { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, 0), 0, 0, 0, 0);
-                                          setStatementLocation($$.m_node, @1, @2); }
-  | OPENBRACE SourceElements CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BlockNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @3); }
-;
-
-VariableStatement:
-    VAR VariableDeclarationList ';'     { $$ = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @3); }
-  | VAR VariableDeclarationList error   { $$ = createNodeDeclarationInfo<StatementNode*>(makeVarStatementNode(GLOBAL_DATA, $2.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @2);
-                                          AUTO_SEMICOLON; }
-;
-
-VariableDeclarationList:
-    IDENT                               { $$.m_node = 0;
-                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, 0);
-                                          $$.m_funcDeclarations = 0;
-                                          $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
-                                          $$.m_numConstants = 0;
-                                        }
-  | IDENT Initializer                   { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @2.first_column + 1, @2.last_column);
-                                          $$.m_node = node;
-                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
-                                          $$.m_funcDeclarations = 0;
-                                          $$.m_features = ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features;
-                                          $$.m_numConstants = $2.m_numConstants;
-                                        }
-  | VariableDeclarationList ',' IDENT
-                                        { $$.m_node = $1.m_node;
-                                          $$.m_varDeclarations = $1.m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, 0);
-                                          $$.m_funcDeclarations = 0;
-                                          $$.m_features = $1.m_features | ((*$3 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          $$.m_numConstants = $1.m_numConstants;
-                                        }
-  | VariableDeclarationList ',' IDENT Initializer
-                                        { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
-                                          setExceptionLocation(node, @3.first_column, @4.first_column + 1, @4.last_column);
-                                          $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
-                                          $$.m_varDeclarations = $1.m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
-                                          $$.m_funcDeclarations = 0;
-                                          $$.m_features = $1.m_features | ((*$3 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features;
-                                          $$.m_numConstants = $1.m_numConstants + $4.m_numConstants;
-                                        }
-;
-
-VariableDeclarationListNoIn:
-    IDENT                               { $$.m_node = 0;
-                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, 0);
-                                          $$.m_funcDeclarations = 0;
-                                          $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
-                                          $$.m_numConstants = 0;
-                                        }
-  | IDENT InitializerNoIn               { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$1, $2.m_node, $2.m_features & AssignFeature);
-                                          setExceptionLocation(node, @1.first_column, @2.first_column + 1, @2.last_column);
-                                          $$.m_node = node;
-                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$1, DeclarationStacks::HasInitializer);
-                                          $$.m_funcDeclarations = 0;
-                                          $$.m_features = ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features;
-                                          $$.m_numConstants = $2.m_numConstants;
-                                        }
-  | VariableDeclarationListNoIn ',' IDENT
-                                        { $$.m_node = $1.m_node;
-                                          $$.m_varDeclarations = $1.m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, 0);
-                                          $$.m_funcDeclarations = 0;
-                                          $$.m_features = $1.m_features | ((*$3 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          $$.m_numConstants = $1.m_numConstants;
-                                        }
-  | VariableDeclarationListNoIn ',' IDENT InitializerNoIn
-                                        { AssignResolveNode* node = new (GLOBAL_DATA) AssignResolveNode(GLOBAL_DATA, *$3, $4.m_node, $4.m_features & AssignFeature);
-                                          setExceptionLocation(node, @3.first_column, @4.first_column + 1, @4.last_column);
-                                          $$.m_node = combineCommaNodes(GLOBAL_DATA, $1.m_node, node);
-                                          $$.m_varDeclarations = $1.m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, *$3, DeclarationStacks::HasInitializer);
-                                          $$.m_funcDeclarations = 0;
-                                          $$.m_features = $1.m_features | ((*$3 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features;
-                                          $$.m_numConstants = $1.m_numConstants + $4.m_numConstants;
-                                        }
-;
-
-ConstStatement:
-    CONSTTOKEN ConstDeclarationList ';' { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @3); }
-  | CONSTTOKEN ConstDeclarationList error
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ConstStatementNode(GLOBAL_DATA, $2.m_node.head), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
-;
-
-ConstDeclarationList:
-    ConstDeclaration                    { $$.m_node.head = $1.m_node;
-                                          $$.m_node.tail = $$.m_node.head;
-                                          $$.m_varDeclarations = new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::VarStack>;
-                                          appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, $1.m_node);
-                                          $$.m_funcDeclarations = 0; 
-                                          $$.m_features = $1.m_features;
-                                          $$.m_numConstants = $1.m_numConstants;
-    }
-  | ConstDeclarationList ',' ConstDeclaration
-                                        { $$.m_node.head = $1.m_node.head;
-                                          $1.m_node.tail->m_next = $3.m_node;
-                                          $$.m_node.tail = $3.m_node;
-                                          $$.m_varDeclarations = $1.m_varDeclarations;
-                                          appendToVarDeclarationList(GLOBAL_DATA, $$.m_varDeclarations, $3.m_node);
-                                          $$.m_funcDeclarations = 0;
-                                          $$.m_features = $1.m_features | $3.m_features;
-                                          $$.m_numConstants = $1.m_numConstants + $3.m_numConstants; }
-;
-
-ConstDeclaration:
-    IDENT                               { $$ = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *$1, 0), (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0, 0); }
-  | IDENT Initializer                   { $$ = createNodeInfo<ConstDeclNode*>(new (GLOBAL_DATA) ConstDeclNode(GLOBAL_DATA, *$1, $2.m_node), ((*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $2.m_features, $2.m_numConstants); }
-;
-
-Initializer:
-    '=' AssignmentExpr                  { $$ = $2; }
-;
-
-InitializerNoIn:
-    '=' AssignmentExprNoIn              { $$ = $2; }
-;
-
-EmptyStatement:
-    ';'                                 { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) EmptyStatementNode(GLOBAL_DATA), 0, 0, 0, 0); }
-;
-
-ExprStatement:
-    ExprNoBF ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @2); }
-  | ExprNoBF error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ExprStatementNode(GLOBAL_DATA, $1.m_node), 0, 0, $1.m_features, $1.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
-;
-
-IfStatement:
-    IF '(' Expr ')' Statement %prec IF_WITHOUT_ELSE
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @4); }
-  | IF '(' Expr ')' Statement ELSE Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) IfElseNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node), 
-                                                                                         mergeDeclarationLists($5.m_varDeclarations, $7.m_varDeclarations),
-                                                                                         mergeDeclarationLists($5.m_funcDeclarations, $7.m_funcDeclarations),
-                                                                                         $3.m_features | $5.m_features | $7.m_features,
-                                                                                         $3.m_numConstants + $5.m_numConstants + $7.m_numConstants); 
-                                          setStatementLocation($$.m_node, @1, @4); }
-;
-
-IterationStatement:
-    DO Statement WHILE '(' Expr ')' ';'    { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
-                                             setStatementLocation($$.m_node, @1, @3); }
-  | DO Statement WHILE '(' Expr ')' error  { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DoWhileNode(GLOBAL_DATA, $2.m_node, $5.m_node), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features | $5.m_features, $2.m_numConstants + $5.m_numConstants);
-                                             setStatementLocation($$.m_node, @1, @3); } // Always performs automatic semicolon insertion.
-  | WHILE '(' Expr ')' Statement        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WhileNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @4); }
-  | FOR '(' ExprNoInOpt ';' ExprOpt ';' ExprOpt ')' Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node, $9.m_node, false), $9.m_varDeclarations, $9.m_funcDeclarations, 
-                                                                                         $3.m_features | $5.m_features | $7.m_features | $9.m_features,
-                                                                                         $3.m_numConstants + $5.m_numConstants + $7.m_numConstants + $9.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @8); 
-                                        }
-  | FOR '(' VAR VariableDeclarationListNoIn ';' ExprOpt ';' ExprOpt ')' Statement
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) ForNode(GLOBAL_DATA, $4.m_node, $6.m_node, $8.m_node, $10.m_node, true),
-                                                                                         mergeDeclarationLists($4.m_varDeclarations, $10.m_varDeclarations),
-                                                                                         mergeDeclarationLists($4.m_funcDeclarations, $10.m_funcDeclarations),
-                                                                                         $4.m_features | $6.m_features | $8.m_features | $10.m_features,
-                                                                                         $4.m_numConstants + $6.m_numConstants + $8.m_numConstants + $10.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @9); }
-  | FOR '(' LeftHandSideExpr INTOKEN Expr ')' Statement
-                                        {
-                                            ForInNode* node = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, $3.m_node, $5.m_node, $7.m_node);
-                                            setExceptionLocation(node, @3.first_column, @3.last_column, @5.last_column);
-                                            $$ = createNodeDeclarationInfo<StatementNode*>(node, $7.m_varDeclarations, $7.m_funcDeclarations,
-                                                                                           $3.m_features | $5.m_features | $7.m_features,
-                                                                                           $3.m_numConstants + $5.m_numConstants + $7.m_numConstants);
-                                            setStatementLocation($$.m_node, @1, @6);
-                                        }
-  | FOR '(' VAR IDENT INTOKEN Expr ')' Statement
-                                        { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, 0, $6.m_node, $8.m_node, @5.first_column, @5.first_column - @4.first_column, @6.last_column - @5.first_column);
-                                          setExceptionLocation(forIn, @4.first_column, @5.first_column + 1, @6.last_column);
-                                          appendToVarDeclarationList(GLOBAL_DATA, $8.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $8.m_varDeclarations, $8.m_funcDeclarations, ((*$4 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $6.m_features | $8.m_features, $6.m_numConstants + $8.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @7); }
-  | FOR '(' VAR IDENT InitializerNoIn INTOKEN Expr ')' Statement
-                                        { ForInNode *forIn = new (GLOBAL_DATA) ForInNode(GLOBAL_DATA, *$4, $5.m_node, $7.m_node, $9.m_node, @5.first_column, @5.first_column - @4.first_column, @5.last_column - @5.first_column);
-                                          setExceptionLocation(forIn, @4.first_column, @6.first_column + 1, @7.last_column);
-                                          appendToVarDeclarationList(GLOBAL_DATA, $9.m_varDeclarations, *$4, DeclarationStacks::HasInitializer);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(forIn, $9.m_varDeclarations, $9.m_funcDeclarations,
-                                                                                         ((*$4 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $5.m_features | $7.m_features | $9.m_features,
-                                                                                         $5.m_numConstants + $7.m_numConstants + $9.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @8); }
-;
-
-ExprOpt:
-    /* nothing */                       { $$ = createNodeInfo<ExpressionNode*>(0, 0, 0); }
-  | Expr
-;
-
-ExprNoInOpt:
-    /* nothing */                       { $$ = createNodeInfo<ExpressionNode*>(0, 0, 0); }
-  | ExprNoIn
-;
-
-ContinueStatement:
-    CONTINUE ';'                        { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation($$.m_node, @1, @2); }
-  | CONTINUE error                      { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | CONTINUE IDENT ';'                  { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation($$.m_node, @1, @3); }
-  | CONTINUE IDENT error                { ContinueNode* node = new (GLOBAL_DATA) ContinueNode(GLOBAL_DATA, *$2);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0);
-                                          setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
-;
-
-BreakStatement:
-    BREAK ';'                           { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @2); }
-  | BREAK error                         { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA);
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA), 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | BREAK IDENT ';'                     { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @3); }
-  | BREAK IDENT error                   { BreakNode* node = new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) BreakNode(GLOBAL_DATA, *$2), 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
-;
-
-ReturnStatement:
-    RETURN ';'                          { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @2); }
-  | RETURN error                        { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, 0); 
-                                          setExceptionLocation(node, @1.first_column, @1.last_column, @1.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, 0, 0); setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
-  | RETURN Expr ';'                     { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @3); }
-  | RETURN Expr error                   { ReturnNode* node = new (GLOBAL_DATA) ReturnNode(GLOBAL_DATA, $2.m_node); 
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column); 
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; }
-;
-
-WithStatement:
-    WITH '(' Expr ')' Statement         { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) WithNode(GLOBAL_DATA, $3.m_node, $5.m_node, @3.last_column, @3.last_column - @3.first_column),
-                                                                                         $5.m_varDeclarations, $5.m_funcDeclarations, $3.m_features | $5.m_features | WithFeature, $3.m_numConstants + $5.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @4); }
-;
-
-SwitchStatement:
-    SWITCH '(' Expr ')' CaseBlock       { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) SwitchNode(GLOBAL_DATA, $3.m_node, $5.m_node), $5.m_varDeclarations, $5.m_funcDeclarations,
-                                                                                         $3.m_features | $5.m_features, $3.m_numConstants + $5.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @4); }
-;
-
-CaseBlock:
-    OPENBRACE CaseClausesOpt CLOSEBRACE              { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, $2.m_node.head, 0, 0), $2.m_varDeclarations, $2.m_funcDeclarations, $2.m_features, $2.m_numConstants); }
-  | OPENBRACE CaseClausesOpt DefaultClause CaseClausesOpt CLOSEBRACE
-                                        { $$ = createNodeDeclarationInfo<CaseBlockNode*>(new (GLOBAL_DATA) CaseBlockNode(GLOBAL_DATA, $2.m_node.head, $3.m_node, $4.m_node.head),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists($2.m_varDeclarations, $3.m_varDeclarations), $4.m_varDeclarations),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists($2.m_funcDeclarations, $3.m_funcDeclarations), $4.m_funcDeclarations),
-                                                                                         $2.m_features | $3.m_features | $4.m_features,
-                                                                                         $2.m_numConstants + $3.m_numConstants + $4.m_numConstants); }
-;
-
-CaseClausesOpt:
-  /* nothing */                         { $$.m_node.head = 0; $$.m_node.tail = 0; $$.m_varDeclarations = 0; $$.m_funcDeclarations = 0; $$.m_features = 0; $$.m_numConstants = 0; }
-  | CaseClauses
-;
-
-CaseClauses:
-    CaseClause                          { $$.m_node.head = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, $1.m_node);
-                                          $$.m_node.tail = $$.m_node.head;
-                                          $$.m_varDeclarations = $1.m_varDeclarations;
-                                          $$.m_funcDeclarations = $1.m_funcDeclarations; 
-                                          $$.m_features = $1.m_features;
-                                          $$.m_numConstants = $1.m_numConstants; }
-  | CaseClauses CaseClause              { $$.m_node.head = $1.m_node.head;
-                                          $$.m_node.tail = new (GLOBAL_DATA) ClauseListNode(GLOBAL_DATA, $1.m_node.tail, $2.m_node);
-                                          $$.m_varDeclarations = mergeDeclarationLists($1.m_varDeclarations, $2.m_varDeclarations);
-                                          $$.m_funcDeclarations = mergeDeclarationLists($1.m_funcDeclarations, $2.m_funcDeclarations);
-                                          $$.m_features = $1.m_features | $2.m_features;
-                                          $$.m_numConstants = $1.m_numConstants + $2.m_numConstants;
-                                        }
-;
-
-CaseClause:
-    CASE Expr ':'                       { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, $2.m_node), 0, 0, $2.m_features, $2.m_numConstants); }
-  | CASE Expr ':' SourceElements        { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, $2.m_node, $4.m_node), $4.m_varDeclarations, $4.m_funcDeclarations, $2.m_features | $4.m_features, $2.m_numConstants + $4.m_numConstants); }
-;
-
-DefaultClause:
-    DEFAULT ':'                         { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0), 0, 0, 0, 0); }
-  | DEFAULT ':' SourceElements          { $$ = createNodeDeclarationInfo<CaseClauseNode*>(new (GLOBAL_DATA) CaseClauseNode(GLOBAL_DATA, 0, $3.m_node), $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
-;
-
-LabelledStatement:
-    IDENT ':' Statement                 { LabelNode* node = new (GLOBAL_DATA) LabelNode(GLOBAL_DATA, *$1, $3.m_node);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, $3.m_varDeclarations, $3.m_funcDeclarations, $3.m_features, $3.m_numConstants); }
-;
-
-ThrowStatement:
-    THROW Expr ';'                      { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @2);
-                                        }
-  | THROW Expr error                    { ThrowNode* node = new (GLOBAL_DATA) ThrowNode(GLOBAL_DATA, $2.m_node);
-                                          setExceptionLocation(node, @1.first_column, @2.last_column, @2.last_column);
-                                          $$ = createNodeDeclarationInfo<StatementNode*>(node, 0, 0, $2.m_features, $2.m_numConstants); setStatementLocation($$.m_node, @1, @2); AUTO_SEMICOLON; 
-                                        }
-;
-
-TryStatement:
-    TRY Block FINALLY Block             { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, GLOBAL_DATA->propertyNames->nullIdentifier, false, 0, $4.m_node),
-                                                                                         mergeDeclarationLists($2.m_varDeclarations, $4.m_varDeclarations),
-                                                                                         mergeDeclarationLists($2.m_funcDeclarations, $4.m_funcDeclarations),
-                                                                                         $2.m_features | $4.m_features,
-                                                                                         $2.m_numConstants + $4.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @2); }
-  | TRY Block CATCH '(' IDENT ')' Block { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, 0),
-                                                                                         mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations),
-                                                                                         mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations),
-                                                                                         $2.m_features | $7.m_features | CatchFeature,
-                                                                                         $2.m_numConstants + $7.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @2); }
-  | TRY Block CATCH '(' IDENT ')' Block FINALLY Block
-                                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) TryNode(GLOBAL_DATA, $2.m_node, *$5, ($7.m_features & EvalFeature) != 0, $7.m_node, $9.m_node),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists($2.m_varDeclarations, $7.m_varDeclarations), $9.m_varDeclarations),
-                                                                                         mergeDeclarationLists(mergeDeclarationLists($2.m_funcDeclarations, $7.m_funcDeclarations), $9.m_funcDeclarations),
-                                                                                         $2.m_features | $7.m_features | $9.m_features | CatchFeature,
-                                                                                         $2.m_numConstants + $7.m_numConstants + $9.m_numConstants);
-                                          setStatementLocation($$.m_node, @1, @2); }
-;
-
-DebuggerStatement:
-    DEBUGGER ';'                        { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          setStatementLocation($$.m_node, @1, @2); }
-  | DEBUGGER error                      { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) DebuggerStatementNode(GLOBAL_DATA), 0, 0, 0, 0);
-                                          setStatementLocation($$.m_node, @1, @1); AUTO_SEMICOLON; }
-;
-
-FunctionDeclaration:
-    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *$2, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line)), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | ClosureFeature, 0); setStatementLocation($6, @5, @7); $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)->body()); }
-  | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
-      {
-          $$ = createNodeDeclarationInfo<StatementNode*>(new (GLOBAL_DATA) FuncDeclNode(GLOBAL_DATA, *$2, $7, GLOBAL_DATA->lexer->sourceCode($6, $8, @6.first_line), $4.m_node.head), 0, new (GLOBAL_DATA) ParserArenaData<DeclarationStacks::FunctionStack>, ((*$2 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0) | $4.m_features | ClosureFeature, 0);
-          if ($4.m_features & ArgumentsFeature)
-              $7->setUsesArguments();
-          setStatementLocation($7, @6, @8);
-          $$.m_funcDeclarations->data.append(static_cast<FuncDeclNode*>($$.m_node)->body());
-      }
-;
-
-FunctionExpr:
-    FUNCTION '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, $5, GLOBAL_DATA->lexer->sourceCode($4, $6, @4.first_line)), ClosureFeature, 0); setStatementLocation($5, @4, @6); }
-    | FUNCTION '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
-      {
-          $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, GLOBAL_DATA->propertyNames->nullIdentifier, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line), $3.m_node.head), $3.m_features | ClosureFeature, 0);
-          if ($3.m_features & ArgumentsFeature)
-              $6->setUsesArguments();
-          setStatementLocation($6, @5, @7);
-      }
-  | FUNCTION IDENT '(' ')' OPENBRACE FunctionBody CLOSEBRACE { $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *$2, $6, GLOBAL_DATA->lexer->sourceCode($5, $7, @5.first_line)), ClosureFeature, 0); setStatementLocation($6, @5, @7); }
-  | FUNCTION IDENT '(' FormalParameterList ')' OPENBRACE FunctionBody CLOSEBRACE
-      {
-          $$ = createNodeInfo(new (GLOBAL_DATA) FuncExprNode(GLOBAL_DATA, *$2, $7, GLOBAL_DATA->lexer->sourceCode($6, $8, @6.first_line), $4.m_node.head), $4.m_features | ClosureFeature, 0); 
-          if ($4.m_features & ArgumentsFeature)
-              $7->setUsesArguments();
-          setStatementLocation($7, @6, @8);
-      }
-;
-
-FormalParameterList:
-    IDENT                               { $$.m_node.head = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, *$1);
-                                          $$.m_features = (*$1 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0;
-                                          $$.m_node.tail = $$.m_node.head; }
-  | FormalParameterList ',' IDENT       { $$.m_node.head = $1.m_node.head;
-                                          $$.m_features = $1.m_features | ((*$3 == GLOBAL_DATA->propertyNames->arguments) ? ArgumentsFeature : 0);
-                                          $$.m_node.tail = new (GLOBAL_DATA) ParameterNode(GLOBAL_DATA, $1.m_node.tail, *$3);  }
-;
-
-FunctionBody:
-    /* not in spec */                   { $$ = FunctionBodyNode::create(GLOBAL_DATA); }
-  | SourceElements_NoNode               { $$ = FunctionBodyNode::create(GLOBAL_DATA); }
-;
-
-Program:
-    /* not in spec */                   { GLOBAL_DATA->parser->didFinishParsing(new (GLOBAL_DATA) SourceElements(GLOBAL_DATA), 0, 0, NoFeatures, @0.last_line, 0); }
-    | SourceElements                    { GLOBAL_DATA->parser->didFinishParsing($1.m_node, $1.m_varDeclarations, $1.m_funcDeclarations, $1.m_features, 
-                                                                                @1.last_line, $1.m_numConstants); }
-;
-
-SourceElements:
-    Statement                           { $$.m_node = new (GLOBAL_DATA) SourceElements(GLOBAL_DATA);
-                                          $$.m_node->append($1.m_node);
-                                          $$.m_varDeclarations = $1.m_varDeclarations;
-                                          $$.m_funcDeclarations = $1.m_funcDeclarations;
-                                          $$.m_features = $1.m_features;
-                                          $$.m_numConstants = $1.m_numConstants;
-                                        }
-  | SourceElements Statement            { $$.m_node->append($2.m_node);
-                                          $$.m_varDeclarations = mergeDeclarationLists($1.m_varDeclarations, $2.m_varDeclarations);
-                                          $$.m_funcDeclarations = mergeDeclarationLists($1.m_funcDeclarations, $2.m_funcDeclarations);
-                                          $$.m_features = $1.m_features | $2.m_features;
-                                          $$.m_numConstants = $1.m_numConstants + $2.m_numConstants;
-                                        }
-;
- 
-// Start NoNodes
-
-Literal_NoNode:
-    NULLTOKEN
-  | TRUETOKEN
-  | FALSETOKEN
-  | NUMBER { }
-  | STRING { }
-  | '/' /* regexp */ { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; }
-  | DIVEQUAL /* regexp with /= */ { if (!GLOBAL_DATA->lexer->skipRegExp()) YYABORT; }
-;
-
-Property_NoNode:
-    IDENT ':' AssignmentExpr_NoNode { }
-  | STRING ':' AssignmentExpr_NoNode { }
-  | NUMBER ':' AssignmentExpr_NoNode { }
-  | IDENT IDENT '(' ')' OPENBRACE FunctionBody_NoNode CLOSEBRACE { if (*$1 != "get" && *$1 != "set") YYABORT; }
-  | IDENT IDENT '(' FormalParameterList_NoNode ')' OPENBRACE FunctionBody_NoNode CLOSEBRACE { if (*$1 != "get" && *$1 != "set") YYABORT; }
-;
-
-PropertyList_NoNode:
-    Property_NoNode
-  | PropertyList_NoNode ',' Property_NoNode
-;
-
-PrimaryExpr_NoNode:
-    PrimaryExprNoBrace_NoNode
-  | OPENBRACE CLOSEBRACE { }
-  | OPENBRACE PropertyList_NoNode CLOSEBRACE { }
-  /* allow extra comma, see http://bugs.webkit.org/show_bug.cgi?id=5939 */
-  | OPENBRACE PropertyList_NoNode ',' CLOSEBRACE { }
-;
-
-PrimaryExprNoBrace_NoNode:
-    THISTOKEN
-  | Literal_NoNode
-  | ArrayLiteral_NoNode
-  | IDENT { }
-  | '(' Expr_NoNode ')'
-;
-
-ArrayLiteral_NoNode:
-    '[' ElisionOpt_NoNode ']'
-  | '[' ElementList_NoNode ']'
-  | '[' ElementList_NoNode ',' ElisionOpt_NoNode ']'
-;
-
-ElementList_NoNode:
-    ElisionOpt_NoNode AssignmentExpr_NoNode
-  | ElementList_NoNode ',' ElisionOpt_NoNode AssignmentExpr_NoNode
-;
-
-ElisionOpt_NoNode:
-    /* nothing */
-  | Elision_NoNode
-;
-
-Elision_NoNode:
-    ','
-  | Elision_NoNode ','
-;
-
-MemberExpr_NoNode:
-    PrimaryExpr_NoNode
-  | FunctionExpr_NoNode
-  | MemberExpr_NoNode '[' Expr_NoNode ']'
-  | MemberExpr_NoNode '.' IDENT
-  | NEW MemberExpr_NoNode Arguments_NoNode
-;
-
-MemberExprNoBF_NoNode:
-    PrimaryExprNoBrace_NoNode
-  | MemberExprNoBF_NoNode '[' Expr_NoNode ']'
-  | MemberExprNoBF_NoNode '.' IDENT
-  | NEW MemberExpr_NoNode Arguments_NoNode
-;
-
-NewExpr_NoNode:
-    MemberExpr_NoNode
-  | NEW NewExpr_NoNode
-;
-
-NewExprNoBF_NoNode:
-    MemberExprNoBF_NoNode
-  | NEW NewExpr_NoNode
-;
-
-CallExpr_NoNode:
-    MemberExpr_NoNode Arguments_NoNode
-  | CallExpr_NoNode Arguments_NoNode
-  | CallExpr_NoNode '[' Expr_NoNode ']'
-  | CallExpr_NoNode '.' IDENT
-;
-
-CallExprNoBF_NoNode:
-    MemberExprNoBF_NoNode Arguments_NoNode
-  | CallExprNoBF_NoNode Arguments_NoNode
-  | CallExprNoBF_NoNode '[' Expr_NoNode ']'
-  | CallExprNoBF_NoNode '.' IDENT
-;
-
-Arguments_NoNode:
-    '(' ')'
-  | '(' ArgumentList_NoNode ')'
-;
-
-ArgumentList_NoNode:
-    AssignmentExpr_NoNode
-  | ArgumentList_NoNode ',' AssignmentExpr_NoNode
-;
-
-LeftHandSideExpr_NoNode:
-    NewExpr_NoNode
-  | CallExpr_NoNode
-;
-
-LeftHandSideExprNoBF_NoNode:
-    NewExprNoBF_NoNode
-  | CallExprNoBF_NoNode
-;
-
-PostfixExpr_NoNode:
-    LeftHandSideExpr_NoNode
-  | LeftHandSideExpr_NoNode PLUSPLUS
-  | LeftHandSideExpr_NoNode MINUSMINUS
-;
-
-PostfixExprNoBF_NoNode:
-    LeftHandSideExprNoBF_NoNode
-  | LeftHandSideExprNoBF_NoNode PLUSPLUS
-  | LeftHandSideExprNoBF_NoNode MINUSMINUS
-;
-
-UnaryExprCommon_NoNode:
-    DELETETOKEN UnaryExpr_NoNode
-  | VOIDTOKEN UnaryExpr_NoNode
-  | TYPEOF UnaryExpr_NoNode
-  | PLUSPLUS UnaryExpr_NoNode
-  | AUTOPLUSPLUS UnaryExpr_NoNode
-  | MINUSMINUS UnaryExpr_NoNode
-  | AUTOMINUSMINUS UnaryExpr_NoNode
-  | '+' UnaryExpr_NoNode
-  | '-' UnaryExpr_NoNode
-  | '~' UnaryExpr_NoNode
-  | '!' UnaryExpr_NoNode
-
-UnaryExpr_NoNode:
-    PostfixExpr_NoNode
-  | UnaryExprCommon_NoNode
-;
-
-UnaryExprNoBF_NoNode:
-    PostfixExprNoBF_NoNode
-  | UnaryExprCommon_NoNode
-;
-
-MultiplicativeExpr_NoNode:
-    UnaryExpr_NoNode
-  | MultiplicativeExpr_NoNode '*' UnaryExpr_NoNode
-  | MultiplicativeExpr_NoNode '/' UnaryExpr_NoNode
-  | MultiplicativeExpr_NoNode '%' UnaryExpr_NoNode
-;
-
-MultiplicativeExprNoBF_NoNode:
-    UnaryExprNoBF_NoNode
-  | MultiplicativeExprNoBF_NoNode '*' UnaryExpr_NoNode
-  | MultiplicativeExprNoBF_NoNode '/' UnaryExpr_NoNode
-  | MultiplicativeExprNoBF_NoNode '%' UnaryExpr_NoNode
-;
-
-AdditiveExpr_NoNode:
-    MultiplicativeExpr_NoNode
-  | AdditiveExpr_NoNode '+' MultiplicativeExpr_NoNode
-  | AdditiveExpr_NoNode '-' MultiplicativeExpr_NoNode
-;
-
-AdditiveExprNoBF_NoNode:
-    MultiplicativeExprNoBF_NoNode
-  | AdditiveExprNoBF_NoNode '+' MultiplicativeExpr_NoNode
-  | AdditiveExprNoBF_NoNode '-' MultiplicativeExpr_NoNode
-;
-
-ShiftExpr_NoNode:
-    AdditiveExpr_NoNode
-  | ShiftExpr_NoNode LSHIFT AdditiveExpr_NoNode
-  | ShiftExpr_NoNode RSHIFT AdditiveExpr_NoNode
-  | ShiftExpr_NoNode URSHIFT AdditiveExpr_NoNode
-;
-
-ShiftExprNoBF_NoNode:
-    AdditiveExprNoBF_NoNode
-  | ShiftExprNoBF_NoNode LSHIFT AdditiveExpr_NoNode
-  | ShiftExprNoBF_NoNode RSHIFT AdditiveExpr_NoNode
-  | ShiftExprNoBF_NoNode URSHIFT AdditiveExpr_NoNode
-;
-
-RelationalExpr_NoNode:
-    ShiftExpr_NoNode
-  | RelationalExpr_NoNode '<' ShiftExpr_NoNode
-  | RelationalExpr_NoNode '>' ShiftExpr_NoNode
-  | RelationalExpr_NoNode LE ShiftExpr_NoNode
-  | RelationalExpr_NoNode GE ShiftExpr_NoNode
-  | RelationalExpr_NoNode INSTANCEOF ShiftExpr_NoNode
-  | RelationalExpr_NoNode INTOKEN ShiftExpr_NoNode
-;
-
-RelationalExprNoIn_NoNode:
-    ShiftExpr_NoNode
-  | RelationalExprNoIn_NoNode '<' ShiftExpr_NoNode
-  | RelationalExprNoIn_NoNode '>' ShiftExpr_NoNode
-  | RelationalExprNoIn_NoNode LE ShiftExpr_NoNode
-  | RelationalExprNoIn_NoNode GE ShiftExpr_NoNode
-  | RelationalExprNoIn_NoNode INSTANCEOF ShiftExpr_NoNode
-;
-
-RelationalExprNoBF_NoNode:
-    ShiftExprNoBF_NoNode
-  | RelationalExprNoBF_NoNode '<' ShiftExpr_NoNode
-  | RelationalExprNoBF_NoNode '>' ShiftExpr_NoNode
-  | RelationalExprNoBF_NoNode LE ShiftExpr_NoNode
-  | RelationalExprNoBF_NoNode GE ShiftExpr_NoNode
-  | RelationalExprNoBF_NoNode INSTANCEOF ShiftExpr_NoNode
-  | RelationalExprNoBF_NoNode INTOKEN ShiftExpr_NoNode
-;
-
-EqualityExpr_NoNode:
-    RelationalExpr_NoNode
-  | EqualityExpr_NoNode EQEQ RelationalExpr_NoNode
-  | EqualityExpr_NoNode NE RelationalExpr_NoNode
-  | EqualityExpr_NoNode STREQ RelationalExpr_NoNode
-  | EqualityExpr_NoNode STRNEQ RelationalExpr_NoNode
-;
-
-EqualityExprNoIn_NoNode:
-    RelationalExprNoIn_NoNode
-  | EqualityExprNoIn_NoNode EQEQ RelationalExprNoIn_NoNode
-  | EqualityExprNoIn_NoNode NE RelationalExprNoIn_NoNode
-  | EqualityExprNoIn_NoNode STREQ RelationalExprNoIn_NoNode
-  | EqualityExprNoIn_NoNode STRNEQ RelationalExprNoIn_NoNode
-;
-
-EqualityExprNoBF_NoNode:
-    RelationalExprNoBF_NoNode
-  | EqualityExprNoBF_NoNode EQEQ RelationalExpr_NoNode
-  | EqualityExprNoBF_NoNode NE RelationalExpr_NoNode
-  | EqualityExprNoBF_NoNode STREQ RelationalExpr_NoNode
-  | EqualityExprNoBF_NoNode STRNEQ RelationalExpr_NoNode
-;
-
-BitwiseANDExpr_NoNode:
-    EqualityExpr_NoNode
-  | BitwiseANDExpr_NoNode '&' EqualityExpr_NoNode
-;
-
-BitwiseANDExprNoIn_NoNode:
-    EqualityExprNoIn_NoNode
-  | BitwiseANDExprNoIn_NoNode '&' EqualityExprNoIn_NoNode
-;
-
-BitwiseANDExprNoBF_NoNode:
-    EqualityExprNoBF_NoNode
-  | BitwiseANDExprNoBF_NoNode '&' EqualityExpr_NoNode
-;
-
-BitwiseXORExpr_NoNode:
-    BitwiseANDExpr_NoNode
-  | BitwiseXORExpr_NoNode '^' BitwiseANDExpr_NoNode
-;
-
-BitwiseXORExprNoIn_NoNode:
-    BitwiseANDExprNoIn_NoNode
-  | BitwiseXORExprNoIn_NoNode '^' BitwiseANDExprNoIn_NoNode
-;
-
-BitwiseXORExprNoBF_NoNode:
-    BitwiseANDExprNoBF_NoNode
-  | BitwiseXORExprNoBF_NoNode '^' BitwiseANDExpr_NoNode
-;
-
-BitwiseORExpr_NoNode:
-    BitwiseXORExpr_NoNode
-  | BitwiseORExpr_NoNode '|' BitwiseXORExpr_NoNode
-;
-
-BitwiseORExprNoIn_NoNode:
-    BitwiseXORExprNoIn_NoNode
-  | BitwiseORExprNoIn_NoNode '|' BitwiseXORExprNoIn_NoNode
-;
-
-BitwiseORExprNoBF_NoNode:
-    BitwiseXORExprNoBF_NoNode
-  | BitwiseORExprNoBF_NoNode '|' BitwiseXORExpr_NoNode
-;
-
-LogicalANDExpr_NoNode:
-    BitwiseORExpr_NoNode
-  | LogicalANDExpr_NoNode AND BitwiseORExpr_NoNode
-;
-
-LogicalANDExprNoIn_NoNode:
-    BitwiseORExprNoIn_NoNode
-  | LogicalANDExprNoIn_NoNode AND BitwiseORExprNoIn_NoNode
-;
-
-LogicalANDExprNoBF_NoNode:
-    BitwiseORExprNoBF_NoNode
-  | LogicalANDExprNoBF_NoNode AND BitwiseORExpr_NoNode
-;
-
-LogicalORExpr_NoNode:
-    LogicalANDExpr_NoNode
-  | LogicalORExpr_NoNode OR LogicalANDExpr_NoNode
-;
-
-LogicalORExprNoIn_NoNode:
-    LogicalANDExprNoIn_NoNode
-  | LogicalORExprNoIn_NoNode OR LogicalANDExprNoIn_NoNode
-;
-
-LogicalORExprNoBF_NoNode:
-    LogicalANDExprNoBF_NoNode
-  | LogicalORExprNoBF_NoNode OR LogicalANDExpr_NoNode
-;
-
-ConditionalExpr_NoNode:
-    LogicalORExpr_NoNode
-  | LogicalORExpr_NoNode '?' AssignmentExpr_NoNode ':' AssignmentExpr_NoNode
-;
-
-ConditionalExprNoIn_NoNode:
-    LogicalORExprNoIn_NoNode
-  | LogicalORExprNoIn_NoNode '?' AssignmentExprNoIn_NoNode ':' AssignmentExprNoIn_NoNode
-;
-
-ConditionalExprNoBF_NoNode:
-    LogicalORExprNoBF_NoNode
-  | LogicalORExprNoBF_NoNode '?' AssignmentExpr_NoNode ':' AssignmentExpr_NoNode
-;
-
-AssignmentExpr_NoNode:
-    ConditionalExpr_NoNode
-  | LeftHandSideExpr_NoNode AssignmentOperator_NoNode AssignmentExpr_NoNode
-;
-
-AssignmentExprNoIn_NoNode:
-    ConditionalExprNoIn_NoNode
-  | LeftHandSideExpr_NoNode AssignmentOperator_NoNode AssignmentExprNoIn_NoNode
-;
-
-AssignmentExprNoBF_NoNode:
-    ConditionalExprNoBF_NoNode
-  | LeftHandSideExprNoBF_NoNode AssignmentOperator_NoNode AssignmentExpr_NoNode
-;
-
-AssignmentOperator_NoNode:
-    '='
-  | PLUSEQUAL
-  | MINUSEQUAL
-  | MULTEQUAL
-  | DIVEQUAL
-  | LSHIFTEQUAL
-  | RSHIFTEQUAL
-  | URSHIFTEQUAL
-  | ANDEQUAL
-  | XOREQUAL
-  | OREQUAL
-  | MODEQUAL
-;
-
-Expr_NoNode:
-    AssignmentExpr_NoNode
-  | Expr_NoNode ',' AssignmentExpr_NoNode
-;
-
-ExprNoIn_NoNode:
-    AssignmentExprNoIn_NoNode
-  | ExprNoIn_NoNode ',' AssignmentExprNoIn_NoNode
-;
-
-ExprNoBF_NoNode:
-    AssignmentExprNoBF_NoNode
-  | ExprNoBF_NoNode ',' AssignmentExpr_NoNode
-;
-
-Statement_NoNode:
-    Block_NoNode
-  | VariableStatement_NoNode
-  | ConstStatement_NoNode
-  | FunctionDeclaration_NoNode
-  | EmptyStatement_NoNode
-  | ExprStatement_NoNode
-  | IfStatement_NoNode
-  | IterationStatement_NoNode
-  | ContinueStatement_NoNode
-  | BreakStatement_NoNode
-  | ReturnStatement_NoNode
-  | WithStatement_NoNode
-  | SwitchStatement_NoNode
-  | LabelledStatement_NoNode
-  | ThrowStatement_NoNode
-  | TryStatement_NoNode
-  | DebuggerStatement_NoNode
-;
-
-Block_NoNode:
-    OPENBRACE CLOSEBRACE { }
-  | OPENBRACE SourceElements_NoNode CLOSEBRACE { }
-;
-
-VariableStatement_NoNode:
-    VAR VariableDeclarationList_NoNode ';'
-  | VAR VariableDeclarationList_NoNode error { AUTO_SEMICOLON; }
-;
-
-VariableDeclarationList_NoNode:
-    IDENT { }
-  | IDENT Initializer_NoNode { }
-  | VariableDeclarationList_NoNode ',' IDENT
-  | VariableDeclarationList_NoNode ',' IDENT Initializer_NoNode
-;
-
-VariableDeclarationListNoIn_NoNode:
-    IDENT { }
-  | IDENT InitializerNoIn_NoNode { }
-  | VariableDeclarationListNoIn_NoNode ',' IDENT
-  | VariableDeclarationListNoIn_NoNode ',' IDENT InitializerNoIn_NoNode
-;
-
-ConstStatement_NoNode:
-    CONSTTOKEN ConstDeclarationList_NoNode ';'
-  | CONSTTOKEN ConstDeclarationList_NoNode error { AUTO_SEMICOLON; }
-;
-
-ConstDeclarationList_NoNode:
-    ConstDeclaration_NoNode
-  | ConstDeclarationList_NoNode ',' ConstDeclaration_NoNode
-;
-
-ConstDeclaration_NoNode:
-    IDENT { }
-  | IDENT Initializer_NoNode { }
-;
-
-Initializer_NoNode:
-    '=' AssignmentExpr_NoNode
-;
-
-InitializerNoIn_NoNode:
-    '=' AssignmentExprNoIn_NoNode
-;
-
-EmptyStatement_NoNode:
-    ';'
-;
-
-ExprStatement_NoNode:
-    ExprNoBF_NoNode ';'
-  | ExprNoBF_NoNode error { AUTO_SEMICOLON; }
-;
-
-IfStatement_NoNode:
-    IF '(' Expr_NoNode ')' Statement_NoNode %prec IF_WITHOUT_ELSE
-  | IF '(' Expr_NoNode ')' Statement_NoNode ELSE Statement_NoNode
-;
-
-IterationStatement_NoNode:
-    DO Statement_NoNode WHILE '(' Expr_NoNode ')' ';'
-  | DO Statement_NoNode WHILE '(' Expr_NoNode ')' error // Always performs automatic semicolon insertion
-  | WHILE '(' Expr_NoNode ')' Statement_NoNode
-  | FOR '(' ExprNoInOpt_NoNode ';' ExprOpt_NoNode ';' ExprOpt_NoNode ')' Statement_NoNode
-  | FOR '(' VAR VariableDeclarationListNoIn_NoNode ';' ExprOpt_NoNode ';' ExprOpt_NoNode ')' Statement_NoNode
-  | FOR '(' LeftHandSideExpr_NoNode INTOKEN Expr_NoNode ')' Statement_NoNode
-  | FOR '(' VAR IDENT INTOKEN Expr_NoNode ')' Statement_NoNode
-  | FOR '(' VAR IDENT InitializerNoIn_NoNode INTOKEN Expr_NoNode ')' Statement_NoNode
-;
-
-ExprOpt_NoNode:
-    /* nothing */
-  | Expr_NoNode
-;
-
-ExprNoInOpt_NoNode:
-    /* nothing */
-  | ExprNoIn_NoNode
-;
-
-ContinueStatement_NoNode:
-    CONTINUE ';'
-  | CONTINUE error { AUTO_SEMICOLON; }
-  | CONTINUE IDENT ';'
-  | CONTINUE IDENT error { AUTO_SEMICOLON; }
-;
-
-BreakStatement_NoNode:
-    BREAK ';'
-  | BREAK error { AUTO_SEMICOLON; }
-  | BREAK IDENT ';'
-  | BREAK IDENT error { AUTO_SEMICOLON; }
-;
-
-ReturnStatement_NoNode:
-    RETURN ';'
-  | RETURN error { AUTO_SEMICOLON; }
-  | RETURN Expr_NoNode ';'
-  | RETURN Expr_NoNode error { AUTO_SEMICOLON; }
-;
-
-WithStatement_NoNode:
-    WITH '(' Expr_NoNode ')' Statement_NoNode
-;
-
-SwitchStatement_NoNode:
-    SWITCH '(' Expr_NoNode ')' CaseBlock_NoNode
-;
-
-CaseBlock_NoNode:
-    OPENBRACE CaseClausesOpt_NoNode CLOSEBRACE { }
-  | OPENBRACE CaseClausesOpt_NoNode DefaultClause_NoNode CaseClausesOpt_NoNode CLOSEBRACE { }
-;
-
-CaseClausesOpt_NoNode:
-    /* nothing */
-  | CaseClauses_NoNode
-;
-
-CaseClauses_NoNode:
-    CaseClause_NoNode
-  | CaseClauses_NoNode CaseClause_NoNode
-;
-
-CaseClause_NoNode:
-    CASE Expr_NoNode ':'
-  | CASE Expr_NoNode ':' SourceElements_NoNode
-;
-
-DefaultClause_NoNode:
-    DEFAULT ':'
-  | DEFAULT ':' SourceElements_NoNode
-;
-
-LabelledStatement_NoNode:
-    IDENT ':' Statement_NoNode { }
-;
-
-ThrowStatement_NoNode:
-    THROW Expr_NoNode ';'
-  | THROW Expr_NoNode error { AUTO_SEMICOLON; }
-;
-
-TryStatement_NoNode:
-    TRY Block_NoNode FINALLY Block_NoNode
-  | TRY Block_NoNode CATCH '(' IDENT ')' Block_NoNode
-  | TRY Block_NoNode CATCH '(' IDENT ')' Block_NoNode FINALLY Block_NoNode
-;
-
-DebuggerStatement_NoNode:
-    DEBUGGER ';'
-  | DEBUGGER error { AUTO_SEMICOLON; }
-;
-
-FunctionDeclaration_NoNode:
-    FUNCTION IDENT '(' ')' OPENBRACE FunctionBody_NoNode CLOSEBRACE
-  | FUNCTION IDENT '(' FormalParameterList_NoNode ')' OPENBRACE FunctionBody_NoNode CLOSEBRACE
-;
-
-FunctionExpr_NoNode:
-    FUNCTION '(' ')' OPENBRACE FunctionBody_NoNode CLOSEBRACE
-  | FUNCTION '(' FormalParameterList_NoNode ')' OPENBRACE FunctionBody_NoNode CLOSEBRACE
-  | FUNCTION IDENT '(' ')' OPENBRACE FunctionBody_NoNode CLOSEBRACE
-  | FUNCTION IDENT '(' FormalParameterList_NoNode ')' OPENBRACE FunctionBody_NoNode CLOSEBRACE
-;
-
-FormalParameterList_NoNode:
-    IDENT { }
-  | FormalParameterList_NoNode ',' IDENT
-;
-
-FunctionBody_NoNode:
-    /* not in spec */
-  | SourceElements_NoNode
-;
-
-SourceElements_NoNode:
-    Statement_NoNode
-  | SourceElements_NoNode Statement_NoNode
-;
-
-// End NoNodes
-
-%%
-
-#undef GLOBAL_DATA
-
-static ExpressionNode* makeAssignNode(JSGlobalData* globalData, ExpressionNode* loc, Operator op, ExpressionNode* expr, bool locHasAssignments, bool exprHasAssignments, int start, int divot, int end)
-{
-    if (!loc->isLocation())
-        return new (globalData) AssignErrorNode(globalData, loc, op, expr, divot, divot - start, end - divot);
-
-    if (loc->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(loc);
-        if (op == OpEqual) {
-            AssignResolveNode* node = new (globalData) AssignResolveNode(globalData, resolve->identifier(), expr, exprHasAssignments);
-            setExceptionLocation(node, start, divot, end);
-            return node;
-        } else
-            return new (globalData) ReadModifyResolveNode(globalData, resolve->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
-    }
-    if (loc->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(loc);
-        if (op == OpEqual)
-            return new (globalData) AssignBracketNode(globalData, bracket->base(), bracket->subscript(), expr, locHasAssignments, exprHasAssignments, bracket->divot(), bracket->divot() - start, end - bracket->divot());
-        else {
-            ReadModifyBracketNode* node = new (globalData) ReadModifyBracketNode(globalData, bracket->base(), bracket->subscript(), op, expr, locHasAssignments, exprHasAssignments, divot, divot - start, end - divot);
-            node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
-            return node;
-        }
-    }
-    ASSERT(loc->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(loc);
-    if (op == OpEqual)
-        return new (globalData) AssignDotNode(globalData, dot->base(), dot->identifier(), expr, exprHasAssignments, dot->divot(), dot->divot() - start, end - dot->divot());
-
-    ReadModifyDotNode* node = new (globalData) ReadModifyDotNode(globalData, dot->base(), dot->identifier(), op, expr, exprHasAssignments, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->endOffset());
-    return node;
-}
-
-static ExpressionNode* makePrefixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
-{
-    if (!expr->isLocation())
-        return new (globalData) PrefixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
-    
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) PrefixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PrefixBracketNode* node = new (globalData) PrefixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->startOffset());
-        return node;
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PrefixDotNode* node = new (globalData) PrefixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->startOffset());
-    return node;
-}
-
-static ExpressionNode* makePostfixNode(JSGlobalData* globalData, ExpressionNode* expr, Operator op, int start, int divot, int end)
-{ 
-    if (!expr->isLocation())
-        return new (globalData) PostfixErrorNode(globalData, expr, op, divot, divot - start, end - divot);
-    
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) PostfixResolveNode(globalData, resolve->identifier(), op, divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        PostfixBracketNode* node = new (globalData) PostfixBracketNode(globalData, bracket->base(), bracket->subscript(), op, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
-        return node;
-        
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    PostfixDotNode* node = new (globalData) PostfixDotNode(globalData, dot->base(), dot->identifier(), op, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->endOffset());
-    return node;
-}
-
-static ExpressionNodeInfo makeFunctionCallNode(JSGlobalData* globalData, ExpressionNodeInfo func, ArgumentsNodeInfo args, int start, int divot, int end)
-{
-    CodeFeatures features = func.m_features | args.m_features;
-    int numConstants = func.m_numConstants + args.m_numConstants;
-    if (!func.m_node->isLocation())
-        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallValueNode(globalData, func.m_node, args.m_node, divot, divot - start, end - divot), features, numConstants);
-    if (func.m_node->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(func.m_node);
-        const Identifier& identifier = resolve->identifier();
-        if (identifier == globalData->propertyNames->eval)
-            return createNodeInfo<ExpressionNode*>(new (globalData) EvalFunctionCallNode(globalData, args.m_node, divot, divot - start, end - divot), EvalFeature | features, numConstants);
-        return createNodeInfo<ExpressionNode*>(new (globalData) FunctionCallResolveNode(globalData, identifier, args.m_node, divot, divot - start, end - divot), features, numConstants);
-    }
-    if (func.m_node->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(func.m_node);
-        FunctionCallBracketNode* node = new (globalData) FunctionCallBracketNode(globalData, bracket->base(), bracket->subscript(), args.m_node, divot, divot - start, end - divot);
-        node->setSubexpressionInfo(bracket->divot(), bracket->endOffset());
-        return createNodeInfo<ExpressionNode*>(node, features, numConstants);
-    }
-    ASSERT(func.m_node->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(func.m_node);
-    FunctionCallDotNode* node;
-    if (dot->identifier() == globalData->propertyNames->call)
-        node = new (globalData) CallFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    else if (dot->identifier() == globalData->propertyNames->apply)
-        node = new (globalData) ApplyFunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    else
-        node = new (globalData) FunctionCallDotNode(globalData, dot->base(), dot->identifier(), args.m_node, divot, divot - start, end - divot);
-    node->setSubexpressionInfo(dot->divot(), dot->endOffset());
-    return createNodeInfo<ExpressionNode*>(node, features, numConstants);
-}
-
-static ExpressionNode* makeTypeOfNode(JSGlobalData* globalData, ExpressionNode* expr)
-{
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) TypeOfResolveNode(globalData, resolve->identifier());
-    }
-    return new (globalData) TypeOfValueNode(globalData, expr);
-}
-
-static ExpressionNode* makeDeleteNode(JSGlobalData* globalData, ExpressionNode* expr, int start, int divot, int end)
-{
-    if (!expr->isLocation())
-        return new (globalData) DeleteValueNode(globalData, expr);
-    if (expr->isResolveNode()) {
-        ResolveNode* resolve = static_cast<ResolveNode*>(expr);
-        return new (globalData) DeleteResolveNode(globalData, resolve->identifier(), divot, divot - start, end - divot);
-    }
-    if (expr->isBracketAccessorNode()) {
-        BracketAccessorNode* bracket = static_cast<BracketAccessorNode*>(expr);
-        return new (globalData) DeleteBracketNode(globalData, bracket->base(), bracket->subscript(), divot, divot - start, end - divot);
-    }
-    ASSERT(expr->isDotAccessorNode());
-    DotAccessorNode* dot = static_cast<DotAccessorNode*>(expr);
-    return new (globalData) DeleteDotNode(globalData, dot->base(), dot->identifier(), divot, divot - start, end - divot);
-}
-
-static PropertyNode* makeGetterOrSetterPropertyNode(JSGlobalData* globalData, const Identifier& getOrSet, const Identifier& name, ParameterNode* params, FunctionBodyNode* body, const SourceCode& source)
-{
-    PropertyNode::Type type;
-    if (getOrSet == "get")
-        type = PropertyNode::Getter;
-    else if (getOrSet == "set")
-        type = PropertyNode::Setter;
-    else
-        return 0;
-    return new (globalData) PropertyNode(globalData, name, new (globalData) FuncExprNode(globalData, globalData->propertyNames->nullIdentifier, body, source, params), type);
-}
-
-static ExpressionNode* makeNegateNode(JSGlobalData* globalData, ExpressionNode* n)
-{
-    if (n->isNumber()) {
-        NumberNode* numberNode = static_cast<NumberNode*>(n);
-        numberNode->setValue(-numberNode->value());
-        return numberNode;
-    }
-
-    return new (globalData) NegateNode(globalData, n);
-}
-
-static NumberNode* makeNumberNode(JSGlobalData* globalData, double d)
-{
-    return new (globalData) NumberNode(globalData, d);
-}
-
-static ExpressionNode* makeBitwiseNotNode(JSGlobalData* globalData, ExpressionNode* expr)
-{
-    if (expr->isNumber())
-        return makeNumberNode(globalData, ~toInt32(static_cast<NumberNode*>(expr)->value()));
-    return new (globalData) BitwiseNotNode(globalData, expr);
-}
-
-static ExpressionNode* makeMultNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    expr1 = expr1->stripUnaryPlus();
-    expr2 = expr2->stripUnaryPlus();
-
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() * static_cast<NumberNode*>(expr2)->value());
-
-    if (expr1->isNumber() && static_cast<NumberNode*>(expr1)->value() == 1)
-        return new (globalData) UnaryPlusNode(globalData, expr2);
-
-    if (expr2->isNumber() && static_cast<NumberNode*>(expr2)->value() == 1)
-        return new (globalData) UnaryPlusNode(globalData, expr1);
-
-    return new (globalData) MultNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeDivNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    expr1 = expr1->stripUnaryPlus();
-    expr2 = expr2->stripUnaryPlus();
-
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() / static_cast<NumberNode*>(expr2)->value());
-    return new (globalData) DivNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeAddNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() + static_cast<NumberNode*>(expr2)->value());
-    return new (globalData) AddNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeSubNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    expr1 = expr1->stripUnaryPlus();
-    expr2 = expr2->stripUnaryPlus();
-
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, static_cast<NumberNode*>(expr1)->value() - static_cast<NumberNode*>(expr2)->value());
-    return new (globalData) SubNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeLeftShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) << (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (globalData) LeftShiftNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-static ExpressionNode* makeRightShiftNode(JSGlobalData* globalData, ExpressionNode* expr1, ExpressionNode* expr2, bool rightHasAssignments)
-{
-    if (expr1->isNumber() && expr2->isNumber())
-        return makeNumberNode(globalData, toInt32(static_cast<NumberNode*>(expr1)->value()) >> (toUInt32(static_cast<NumberNode*>(expr2)->value()) & 0x1f));
-    return new (globalData) RightShiftNode(globalData, expr1, expr2, rightHasAssignments);
-}
-
-// Called by yyparse on error.
-int yyerror(const char*)
-{
-    return 1;
-}
-
-// May we automatically insert a semicolon?
-static bool allowAutomaticSemicolon(Lexer& lexer, int yychar)
-{
-    return yychar == CLOSEBRACE || yychar == 0 || lexer.prevTerminator();
-}
-
-static ExpressionNode* combineCommaNodes(JSGlobalData* globalData, ExpressionNode* list, ExpressionNode* init)
-{
-    if (!list)
-        return init;
-    if (list->isCommaNode()) {
-        static_cast<CommaNode*>(list)->append(init);
-        return list;
-    }
-    return new (globalData) CommaNode(globalData, list, init);
-}
-
-// We turn variable declarations into either assignments or empty
-// statements (which later get stripped out), because the actual
-// declaration work is hoisted up to the start of the function body
-static StatementNode* makeVarStatementNode(JSGlobalData* globalData, ExpressionNode* expr)
-{
-    if (!expr)
-        return new (globalData) EmptyStatementNode(globalData);
-    return new (globalData) VarStatementNode(globalData, expr);
-}
diff --git a/JavaScriptCore/parser/JSParser.cpp b/JavaScriptCore/parser/JSParser.cpp
index 1934c0c..5825270 100644
--- a/JavaScriptCore/parser/JSParser.cpp
+++ b/JavaScriptCore/parser/JSParser.cpp
@@ -25,14 +25,12 @@
 
 #include "config.h"
 
-#if ENABLE(RECURSIVE_PARSE)
 #include "JSParser.h"
 
 using namespace JSC;
 
 #include "JSGlobalData.h"
 #include "NodeInfo.h"
-#include "Grammar.h"
 #include "ASTBuilder.h"
 #include <utility>
 
@@ -1499,6 +1497,3 @@ template <class TreeBuilder> TreeExpression JSParser::parseUnaryExpression(TreeB
 }
 
 }
-
-#endif
-
diff --git a/JavaScriptCore/parser/JSParser.h b/JavaScriptCore/parser/JSParser.h
index e212b2a..554556f 100644
--- a/JavaScriptCore/parser/JSParser.h
+++ b/JavaScriptCore/parser/JSParser.h
@@ -25,7 +25,6 @@
 
 #ifndef JSParser_h
 #define JSParser_h
-#if ENABLE(RECURSIVE_PARSE)
 
 namespace JSC {
 
@@ -121,5 +120,4 @@ struct JSToken {
 
 int jsParse(JSGlobalData*);
 }
-#endif
 #endif // JSParser_h
diff --git a/JavaScriptCore/parser/Lexer.cpp b/JavaScriptCore/parser/Lexer.cpp
index 3a38273..660b1a4 100644
--- a/JavaScriptCore/parser/Lexer.cpp
+++ b/JavaScriptCore/parser/Lexer.cpp
@@ -2,6 +2,7 @@
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2006, 2007, 2008, 2009 Apple Inc. All Rights Reserved.
  *  Copyright (C) 2007 Cameron Zwarich (cwzwarich@uwaterloo.ca)
+ *  Copyright (C) 2010 Zoltan Herczeg (zherczeg@inf.u-szeged.hu)
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -38,19 +39,178 @@
 using namespace WTF;
 using namespace Unicode;
 
-#if ENABLE(RECURSIVE_PARSE)
 #include "JSParser.h"
-#else
-using namespace JSC;
-#include "Grammar.h"
-#endif
-
 #include "Lookup.h"
 #include "Lexer.lut.h"
 
 namespace JSC {
 
-static const UChar byteOrderMark = 0xFEFF;
+
+enum CharacterTypes {
+    // Types for the main switch
+    CharacterInvalid,
+
+    CharacterAlpha,
+    CharacterZero,
+    CharacterNumber,
+
+    CharacterLineTerminator,
+    CharacterExclamationMark,
+    CharacterSimple,
+    CharacterQuote,
+    CharacterDot,
+    CharacterSlash,
+    CharacterBackSlash,
+    CharacterSemicolon,
+    CharacterOpenBrace,
+    CharacterCloseBrace,
+
+    CharacterAdd,
+    CharacterSub,
+    CharacterMultiply,
+    CharacterModulo,
+    CharacterAnd,
+    CharacterXor,
+    CharacterOr,
+    CharacterLess,
+    CharacterGreater,
+    CharacterEqual,
+
+    // Other types (only one so far)
+    CharacterWhiteSpace,
+};
+
+// 128 ascii codes
+static unsigned char AsciiCharacters[128] = {
+/*   0 - Null               */ CharacterInvalid,
+/*   1 - Start of Heading   */ CharacterInvalid,
+/*   2 - Start of Text      */ CharacterInvalid,
+/*   3 - End of Text        */ CharacterInvalid,
+/*   4 - End of Transm.     */ CharacterInvalid,
+/*   5 - Enquiry            */ CharacterInvalid,
+/*   6 - Acknowledgment     */ CharacterInvalid,
+/*   7 - Bell               */ CharacterInvalid,
+/*   8 - Back Space         */ CharacterInvalid,
+/*   9 - Horizontal Tab     */ CharacterWhiteSpace,
+/*  10 - Line Feed          */ CharacterLineTerminator,
+/*  11 - Vertical Tab       */ CharacterWhiteSpace,
+/*  12 - Form Feed          */ CharacterWhiteSpace,
+/*  13 - Carriage Return    */ CharacterLineTerminator,
+/*  14 - Shift Out          */ CharacterInvalid,
+/*  15 - Shift In           */ CharacterInvalid,
+/*  16 - Data Line Escape   */ CharacterInvalid,
+/*  17 - Device Control 1   */ CharacterInvalid,
+/*  18 - Device Control 2   */ CharacterInvalid,
+/*  19 - Device Control 3   */ CharacterInvalid,
+/*  20 - Device Control 4   */ CharacterInvalid,
+/*  21 - Negative Ack.      */ CharacterInvalid,
+/*  22 - Synchronous Idle   */ CharacterInvalid,
+/*  23 - End of Transmit    */ CharacterInvalid,
+/*  24 - Cancel             */ CharacterInvalid,
+/*  25 - End of Medium      */ CharacterInvalid,
+/*  26 - Substitute         */ CharacterInvalid,
+/*  27 - Escape             */ CharacterInvalid,
+/*  28 - File Separator     */ CharacterInvalid,
+/*  29 - Group Separator    */ CharacterInvalid,
+/*  30 - Record Separator   */ CharacterInvalid,
+/*  31 - Unit Separator     */ CharacterInvalid,
+/*  32 - Space              */ CharacterWhiteSpace,
+/*  33 - !                  */ CharacterExclamationMark,
+/*  34 - "                  */ CharacterQuote,
+/*  35 - #                  */ CharacterInvalid,
+/*  36 - $                  */ CharacterAlpha,
+/*  37 - %                  */ CharacterModulo,
+/*  38 - &                  */ CharacterAnd,
+/*  39 - '                  */ CharacterQuote,
+/*  40 - (                  */ CharacterSimple,
+/*  41 - )                  */ CharacterSimple,
+/*  42 - *                  */ CharacterMultiply,
+/*  43 - +                  */ CharacterAdd,
+/*  44 - ,                  */ CharacterSimple,
+/*  45 - -                  */ CharacterSub,
+/*  46 - .                  */ CharacterDot,
+/*  47 - /                  */ CharacterSlash,
+/*  48 - 0                  */ CharacterZero,
+/*  49 - 1                  */ CharacterNumber,
+/*  50 - 2                  */ CharacterNumber,
+/*  51 - 3                  */ CharacterNumber,
+/*  52 - 4                  */ CharacterNumber,
+/*  53 - 5                  */ CharacterNumber,
+/*  54 - 6                  */ CharacterNumber,
+/*  55 - 7                  */ CharacterNumber,
+/*  56 - 8                  */ CharacterNumber,
+/*  57 - 9                  */ CharacterNumber,
+/*  58 - :                  */ CharacterSimple,
+/*  59 - ;                  */ CharacterSemicolon,
+/*  60 - <                  */ CharacterLess,
+/*  61 - =                  */ CharacterEqual,
+/*  62 - >                  */ CharacterGreater,
+/*  63 - ?                  */ CharacterSimple,
+/*  64 - @                  */ CharacterInvalid,
+/*  65 - A                  */ CharacterAlpha,
+/*  66 - B                  */ CharacterAlpha,
+/*  67 - C                  */ CharacterAlpha,
+/*  68 - D                  */ CharacterAlpha,
+/*  69 - E                  */ CharacterAlpha,
+/*  70 - F                  */ CharacterAlpha,
+/*  71 - G                  */ CharacterAlpha,
+/*  72 - H                  */ CharacterAlpha,
+/*  73 - I                  */ CharacterAlpha,
+/*  74 - J                  */ CharacterAlpha,
+/*  75 - K                  */ CharacterAlpha,
+/*  76 - L                  */ CharacterAlpha,
+/*  77 - M                  */ CharacterAlpha,
+/*  78 - N                  */ CharacterAlpha,
+/*  79 - O                  */ CharacterAlpha,
+/*  80 - P                  */ CharacterAlpha,
+/*  81 - Q                  */ CharacterAlpha,
+/*  82 - R                  */ CharacterAlpha,
+/*  83 - S                  */ CharacterAlpha,
+/*  84 - T                  */ CharacterAlpha,
+/*  85 - U                  */ CharacterAlpha,
+/*  86 - V                  */ CharacterAlpha,
+/*  87 - W                  */ CharacterAlpha,
+/*  88 - X                  */ CharacterAlpha,
+/*  89 - Y                  */ CharacterAlpha,
+/*  90 - Z                  */ CharacterAlpha,
+/*  91 - [                  */ CharacterSimple,
+/*  92 - \                  */ CharacterBackSlash,
+/*  93 - ]                  */ CharacterSimple,
+/*  94 - ^                  */ CharacterXor,
+/*  95 - _                  */ CharacterAlpha,
+/*  96 - `                  */ CharacterInvalid,
+/*  97 - a                  */ CharacterAlpha,
+/*  98 - b                  */ CharacterAlpha,
+/*  99 - c                  */ CharacterAlpha,
+/* 100 - d                  */ CharacterAlpha,
+/* 101 - e                  */ CharacterAlpha,
+/* 102 - f                  */ CharacterAlpha,
+/* 103 - g                  */ CharacterAlpha,
+/* 104 - h                  */ CharacterAlpha,
+/* 105 - i                  */ CharacterAlpha,
+/* 106 - j                  */ CharacterAlpha,
+/* 107 - k                  */ CharacterAlpha,
+/* 108 - l                  */ CharacterAlpha,
+/* 109 - m                  */ CharacterAlpha,
+/* 110 - n                  */ CharacterAlpha,
+/* 111 - o                  */ CharacterAlpha,
+/* 112 - p                  */ CharacterAlpha,
+/* 113 - q                  */ CharacterAlpha,
+/* 114 - r                  */ CharacterAlpha,
+/* 115 - s                  */ CharacterAlpha,
+/* 116 - t                  */ CharacterAlpha,
+/* 117 - u                  */ CharacterAlpha,
+/* 118 - v                  */ CharacterAlpha,
+/* 119 - w                  */ CharacterAlpha,
+/* 120 - x                  */ CharacterAlpha,
+/* 121 - y                  */ CharacterAlpha,
+/* 122 - z                  */ CharacterAlpha,
+/* 123 - {                  */ CharacterOpenBrace,
+/* 124 - |                  */ CharacterOr,
+/* 125 - }                  */ CharacterCloseBrace,
+/* 126 - ~                  */ CharacterSimple,
+/* 127 - Delete             */ CharacterInvalid,
+};
 
 Lexer::Lexer(JSGlobalData* globalData)
     : m_isReparsing(false)
@@ -64,77 +224,17 @@ Lexer::~Lexer()
     m_keywordTable.deleteTable();
 }
 
-inline const UChar* Lexer::currentCharacter() const
+ALWAYS_INLINE const UChar* Lexer::currentCharacter() const
 {
-    return m_code - 4;
+    ASSERT(m_code <= m_codeEnd);
+    return m_code;
 }
 
-inline int Lexer::currentOffset() const
+ALWAYS_INLINE int Lexer::currentOffset() const
 {
     return currentCharacter() - m_codeStart;
 }
 
-ALWAYS_INLINE void Lexer::shift1()
-{
-    m_current = m_next1;
-    m_next1 = m_next2;
-    m_next2 = m_next3;
-    if (LIKELY(m_code < m_codeEnd))
-        m_next3 = m_code[0];
-    else
-        m_next3 = -1;
-
-    ++m_code;
-}
-
-ALWAYS_INLINE void Lexer::shift2()
-{
-    m_current = m_next2;
-    m_next1 = m_next3;
-    if (LIKELY(m_code + 1 < m_codeEnd)) {
-        m_next2 = m_code[0];
-        m_next3 = m_code[1];
-    } else {
-        m_next2 = m_code < m_codeEnd ? m_code[0] : -1;
-        m_next3 = -1;
-    }
-
-    m_code += 2;
-}
-
-ALWAYS_INLINE void Lexer::shift3()
-{
-    m_current = m_next3;
-    if (LIKELY(m_code + 2 < m_codeEnd)) {
-        m_next1 = m_code[0];
-        m_next2 = m_code[1];
-        m_next3 = m_code[2];
-    } else {
-        m_next1 = m_code < m_codeEnd ? m_code[0] : -1;
-        m_next2 = m_code + 1 < m_codeEnd ? m_code[1] : -1;
-        m_next3 = -1;
-    }
-
-    m_code += 3;
-}
-
-ALWAYS_INLINE void Lexer::shift4()
-{
-    if (LIKELY(m_code + 3 < m_codeEnd)) {
-        m_current = m_code[0];
-        m_next1 = m_code[1];
-        m_next2 = m_code[2];
-        m_next3 = m_code[3];
-    } else {
-        m_current = m_code < m_codeEnd ? m_code[0] : -1;
-        m_next1 = m_code + 1 < m_codeEnd ? m_code[1] : -1;
-        m_next2 = m_code + 2 < m_codeEnd ? m_code[2] : -1;
-        m_next3 = -1;
-    }
-
-    m_code += 4;
-}
-
 void Lexer::setCode(const SourceCode& source, ParserArena& arena)
 {
     m_arena = &arena.identifierArena();
@@ -155,50 +255,58 @@ void Lexer::setCode(const SourceCode& source, ParserArena& arena)
     m_buffer8.reserveInitialCapacity(initialReadBufferCapacity);
     m_buffer16.reserveInitialCapacity((m_codeEnd - m_code) / 2);
 
-    // ECMA-262 calls for stripping all Cf characters, but we only strip BOM characters.
-    // See <https://bugs.webkit.org/show_bug.cgi?id=4931> for details.
-    if (source.provider()->hasBOMs()) {
-        for (const UChar* p = m_codeStart; p < m_codeEnd; ++p) {
-            if (UNLIKELY(*p == byteOrderMark)) {
-                copyCodeWithoutBOMs();
-                break;
-            }
-        }
-    }
-
-    // Read the first characters into the 4-character buffer.
-    shift4();
+    if (LIKELY(m_code < m_codeEnd))
+        m_current = *m_code;
+    else
+        m_current = -1;
     ASSERT(currentOffset() == source.startOffset());
 }
 
-void Lexer::copyCodeWithoutBOMs()
+ALWAYS_INLINE void Lexer::shift()
 {
-    // Note: In this case, the character offset data for debugging will be incorrect.
-    // If it's important to correctly debug code with extraneous BOMs, then the caller
-    // should strip the BOMs when creating the SourceProvider object and do its own
-    // mapping of offsets within the stripped text to original text offset.
-
-    m_codeWithoutBOMs.reserveCapacity(m_codeEnd - m_code);
-    for (const UChar* p = m_code; p < m_codeEnd; ++p) {
-        UChar c = *p;
-        if (c != byteOrderMark)
-            m_codeWithoutBOMs.append(c);
-    }
-    ptrdiff_t startDelta = m_codeStart - m_code;
-    m_code = m_codeWithoutBOMs.data();
-    m_codeStart = m_code + startDelta;
-    m_codeEnd = m_codeWithoutBOMs.data() + m_codeWithoutBOMs.size();
+    // Faster than an if-else sequence
+    ASSERT(m_current != -1);
+    m_current = -1;
+    ++m_code;
+    if (LIKELY(m_code < m_codeEnd))
+        m_current = *m_code;
+}
+
+ALWAYS_INLINE int Lexer::peek(int offset)
+{
+    // Only use if necessary
+    ASSERT(offset > 0 && offset < 5);
+    const UChar* code = m_code + offset;
+    return (code < m_codeEnd) ? *code : -1;
+}
+
+int Lexer::getUnicodeCharacter()
+{
+    int char1 = peek(1);
+    int char2 = peek(2);
+    int char3 = peek(3);
+
+    if (UNLIKELY(!isASCIIHexDigit(m_current) || !isASCIIHexDigit(char1) || !isASCIIHexDigit(char2) || !isASCIIHexDigit(char3)))
+        return -1;
+
+    int result = convertUnicode(m_current, char1, char2, char3);
+    shift();
+    shift();
+    shift();
+    shift();
+    return result;
 }
 
 void Lexer::shiftLineTerminator()
 {
     ASSERT(isLineTerminator(m_current));
 
+    int m_prev = m_current;
+    shift();
+
     // Allow both CRLF and LFCR.
-    if (m_current + m_next1 == '\n' + '\r')
-        shift2();
-    else
-        shift1();
+    if (m_prev + m_current == '\n' + '\r')
+        shift();
 
     ++m_lineNumber;
 }
@@ -208,7 +316,7 @@ ALWAYS_INLINE const Identifier* Lexer::makeIdentifier(const UChar* characters, s
     return &m_arena->makeIdentifier(m_globalData, characters, length);
 }
 
-inline bool Lexer::lastTokenWasRestrKeyword() const
+ALWAYS_INLINE bool Lexer::lastTokenWasRestrKeyword() const
 {
     return m_lastToken == CONTINUE || m_lastToken == BREAK || m_lastToken == RETURN || m_lastToken == THROW;
 }
@@ -286,11 +394,11 @@ int Lexer::lex(void* p1, void* p2)
 
 start:
     while (isWhiteSpace(m_current))
-        shift1();
+        shift();
 
     int startOffset = currentOffset();
 
-    if (m_current == -1) {
+    if (UNLIKELY(m_current == -1)) {
         if (!m_terminator && !m_delimited && !m_isReparsing) {
             // automatic semicolon insertion if program incomplete
             token = ';';
@@ -300,265 +408,268 @@ start:
     }
 
     m_delimited = false;
-    switch (m_current) {
-        case '>':
-            if (m_next1 == '>' && m_next2 == '>') {
-                if (m_next3 == '=') {
-                    shift4();
-                    token = URSHIFTEQUAL;
+    ASSERT(m_current >= 0);
+
+    if (m_current < 128) {
+        ASSERT(isASCII(m_current));
+
+        switch (AsciiCharacters[m_current]) {
+        case CharacterGreater:
+            shift();
+            if (m_current == '>') {
+                shift();
+                if (m_current == '>') {
+                    shift();
+                    if (m_current == '=') {
+                        shift();
+                        token = URSHIFTEQUAL;
+                        break;
+                    }
+                    token = URSHIFT;
                     break;
                 }
-                shift3();
-                token = URSHIFT;
-                break;
-            }
-            if (m_next1 == '>') {
-                if (m_next2 == '=') {
-                    shift3();
+                if (m_current == '=') {
+                    shift();
                     token = RSHIFTEQUAL;
                     break;
                 }
-                shift2();
                 token = RSHIFT;
                 break;
             }
-            if (m_next1 == '=') {
-                shift2();
+            if (m_current == '=') {
+                shift();
                 token = GE;
                 break;
             }
-            shift1();
             token = '>';
             break;
-        case '=':
-            if (m_next1 == '=') {
-                if (m_next2 == '=') {
-                    shift3();
+        case CharacterEqual:
+            shift();
+            if (m_current == '=') {
+                shift();
+                if (m_current == '=') {
+                    shift();
                     token = STREQ;
                     break;
                 }
-                shift2();
                 token = EQEQ;
                 break;
             }
-            shift1();
             token = '=';
             break;
-        case '!':
-            if (m_next1 == '=') {
-                if (m_next2 == '=') {
-                    shift3();
-                    token = STRNEQ;
-                    break;
-                }
-                shift2();
-                token = NE;
-                break;
-            }
-            shift1();
-            token = '!';
-            break;
-        case '<':
-            if (m_next1 == '!' && m_next2 == '-' && m_next3 == '-') {
+        case CharacterLess:
+            shift();
+            if (m_current == '!' && peek(1) == '-' && peek(2) == '-') {
                 // <!-- marks the beginning of a line comment (for www usage)
-                shift4();
                 goto inSingleLineComment;
             }
-            if (m_next1 == '<') {
-                if (m_next2 == '=') {
-                    shift3();
+            if (m_current == '<') {
+                shift();
+                if (m_current == '=') {
+                    shift();
                     token = LSHIFTEQUAL;
                     break;
                 }
-                shift2();
                 token = LSHIFT;
                 break;
             }
-            if (m_next1 == '=') {
-                shift2();
+            if (m_current == '=') {
+                shift();
                 token = LE;
                 break;
             }
-            shift1();
             token = '<';
             break;
-        case '+':
-            if (m_next1 == '+') {
-                shift2();
-                if (m_terminator) {
-                    token = AUTOPLUSPLUS;
+        case CharacterExclamationMark:
+            shift();
+            if (m_current == '=') {
+                shift();
+                if (m_current == '=') {
+                    shift();
+                    token = STRNEQ;
                     break;
                 }
-                token = PLUSPLUS;
+                token = NE;
+                break;
+            }
+            token = '!';
+            break;
+        case CharacterAdd:
+            shift();
+            if (m_current == '+') {
+                shift();
+                token = (!m_terminator) ? PLUSPLUS : AUTOPLUSPLUS;
                 break;
             }
-            if (m_next1 == '=') {
-                shift2();
+            if (m_current == '=') {
+                shift();
                 token = PLUSEQUAL;
                 break;
             }
-            shift1();
             token = '+';
             break;
-        case '-':
-            if (m_next1 == '-') {
-                if (m_atLineStart && m_next2 == '>') {
-                    shift3();
+        case CharacterSub:
+            shift();
+            if (m_current == '-') {
+                shift();
+                if (m_atLineStart && m_current == '>') {
+                    shift();
                     goto inSingleLineComment;
                 }
-                shift2();
-                if (m_terminator) {
-                    token = AUTOMINUSMINUS;
-                    break;
-                }
-                token = MINUSMINUS;
+                token = (!m_terminator) ? MINUSMINUS : AUTOMINUSMINUS;
                 break;
             }
-            if (m_next1 == '=') {
-                shift2();
+            if (m_current == '=') {
+                shift();
                 token = MINUSEQUAL;
                 break;
             }
-            shift1();
             token = '-';
             break;
-        case '*':
-            if (m_next1 == '=') {
-                shift2();
+        case CharacterMultiply:
+            shift();
+            if (m_current == '=') {
+                shift();
                 token = MULTEQUAL;
                 break;
             }
-            shift1();
             token = '*';
             break;
-        case '/':
-            if (m_next1 == '/') {
-                shift2();
+        case CharacterSlash:
+            shift();
+            if (m_current == '/') {
+                shift();
                 goto inSingleLineComment;
             }
-            if (m_next1 == '*')
+            if (m_current == '*') {
+                shift();
                 goto inMultiLineComment;
-            if (m_next1 == '=') {
-                shift2();
+            }
+            if (m_current == '=') {
+                shift();
                 token = DIVEQUAL;
                 break;
             }
-            shift1();
             token = '/';
             break;
-        case '&':
-            if (m_next1 == '&') {
-                shift2();
+        case CharacterAnd:
+            shift();
+            if (m_current == '&') {
+                shift();
                 token = AND;
                 break;
             }
-            if (m_next1 == '=') {
-                shift2();
+            if (m_current == '=') {
+                shift();
                 token = ANDEQUAL;
                 break;
             }
-            shift1();
             token = '&';
             break;
-        case '^':
-            if (m_next1 == '=') {
-                shift2();
+        case CharacterXor:
+            shift();
+            if (m_current == '=') {
+                shift();
                 token = XOREQUAL;
                 break;
             }
-            shift1();
             token = '^';
             break;
-        case '%':
-            if (m_next1 == '=') {
-                shift2();
+        case CharacterModulo:
+            shift();
+            if (m_current == '=') {
+                shift();
                 token = MODEQUAL;
                 break;
             }
-            shift1();
             token = '%';
             break;
-        case '|':
-            if (m_next1 == '=') {
-                shift2();
+        case CharacterOr:
+            shift();
+            if (m_current == '=') {
+                shift();
                 token = OREQUAL;
                 break;
             }
-            if (m_next1 == '|') {
-                shift2();
+            if (m_current == '|') {
+                shift();
                 token = OR;
                 break;
             }
-            shift1();
             token = '|';
             break;
-        case '.':
-            if (isASCIIDigit(m_next1)) {
+        case CharacterDot:
+            shift();
+            if (isASCIIDigit(m_current)) {
                 record8('.');
-                shift1();
                 goto inNumberAfterDecimalPoint;
             }
             token = '.';
-            shift1();
             break;
-        case ',':
-        case '~':
-        case '?':
-        case ':':
-        case '(':
-        case ')':
-        case '[':
-        case ']':
+        case CharacterSimple:
             token = m_current;
-            shift1();
+            shift();
             break;
-        case ';':
-            shift1();
+        case CharacterSemicolon:
             m_delimited = true;
+            shift();
             token = ';';
             break;
-        case '{':
+        case CharacterOpenBrace:
             lvalp->intValue = currentOffset();
-            shift1();
+            shift();
             token = OPENBRACE;
             break;
-        case '}':
+        case CharacterCloseBrace:
             lvalp->intValue = currentOffset();
-            shift1();
             m_delimited = true;
+            shift();
             token = CLOSEBRACE;
             break;
-        case '\\':
+        case CharacterBackSlash:
             goto startIdentifierWithBackslash;
-        case '0':
+        case CharacterZero:
             goto startNumberWithZeroDigit;
-        case '1':
-        case '2':
-        case '3':
-        case '4':
-        case '5':
-        case '6':
-        case '7':
-        case '8':
-        case '9':
+        case CharacterNumber:
             goto startNumber;
-        case '"':
-        case '\'':
+        case CharacterQuote:
             goto startString;
-        default:
-            if (isIdentStart(m_current))
-                goto startIdentifierOrKeyword;
-            if (isLineTerminator(m_current)) {
-                shiftLineTerminator();
-                m_atLineStart = true;
-                m_terminator = true;
-                if (lastTokenWasRestrKeyword()) {
-                    token = ';';
-                    goto doneSemicolon;
-                }
-                goto start;
+        case CharacterAlpha:
+            ASSERT(isIdentStart(m_current));
+            goto startIdentifierOrKeyword;
+        case CharacterLineTerminator:
+            ASSERT(isLineTerminator(m_current));
+            shiftLineTerminator();
+            m_atLineStart = true;
+            m_terminator = true;
+            if (lastTokenWasRestrKeyword()) {
+                token = ';';
+                goto doneSemicolon;
             }
+            goto start;
+        case CharacterInvalid:
             goto returnError;
+        default:
+            ASSERT_NOT_REACHED();
+            goto returnError;
+        }
+    } else {
+        // Rare characters
+        ASSERT(!isASCII(m_current));
+
+        if (isNonASCIIIdentStart(m_current))
+            goto startIdentifierOrKeyword;
+        if (isLineTerminator(m_current)) {
+            shiftLineTerminator();
+            m_atLineStart = true;
+            m_terminator = true;
+            if (lastTokenWasRestrKeyword()) {
+                token = ';';
+                goto doneSemicolon;
+            }
+            goto start;
+        }
+        goto returnError;
     }
 
     m_atLineStart = false;
@@ -566,7 +677,7 @@ start:
 
 startString: {
     int stringQuoteCharacter = m_current;
-    shift1();
+    shift();
 
     const UChar* stringStart = currentCharacter();
     while (m_current != stringQuoteCharacter) {
@@ -577,10 +688,10 @@ startString: {
             m_buffer16.append(stringStart, currentCharacter() - stringStart);
             goto inString;
         }
-        shift1();
+        shift();
     }
     lvalp->ident = makeIdentifier(stringStart, currentCharacter() - stringStart);
-    shift1();
+    shift();
     m_atLineStart = false;
     m_delimited = false;
     token = STRING;
@@ -595,17 +706,19 @@ inString:
         if (UNLIKELY(m_current == -1))
             goto returnError;
         record16(m_current);
-        shift1();
+        shift();
     }
     goto doneString;
 
 inStringEscapeSequence:
-    shift1();
+    shift();
     if (m_current == 'x') {
-        shift1();
-        if (isASCIIHexDigit(m_current) && isASCIIHexDigit(m_next1)) {
-            record16(convertHex(m_current, m_next1));
-            shift2();
+        shift();
+        if (isASCIIHexDigit(m_current) && isASCIIHexDigit(peek(1))) {
+            int prev = m_current;
+            shift();
+            record16(convertHex(prev, m_current));
+            shift();
             goto inString;
         }
         record16('x');
@@ -614,10 +727,10 @@ inStringEscapeSequence:
         goto inString;
     }
     if (m_current == 'u') {
-        shift1();
-        if (isASCIIHexDigit(m_current) && isASCIIHexDigit(m_next1) && isASCIIHexDigit(m_next2) && isASCIIHexDigit(m_next3)) {
-            record16(convertUnicode(m_current, m_next1, m_next2, m_next3));
-            shift4();
+        shift();
+        token = getUnicodeCharacter();
+        if (token != -1) {
+            record16(token);
             goto inString;
         }
         if (m_current == stringQuoteCharacter) {
@@ -627,18 +740,21 @@ inStringEscapeSequence:
         goto returnError;
     }
     if (isASCIIOctalDigit(m_current)) {
-        if (m_current >= '0' && m_current <= '3' && isASCIIOctalDigit(m_next1) && isASCIIOctalDigit(m_next2)) {
-            record16((m_current - '0') * 64 + (m_next1 - '0') * 8 + m_next2 - '0');
-            shift3();
+        int char1 = m_current;
+        shift();
+        if (char1 >= '0' && char1 <= '3' && isASCIIOctalDigit(m_current) && isASCIIOctalDigit(peek(1))) {
+            int char2 = m_current;
+            shift();
+            record16((char1 - '0') * 64 + (char2 - '0') * 8 + m_current - '0');
+            shift();
             goto inString;
         }
-        if (isASCIIOctalDigit(m_next1)) {
-            record16((m_current - '0') * 8 + m_next1 - '0');
-            shift2();
+        if (isASCIIOctalDigit(m_current)) {
+            record16((char1 - '0') * 8 + m_current - '0');
+            shift();
             goto inString;
         }
-        record16(m_current - '0');
-        shift1();
+        record16(char1 - '0');
         goto inString;
     }
     if (isLineTerminator(m_current)) {
@@ -648,28 +764,31 @@ inStringEscapeSequence:
     if (m_current == -1)
         goto returnError;
     record16(singleEscape(m_current));
-    shift1();
+    shift();
     goto inString;
 }
 
-startIdentifierWithBackslash:
-    shift1();
+startIdentifierWithBackslash: {
+    shift();
     if (UNLIKELY(m_current != 'u'))
         goto returnError;
-    shift1();
-    if (UNLIKELY(!isASCIIHexDigit(m_current) || !isASCIIHexDigit(m_next1) || !isASCIIHexDigit(m_next2) || !isASCIIHexDigit(m_next3)))
+    shift();
+
+    token = getUnicodeCharacter();
+    if (UNLIKELY(token == -1))
         goto returnError;
-    token = convertUnicode(m_current, m_next1, m_next2, m_next3);
     if (UNLIKELY(!isIdentStart(token)))
         goto returnError;
     goto inIdentifierAfterCharacterCheck;
+}
 
 startIdentifierOrKeyword: {
     const UChar* identifierStart = currentCharacter();
-    shift1();
+    shift();
     while (isIdentPart(m_current))
-        shift1();
+        shift();
     if (LIKELY(m_current != '\\')) {
+        // Fast case for idents which does not contain \uCCCC characters
         lvalp->ident = makeIdentifier(identifierStart, currentCharacter() - identifierStart);
         goto doneIdentifierOrKeyword;
     }
@@ -677,22 +796,21 @@ startIdentifierOrKeyword: {
 }
 
     do {
-        shift1();
+        shift();
         if (UNLIKELY(m_current != 'u'))
             goto returnError;
-        shift1();
-        if (UNLIKELY(!isASCIIHexDigit(m_current) || !isASCIIHexDigit(m_next1) || !isASCIIHexDigit(m_next2) || !isASCIIHexDigit(m_next3)))
+        shift();
+        token = getUnicodeCharacter();
+        if (UNLIKELY(token == -1))
             goto returnError;
-        token = convertUnicode(m_current, m_next1, m_next2, m_next3);
         if (UNLIKELY(!isIdentPart(token)))
             goto returnError;
 inIdentifierAfterCharacterCheck:
         record16(token);
-        shift4();
 
         while (isIdentPart(m_current)) {
             record16(m_current);
-            shift1();
+            shift();
         }
     } while (UNLIKELY(m_current == '\\'));
     goto doneIdentifier;
@@ -701,7 +819,7 @@ inSingleLineComment:
     while (!isLineTerminator(m_current)) {
         if (UNLIKELY(m_current == -1))
             return 0;
-        shift1();
+        shift();
     }
     shiftLineTerminator();
     m_atLineStart = true;
@@ -711,36 +829,43 @@ inSingleLineComment:
     goto start;
 
 inMultiLineComment:
-    shift2();
-    while (m_current != '*' || m_next1 != '/') {
+    while (true) {
+        if (UNLIKELY(m_current == '*')) {
+            shift();
+            if (m_current == '/')
+                break;
+            if (m_current == '*')
+                continue;
+        }
+
+        if (UNLIKELY(m_current == -1))
+            goto returnError;
+
         if (isLineTerminator(m_current))
             shiftLineTerminator();
-        else {
-            shift1();
-            if (UNLIKELY(m_current == -1))
-                goto returnError;
-        }
+        else
+            shift();
     }
-    shift2();
+    shift();
     m_atLineStart = false;
     goto start;
 
 startNumberWithZeroDigit:
-    shift1();
-    if ((m_current | 0x20) == 'x' && isASCIIHexDigit(m_next1)) {
-        shift1();
+    shift();
+    if ((m_current | 0x20) == 'x' && isASCIIHexDigit(peek(1))) {
+        shift();
         goto inHex;
     }
     if (m_current == '.') {
         record8('0');
         record8('.');
-        shift1();
+        shift();
         goto inNumberAfterDecimalPoint;
     }
     if ((m_current | 0x20) == 'e') {
         record8('0');
         record8('e');
-        shift1();
+        shift();
         goto inExponentIndicator;
     }
     if (isASCIIOctalDigit(m_current))
@@ -753,11 +878,11 @@ startNumberWithZeroDigit:
 inNumberAfterDecimalPoint:
     while (isASCIIDigit(m_current)) {
         record8(m_current);
-        shift1();
+        shift();
     }
     if ((m_current | 0x20) == 'e') {
         record8('e');
-        shift1();
+        shift();
         goto inExponentIndicator;
     }
     goto doneNumber;
@@ -765,20 +890,20 @@ inNumberAfterDecimalPoint:
 inExponentIndicator:
     if (m_current == '+' || m_current == '-') {
         record8(m_current);
-        shift1();
+        shift();
     }
     if (!isASCIIDigit(m_current))
         goto returnError;
     do {
         record8(m_current);
-        shift1();
+        shift();
     } while (isASCIIDigit(m_current));
     goto doneNumber;
 
 inOctal: {
     do {
         record8(m_current);
-        shift1();
+        shift();
     } while (isASCIIOctalDigit(m_current));
     if (isASCIIDigit(m_current))
         goto startNumber;
@@ -802,7 +927,7 @@ inOctal: {
 inHex: {
     do {
         record8(m_current);
-        shift1();
+        shift();
     } while (isASCIIHexDigit(m_current));
 
     double dval = 0;
@@ -823,19 +948,19 @@ inHex: {
 
 startNumber:
     record8(m_current);
-    shift1();
+    shift();
     while (isASCIIDigit(m_current)) {
         record8(m_current);
-        shift1();
+        shift();
     }
     if (m_current == '.') {
         record8('.');
-        shift1();
+        shift();
         goto inNumberAfterDecimalPoint;
     }
     if ((m_current | 0x20) == 'e') {
         record8('e');
-        shift1();
+        shift();
         goto inExponentIndicator;
     }
 
@@ -883,7 +1008,7 @@ doneIdentifierOrKeyword: {
 
 doneString:
     // Atomize constant strings in case they're later used in property lookup.
-    shift1();
+    shift();
     m_atLineStart = false;
     m_delimited = false;
     lvalp->ident = makeIdentifier(m_buffer16.data(), m_buffer16.size());
@@ -929,7 +1054,7 @@ bool Lexer::scanRegExp(const Identifier*& pattern, const Identifier*& flags, UCh
             return false;
         }
 
-        shift1();
+        shift();
 
         if (current == '/' && !lastWasEscape && !inBrackets)
             break;
@@ -959,7 +1084,7 @@ bool Lexer::scanRegExp(const Identifier*& pattern, const Identifier*& flags, UCh
 
     while (isIdentPart(m_current)) {
         record16(m_current);
-        shift1();
+        shift();
     }
 
     flags = makeIdentifier(m_buffer16.data(), m_buffer16.size());
@@ -979,7 +1104,7 @@ bool Lexer::skipRegExp()
         if (isLineTerminator(current) || current == -1)
             return false;
 
-        shift1();
+        shift();
 
         if (current == '/' && !lastWasEscape && !inBrackets)
             break;
@@ -1003,7 +1128,7 @@ bool Lexer::skipRegExp()
     }
 
     while (isIdentPart(m_current))
-        shift1();
+        shift();
 
     return true;
 }
@@ -1024,26 +1149,6 @@ void Lexer::clear()
 
 SourceCode Lexer::sourceCode(int openBrace, int closeBrace, int firstLine)
 {
-    if (m_codeWithoutBOMs.isEmpty())
-        return SourceCode(m_source->provider(), openBrace, closeBrace + 1, firstLine);
-
-    const UChar* data = m_source->provider()->data();
-    
-    ASSERT(openBrace < closeBrace);
-    int i;
-    for (i = m_source->startOffset(); i < openBrace; ++i) {
-        if (data[i] == byteOrderMark) {
-            openBrace++;
-            closeBrace++;
-        }
-    }
-    for (; i < closeBrace; ++i) {
-        if (data[i] == byteOrderMark)
-            closeBrace++;
-    }
-
-    ASSERT(openBrace < closeBrace);
-
     return SourceCode(m_source->provider(), openBrace, closeBrace + 1, firstLine);
 }
 
diff --git a/JavaScriptCore/parser/Lexer.h b/JavaScriptCore/parser/Lexer.h
index f197093..ec254ce 100644
--- a/JavaScriptCore/parser/Lexer.h
+++ b/JavaScriptCore/parser/Lexer.h
@@ -1,6 +1,7 @@
 /*
  *  Copyright (C) 1999-2000 Harri Porten (porten@kde.org)
  *  Copyright (C) 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *  Copyright (C) 2010 Zoltan Herczeg (zherczeg@inf.u-szeged.hu)
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -26,6 +27,7 @@
 #include "ParserArena.h"
 #include "SourceCode.h"
 #include <wtf/ASCIICType.h>
+#include <wtf/AlwaysInline.h>
 #include <wtf/SegmentedVector.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/Unicode.h>
@@ -66,24 +68,23 @@ namespace JSC {
         Lexer(JSGlobalData*);
         ~Lexer();
 
-        void shift1();
-        void shift2();
-        void shift3();
-        void shift4();
-        void shiftLineTerminator();
-
         void record8(int);
         void record16(int);
         void record16(UChar);
 
         void copyCodeWithoutBOMs();
 
-        int currentOffset() const;
-        const UChar* currentCharacter() const;
+        ALWAYS_INLINE void shift();
+        ALWAYS_INLINE int peek(int offset);
+        int getUnicodeCharacter();
+        void shiftLineTerminator();
+
+        ALWAYS_INLINE const UChar* currentCharacter() const;
+        ALWAYS_INLINE int currentOffset() const;
 
-        const Identifier* makeIdentifier(const UChar* characters, size_t length);
+        ALWAYS_INLINE const Identifier* makeIdentifier(const UChar* characters, size_t length);
 
-        bool lastTokenWasRestrKeyword() const;
+        ALWAYS_INLINE bool lastTokenWasRestrKeyword() const;
 
         static const size_t initialReadBufferCapacity = 32;
         
@@ -106,10 +107,7 @@ namespace JSC {
 
         // current and following unicode characters (int to allow for -1 for end-of-file marker)
         int m_current;
-        int m_next1;
-        int m_next2;
-        int m_next3;
-        
+
         IdentifierArena* m_arena;
 
         JSGlobalData* m_globalData;
diff --git a/JavaScriptCore/parser/NodeConstructors.h b/JavaScriptCore/parser/NodeConstructors.h
index 8b64e0f..4e094b6 100644
--- a/JavaScriptCore/parser/NodeConstructors.h
+++ b/JavaScriptCore/parser/NodeConstructors.h
@@ -43,11 +43,7 @@ namespace JSC {
     }
 
     inline Node::Node(JSGlobalData* globalData)
-#if ENABLE(RECURSIVE_PARSE)
         : m_line(globalData->lexer->lastLineNumber())
-#else
-        : m_line(globalData->lexer->lineNumber())
-#endif
     {
     }
 
diff --git a/JavaScriptCore/parser/Parser.cpp b/JavaScriptCore/parser/Parser.cpp
index fe92b40..b97754f 100644
--- a/JavaScriptCore/parser/Parser.cpp
+++ b/JavaScriptCore/parser/Parser.cpp
@@ -59,12 +59,8 @@ void Parser::parse(JSGlobalData* globalData, int* errLine, UString* errMsg)
 
     Lexer& lexer = *globalData->lexer;
     lexer.setCode(*m_source, m_arena);
-    
-#if ENABLE(RECURSIVE_PARSE)
+
     int parseError = jsParse(globalData);
-#else
-    int parseError = jscyyparse(globalData);
-#endif
     int lineNumber = lexer.lineNumber();
     bool lexError = lexer.sawError();
     lexer.clear();
diff --git a/JavaScriptCore/parser/SourceProvider.h b/JavaScriptCore/parser/SourceProvider.h
index 1c59eed..87ea960 100644
--- a/JavaScriptCore/parser/SourceProvider.h
+++ b/JavaScriptCore/parser/SourceProvider.h
@@ -34,13 +34,10 @@
 
 namespace JSC {
 
-    enum SourceBOMPresence { SourceHasNoBOMs, SourceCouldHaveBOMs };
-
     class SourceProvider : public RefCounted<SourceProvider> {
     public:
-        SourceProvider(const UString& url, SourceBOMPresence hasBOMs = SourceCouldHaveBOMs)
+        SourceProvider(const UString& url)
             : m_url(url)
-            , m_hasBOMs(hasBOMs)
         {
         }
         virtual ~SourceProvider() { }
@@ -52,29 +49,33 @@ namespace JSC {
         const UString& url() { return m_url; }
         intptr_t asID() { return reinterpret_cast<intptr_t>(this); }
 
-        SourceBOMPresence hasBOMs() const { return m_hasBOMs; }
-
     private:
         UString m_url;
-        SourceBOMPresence m_hasBOMs;
     };
 
     class UStringSourceProvider : public SourceProvider {
     public:
-        static PassRefPtr<UStringSourceProvider> create(const UString& source, const UString& url)
+        static PassRefPtr<UStringSourceProvider> create(const UString& source, const UString& url, bool hasBOMs = true)
         {
-            return adoptRef(new UStringSourceProvider(source, url));
+            return adoptRef(new UStringSourceProvider(source, url, hasBOMs));
         }
 
-        UString getRange(int start, int end) const { return m_source.substr(start, end - start); }
+        UString getRange(int start, int end) const
+        {
+            return m_source.substr(start, end - start);
+        }
         const UChar* data() const { return m_source.data(); }
         int length() const { return m_source.size(); }
 
     private:
-        UStringSourceProvider(const UString& source, const UString& url)
+        UStringSourceProvider(const UString& source, const UString& url, bool hasBOMs)
             : SourceProvider(url)
             , m_source(source)
         {
+            if (hasBOMs && m_source.size()) {
+                bool scratch = false;
+                m_source = UString(m_source.rep()->copyStringWithoutBOMs(false, scratch));
+            }
         }
 
         UString m_source;
diff --git a/JavaScriptCore/pcre/pcre_compile.cpp b/JavaScriptCore/pcre/pcre_compile.cpp
index 2bedca6..ea6e44c 100644
--- a/JavaScriptCore/pcre/pcre_compile.cpp
+++ b/JavaScriptCore/pcre/pcre_compile.cpp
@@ -48,6 +48,7 @@ supporting internal functions that are not used by other modules. */
 #include <string.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/FastMalloc.h>
+#include <wtf/FixedArray.h>
 
 using namespace WTF;
 
@@ -2035,8 +2036,8 @@ static int calculateCompiledPatternLength(const UChar* pattern, int patternLengt
     int branch_extra = 0;
     int lastitemlength = 0;
     unsigned brastackptr = 0;
-    int brastack[BRASTACK_SIZE];
-    unsigned char bralenstack[BRASTACK_SIZE];
+    FixedArray<int, BRASTACK_SIZE> brastack;
+    FixedArray<unsigned char, BRASTACK_SIZE> bralenstack;
     int bracount = 0;
     
     const UChar* ptr = (const UChar*)(pattern - 1);
diff --git a/JavaScriptCore/qt/ChangeLog b/JavaScriptCore/qt/ChangeLog
new file mode 100644
index 0000000..8f2d423
--- /dev/null
+++ b/JavaScriptCore/qt/ChangeLog
@@ -0,0 +1,59 @@
+2010-07-02  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Compilation fix.
+
+        QScriptEnginePrivate::newArray can't be const because it can
+        throw an exception.
+
+        [Qt] QScriptEnginePrivate compilation fix
+        https://bugs.webkit.org/show_bug.cgi?id=41520
+
+        * api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::newArray):
+        * api/qscriptengine_p.h:
+
+2010-06-28  Jedrzej Nowacki  <jedrzej.nowacki@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Implement exception reporting in the QtScript API.
+
+        The exception should be accessible through the API by the uncaughtException
+        function. Functions; hasUncaughtException, clearExceptions, uncaughtExceptionLineNumber,
+        uncaughtExceptionBacktrace were added to facilitate error checking and debugging.
+
+        [Qt] QtScript API should be exceptions aware.
+        https://bugs.webkit.org/show_bug.cgi?id=41199
+
+        * api/qscriptengine.cpp:
+        (QScriptEngine::hasUncaughtException):
+        (QScriptEngine::uncaughtException):
+        (QScriptEngine::clearExceptions):
+        (QScriptEngine::uncaughtExceptionLineNumber):
+        (QScriptEngine::uncaughtExceptionBacktrace):
+        * api/qscriptengine.h:
+        * api/qscriptengine_p.cpp:
+        (QScriptEnginePrivate::QScriptEnginePrivate):
+        (QScriptEnginePrivate::~QScriptEnginePrivate):
+        (QScriptEnginePrivate::uncaughtException):
+        * api/qscriptengine_p.h:
+        (QScriptEnginePrivate::):
+        (QScriptEnginePrivate::evaluate):
+        (QScriptEnginePrivate::hasUncaughtException):
+        (QScriptEnginePrivate::clearExceptions):
+        (QScriptEnginePrivate::setException):
+        (QScriptEnginePrivate::uncaughtExceptionLineNumber):
+        (QScriptEnginePrivate::uncaughtExceptionBacktrace):
+        * api/qscriptvalue_p.h:
+        (QScriptValuePrivate::toString):
+        (QScriptValuePrivate::toNumber):
+        (QScriptValuePrivate::toObject):
+        (QScriptValuePrivate::equals):
+        (QScriptValuePrivate::instanceOf):
+        (QScriptValuePrivate::call):
+        (QScriptValuePrivate::inherits):
+        * tests/qscriptengine/tst_qscriptengine.cpp:
+        (tst_QScriptEngine::uncaughtException):
+
diff --git a/JavaScriptCore/qt/api/qscriptengine.cpp b/JavaScriptCore/qt/api/qscriptengine.cpp
index e1bdf77..4b2319b 100644
--- a/JavaScriptCore/qt/api/qscriptengine.cpp
+++ b/JavaScriptCore/qt/api/qscriptengine.cpp
@@ -96,6 +96,71 @@ QScriptValue QScriptEngine::evaluate(const QScriptProgram& program)
 }
 
 /*!
+    Returns true if the last script evaluation resulted in an uncaught
+    exception; otherwise returns false.
+
+    The exception state is cleared when evaluate() is called.
+
+    \sa uncaughtException(), uncaughtExceptionLineNumber(),
+      uncaughtExceptionBacktrace()
+*/
+bool QScriptEngine::hasUncaughtException() const
+{
+    return d_ptr->hasUncaughtException();
+}
+
+/*!
+    Returns the current uncaught exception, or an invalid QScriptValue
+    if there is no uncaught exception.
+
+    The exception value is typically an \c{Error} object; in that case,
+    you can call toString() on the return value to obtain an error
+    message.
+
+    \sa hasUncaughtException(), uncaughtExceptionLineNumber(),
+      uncaughtExceptionBacktrace()
+*/
+QScriptValue QScriptEngine::uncaughtException() const
+{
+    return QScriptValuePrivate::get(d_ptr->uncaughtException());
+}
+
+/*!
+    Clears any uncaught exceptions in this engine.
+
+    \sa hasUncaughtException()
+*/
+void QScriptEngine::clearExceptions()
+{
+    d_ptr->clearExceptions();
+}
+
+/*!
+    Returns the line number where the last uncaught exception occurred.
+
+    Line numbers are 1-based, unless a different base was specified as
+    the second argument to evaluate().
+
+    \sa hasUncaughtException(), uncaughtExceptionBacktrace()
+*/
+int QScriptEngine::uncaughtExceptionLineNumber() const
+{
+    return d_ptr->uncaughtExceptionLineNumber();
+}
+
+/*!
+    Returns a human-readable backtrace of the last uncaught exception.
+
+    Each line is of the form \c{<function-name>(<arguments>)@<file-name>:<line-number>}.
+
+    \sa uncaughtException()
+*/
+QStringList QScriptEngine::uncaughtExceptionBacktrace() const
+{
+    return d_ptr->uncaughtExceptionBacktrace();
+}
+
+/*!
     Runs the garbage collector.
 
     The garbage collector will attempt to reclaim memory by locating and disposing of objects that are
@@ -206,6 +271,16 @@ QScriptValue QScriptEngine::newObject()
 }
 
 /*!
+  Creates a QtScript object of class Array with the given \a length.
+
+  \sa newObject()
+*/
+QScriptValue QScriptEngine::newArray(uint length)
+{
+    return QScriptValuePrivate::get(d_ptr->newArray(length));
+}
+
+/*!
   Returns this engine's Global Object.
 
   By default, the Global Object contains the built-in objects that are
diff --git a/JavaScriptCore/qt/api/qscriptengine.h b/JavaScriptCore/qt/api/qscriptengine.h
index 653dffe..1a87a37 100644
--- a/JavaScriptCore/qt/api/qscriptengine.h
+++ b/JavaScriptCore/qt/api/qscriptengine.h
@@ -42,6 +42,12 @@ public:
     QScriptValue evaluate(const QString& program, const QString& fileName = QString(), int lineNumber = 1);
     QScriptValue evaluate(const QScriptProgram& program);
 
+    bool hasUncaughtException() const;
+    QScriptValue uncaughtException() const;
+    void clearExceptions();
+    int uncaughtExceptionLineNumber() const;
+    QStringList uncaughtExceptionBacktrace() const;
+
     void collectGarbage();
     void reportAdditionalMemoryCost(int cost);
 
@@ -51,6 +57,7 @@ public:
     QScriptValue nullValue();
     QScriptValue undefinedValue();
     QScriptValue newObject();
+    QScriptValue newArray(uint length = 0);
     QScriptValue globalObject() const;
 private:
     friend class QScriptEnginePrivate;
diff --git a/JavaScriptCore/qt/api/qscriptengine_p.cpp b/JavaScriptCore/qt/api/qscriptengine_p.cpp
index fd7978b..23e41c4 100644
--- a/JavaScriptCore/qt/api/qscriptengine_p.cpp
+++ b/JavaScriptCore/qt/api/qscriptengine_p.cpp
@@ -31,11 +31,14 @@
 QScriptEnginePrivate::QScriptEnginePrivate(const QScriptEngine* engine)
     : q_ptr(const_cast<QScriptEngine*>(engine))
     , m_context(JSGlobalContextCreate(0))
+    , m_exception(0)
 {
 }
 
 QScriptEnginePrivate::~QScriptEnginePrivate()
 {
+    if (m_exception)
+        JSValueUnprotect(m_context, m_exception);
     JSGlobalContextRelease(m_context);
 }
 
@@ -77,11 +80,35 @@ QScriptValuePrivate* QScriptEnginePrivate::evaluate(const QScriptProgramPrivate*
     return new QScriptValuePrivate(this, evaluate(*program, program->file(), program->line()));
 }
 
+QScriptValuePrivate* QScriptEnginePrivate::uncaughtException() const
+{
+    return m_exception ? new QScriptValuePrivate(this, m_exception) : new QScriptValuePrivate();
+}
+
 QScriptValuePrivate* QScriptEnginePrivate::newObject() const
 {
     return new QScriptValuePrivate(this, JSObjectMake(m_context, /* jsClass */ 0, /* userData */ 0));
 }
 
+QScriptValuePrivate* QScriptEnginePrivate::newArray(uint length)
+{
+    JSValueRef exception = 0;
+    JSObjectRef array = JSObjectMakeArray(m_context, /* argumentCount */ 0, /* arguments */ 0, &exception);
+
+    if (!exception) {
+        if (length > 0) {
+            JSRetainPtr<JSStringRef> lengthRef(Adopt, JSStringCreateWithUTF8CString("length"));
+            // array is an Array instance, so an exception should not occure here.
+            JSObjectSetProperty(m_context, array, lengthRef.get(), JSValueMakeNumber(m_context, length), kJSPropertyAttributeNone, /* exception */ 0);
+        }
+    } else {
+        setException(exception, NotNullException);
+        return new QScriptValuePrivate();
+    }
+
+    return new QScriptValuePrivate(this, array);
+}
+
 QScriptValuePrivate* QScriptEnginePrivate::globalObject() const
 {
     JSObjectRef globalObject = JSContextGetGlobalObject(m_context);
diff --git a/JavaScriptCore/qt/api/qscriptengine_p.h b/JavaScriptCore/qt/api/qscriptengine_p.h
index 9083f7d..30ee039 100644
--- a/JavaScriptCore/qt/api/qscriptengine_p.h
+++ b/JavaScriptCore/qt/api/qscriptengine_p.h
@@ -26,9 +26,11 @@
 #include "qscriptsyntaxcheckresult_p.h"
 #include "qscriptvalue.h"
 #include <JavaScriptCore/JavaScript.h>
+#include <JavaScriptCore/JSRetainPtr.h>
 #include <JSBasePrivate.h>
 #include <QtCore/qshareddata.h>
 #include <QtCore/qstring.h>
+#include <QtCore/qstringlist.h>
 
 class QScriptEngine;
 class QScriptSyntaxCheckResultPrivate;
@@ -41,11 +43,23 @@ public:
     QScriptEnginePrivate(const QScriptEngine*);
     ~QScriptEnginePrivate();
 
+    enum SetExceptionFlag {
+        IgnoreNullException = 0x01,
+        NotNullException = 0x02,
+    };
+
     QScriptSyntaxCheckResultPrivate* checkSyntax(const QString& program);
     QScriptValuePrivate* evaluate(const QString& program, const QString& fileName, int lineNumber);
     QScriptValuePrivate* evaluate(const QScriptProgramPrivate* program);
     inline JSValueRef evaluate(JSStringRef program, JSStringRef fileName, int lineNumber);
 
+    inline bool hasUncaughtException() const;
+    QScriptValuePrivate* uncaughtException() const;
+    inline void clearExceptions();
+    inline void setException(JSValueRef exception, const /* SetExceptionFlags */ unsigned flags = IgnoreNullException);
+    inline int uncaughtExceptionLineNumber() const;
+    inline QStringList uncaughtExceptionBacktrace() const;
+
     inline void collectGarbage();
     inline void reportAdditionalMemoryCost(int cost);
 
@@ -57,6 +71,7 @@ public:
     inline JSValueRef makeJSValue(QScriptValue::SpecialValue value) const;
 
     QScriptValuePrivate* newObject() const;
+    QScriptValuePrivate* newArray(uint length);
     QScriptValuePrivate* globalObject() const;
 
     inline QScriptStringPrivate* toStringHandle(const QString& str) const;
@@ -65,6 +80,7 @@ public:
 private:
     QScriptEngine* q_ptr;
     JSGlobalContextRef m_context;
+    JSValueRef m_exception;
 };
 
 
@@ -77,11 +93,67 @@ JSValueRef QScriptEnginePrivate::evaluate(JSStringRef program, JSStringRef fileN
 {
     JSValueRef exception;
     JSValueRef result = JSEvaluateScript(m_context, program, /* Global Object */ 0, fileName, lineNumber, &exception);
-    if (!result)
+    if (!result) {
+        setException(exception, NotNullException);
         return exception; // returns an exception
+    }
+    clearExceptions();
     return result;
 }
 
+bool QScriptEnginePrivate::hasUncaughtException() const
+{
+    return m_exception;
+}
+
+void QScriptEnginePrivate::clearExceptions()
+{
+    if (m_exception)
+        JSValueUnprotect(m_context, m_exception);
+    m_exception = 0;
+}
+
+void QScriptEnginePrivate::setException(JSValueRef exception, const /* SetExceptionFlags */ unsigned flags)
+{
+    if (!((flags & NotNullException) || exception))
+        return;
+    Q_ASSERT(exception);
+
+    if (m_exception)
+        JSValueUnprotect(m_context, m_exception);
+    JSValueProtect(m_context, exception);
+    m_exception = exception;
+}
+
+int QScriptEnginePrivate::uncaughtExceptionLineNumber() const
+{
+    if (!hasUncaughtException() || !JSValueIsObject(m_context, m_exception))
+        return -1;
+
+    JSValueRef exception = 0;
+    JSRetainPtr<JSStringRef> lineNumberPropertyName(Adopt, QScriptConverter::toString("line"));
+    JSValueRef lineNumber = JSObjectGetProperty(m_context, const_cast<JSObjectRef>(m_exception), lineNumberPropertyName.get(), &exception);
+    int result = JSValueToNumber(m_context, lineNumber, &exception);
+    return exception ? -1 : result;
+}
+
+QStringList QScriptEnginePrivate::uncaughtExceptionBacktrace() const
+{
+    if (!hasUncaughtException() || !JSValueIsObject(m_context, m_exception))
+        return QStringList();
+
+    JSValueRef exception = 0;
+    JSRetainPtr<JSStringRef> fileNamePropertyName(Adopt, QScriptConverter::toString("sourceURL"));
+    JSRetainPtr<JSStringRef> lineNumberPropertyName(Adopt, QScriptConverter::toString("line"));
+    JSValueRef jsFileName = JSObjectGetProperty(m_context, const_cast<JSObjectRef>(m_exception), fileNamePropertyName.get(), &exception);
+    JSValueRef jsLineNumber = JSObjectGetProperty(m_context, const_cast<JSObjectRef>(m_exception), lineNumberPropertyName.get(), &exception);
+    JSRetainPtr<JSStringRef> fileName(Adopt, JSValueToStringCopy(m_context, jsFileName, &exception));
+    int lineNumber = JSValueToNumber(m_context, jsLineNumber, &exception);
+    return QStringList(QString::fromLatin1("<anonymous>()@%0:%1")
+            .arg(QScriptConverter::toString(fileName.get()))
+            .arg(QScriptConverter::toString(exception ? -1 : lineNumber)));
+}
+
 void QScriptEnginePrivate::collectGarbage()
 {
     JSGarbageCollect(m_context);
diff --git a/JavaScriptCore/qt/api/qscriptvalue.cpp b/JavaScriptCore/qt/api/qscriptvalue.cpp
index 8ad76a5..e309fb7 100644
--- a/JavaScriptCore/qt/api/qscriptvalue.cpp
+++ b/JavaScriptCore/qt/api/qscriptvalue.cpp
@@ -627,3 +627,41 @@ bool QScriptValue::instanceOf(const QScriptValue& other) const
 {
     return d_ptr->instanceOf(QScriptValuePrivate::get(other));
 }
+
+/*!
+  Returns the value of this QScriptValue's property with the given \a name,
+  using the given \a mode to resolve the property.
+
+  If no such property exists, an invalid QScriptValue is returned.
+
+  If the property is implemented using a getter function (i.e. has the
+  PropertyGetter flag set), calling property() has side-effects on the
+  script engine, since the getter function will be called (possibly
+  resulting in an uncaught script exception). If an exception
+  occurred, property() returns the value that was thrown (typically
+  an \c{Error} object).
+
+  \sa setProperty(), propertyFlags(), QScriptValueIterator
+*/
+QScriptValue QScriptValue::property(const QString& name, const ResolveFlags& mode) const
+{
+    return QScriptValuePrivate::get(d_ptr->property(name, mode));
+}
+
+/*!
+  \overload
+
+  Returns the property at the given \a arrayIndex, using the given \a
+  mode to resolve the property.
+
+  This function is provided for convenience and performance when
+  working with array objects.
+
+  If this QScriptValue is not an Array object, this function behaves
+  as if property() was called with the string representation of \a
+  arrayIndex.
+*/
+QScriptValue QScriptValue::property(quint32 arrayIndex, const ResolveFlags& mode) const
+{
+    return QScriptValuePrivate::get(d_ptr->property(arrayIndex, mode));
+}
diff --git a/JavaScriptCore/qt/api/qscriptvalue.h b/JavaScriptCore/qt/api/qscriptvalue.h
index c82ef55..c55d461 100644
--- a/JavaScriptCore/qt/api/qscriptvalue.h
+++ b/JavaScriptCore/qt/api/qscriptvalue.h
@@ -32,7 +32,14 @@ typedef QList<QScriptValue> QScriptValueList;
 typedef double qsreal;
 
 class QScriptValue {
-public:    
+public:
+    enum ResolveFlag {
+        ResolveLocal     = 0x00,
+        ResolvePrototype = 0x01
+    };
+
+    Q_DECLARE_FLAGS(ResolveFlags, ResolveFlag)
+
     enum SpecialValue {
         NullValue,
         UndefinedValue
@@ -67,6 +74,9 @@ public:
     bool strictlyEquals(const QScriptValue& other) const;
     bool instanceOf(const QScriptValue& other) const;
 
+    QScriptValue property(const QString& name, const ResolveFlags& mode = ResolvePrototype) const;
+    QScriptValue property(quint32 arrayIndex, const ResolveFlags& mode = ResolvePrototype) const;
+
     QScriptEngine* engine() const;
 
     bool isValid() const;
diff --git a/JavaScriptCore/qt/api/qscriptvalue_p.h b/JavaScriptCore/qt/api/qscriptvalue_p.h
index f8a1e7a..49bec97 100644
--- a/JavaScriptCore/qt/api/qscriptvalue_p.h
+++ b/JavaScriptCore/qt/api/qscriptvalue_p.h
@@ -120,6 +120,9 @@ public:
     inline bool instanceOf(QScriptValuePrivate* other);
     inline bool assignEngine(QScriptEnginePrivate* engine);
 
+    inline QScriptValuePrivate* property(const QString& name, const QScriptValue::ResolveFlags& mode);
+    inline QScriptValuePrivate* property(quint32 arrayIndex, const QScriptValue::ResolveFlags& mode);
+
     inline QScriptValuePrivate* call(const QScriptValuePrivate* , const QScriptValueList& args);
 
     inline operator JSValueRef() const;
@@ -442,7 +445,9 @@ QString QScriptValuePrivate::toString() const
     case JSValue:
     case JSPrimitive:
     case JSObject:
-        JSRetainPtr<JSStringRef> ptr(Adopt, JSValueToStringCopy(*m_engine, *this, /* exception */ 0));
+        JSValueRef exception = 0;
+        JSRetainPtr<JSStringRef> ptr(Adopt, JSValueToStringCopy(*m_engine, *this, &exception));
+        m_engine->setException(exception);
         return QScriptConverter::toString(ptr.get());
     }
 
@@ -456,7 +461,12 @@ qsreal QScriptValuePrivate::toNumber() const
     case JSValue:
     case JSPrimitive:
     case JSObject:
-        return JSValueToNumber(*m_engine, *this, /* exception */ 0);
+        {
+            JSValueRef exception = 0;
+            qsreal result = JSValueToNumber(*m_engine, *this, &exception);
+            m_engine->setException(exception);
+            return result;
+        }
     case CNumber:
         return u.m_number;
     case CBool:
@@ -585,9 +595,13 @@ QScriptValuePrivate* QScriptValuePrivate::toObject(QScriptEnginePrivate* engine)
         {
             if (engine != this->engine())
                 qWarning("QScriptEngine::toObject: cannot convert value created in a different engine");
-            JSObjectRef object = JSValueToObject(*m_engine, *this, /* exception */ 0);
+            JSValueRef exception = 0;
+            JSObjectRef object = JSValueToObject(*m_engine, *this, &exception);
             if (object)
                 return new QScriptValuePrivate(m_engine.constData(), object);
+            else
+                m_engine->setException(exception, QScriptEnginePrivate::NotNullException);
+
         }
         return new QScriptValuePrivate;
     case JSObject:
@@ -621,7 +635,7 @@ inline QScriptValuePrivate* QScriptValuePrivate::prototype()
             return new QScriptValuePrivate(engine(), prototype);
         // The prototype could be either a null or a JSObject, so it is safe to cast the prototype
         // to the JSObjectRef here.
-        return new QScriptValuePrivate(engine(), prototype, const_cast<JSObjectRef>(prototype));
+        return new QScriptValuePrivate(engine(), const_cast<JSObjectRef>(prototype));
     }
     return new QScriptValuePrivate;
 }
@@ -672,7 +686,10 @@ bool QScriptValuePrivate::equals(QScriptValuePrivate* other)
         }
     }
 
-    return JSValueIsEqual(*m_engine, *this, *other, /* exception */ 0);
+    JSValueRef exception = 0;
+    bool result = JSValueIsEqual(*m_engine, *this, *other, &exception);
+    m_engine->setException(exception);
+    return result;
 }
 
 bool QScriptValuePrivate::strictlyEquals(QScriptValuePrivate* other)
@@ -716,7 +733,10 @@ inline bool QScriptValuePrivate::instanceOf(QScriptValuePrivate* other)
 {
     if (!isJSBased() || !other->isObject())
         return false;
-    return JSValueIsInstanceOfConstructor(*m_engine, *this, *other, /* exception */ 0);
+    JSValueRef exception = 0;
+    bool result = JSValueIsInstanceOfConstructor(*m_engine, *this, *other, &exception);
+    m_engine->setException(exception);
+    return result;
 }
 
 /*!
@@ -756,6 +776,35 @@ bool QScriptValuePrivate::assignEngine(QScriptEnginePrivate* engine)
     return true;
 }
 
+inline QScriptValuePrivate* QScriptValuePrivate::property(const QString& name, const QScriptValue::ResolveFlags& mode)
+{
+    if (!isObject())
+        return new QScriptValuePrivate;
+
+    if (mode & QScriptValue::ResolveLocal) {
+        qWarning("QScriptValue::property(): ResolveLocal not supported yet.");
+        return new QScriptValuePrivate;
+    }
+
+    JSRetainPtr<JSStringRef> nameRef(Adopt, QScriptConverter::toString(name));
+    QScriptValuePrivate* result = new QScriptValuePrivate(m_engine.constData(), JSObjectGetProperty(*m_engine, *this, nameRef.get(), /* exception */ 0));
+
+    return result;
+}
+
+inline QScriptValuePrivate* QScriptValuePrivate::property(quint32 arrayIndex, const QScriptValue::ResolveFlags& mode)
+{
+    if (!isObject())
+        return new QScriptValuePrivate;
+
+    if (mode & QScriptValue::ResolveLocal) {
+        qWarning("QScriptValue::property(): ResolveLocal not supported yet.");
+        return new QScriptValuePrivate;
+    }
+
+    return new QScriptValuePrivate(m_engine.constData(), JSObjectGetPropertyAtIndex(*m_engine, *this, arrayIndex, /* exception */ 0));
+}
+
 QScriptValuePrivate* QScriptValuePrivate::call(const QScriptValuePrivate*, const QScriptValueList& args)
 {
     switch (m_state) {
@@ -781,8 +830,10 @@ QScriptValuePrivate* QScriptValuePrivate::call(const QScriptValuePrivate*, const
             // Make the call
             JSValueRef exception = 0;
             JSValueRef result = JSObjectCallAsFunction(*m_engine, *this, /* thisObject */ 0, argc, argv.constData(), &exception);
-            if (!result && exception)
+            if (!result && exception) {
+                m_engine->setException(exception);
                 return new QScriptValuePrivate(engine(), exception);
+            }
             if (result && !exception)
                 return new QScriptValuePrivate(engine(), result);
         }
@@ -823,9 +874,12 @@ bool QScriptValuePrivate::inherits(const char* name)
     Q_ASSERT(isJSBased());
     JSObjectRef globalObject = JSContextGetGlobalObject(*m_engine);
     JSStringRef errorAttrName = QScriptConverter::toString(name);
-    JSValueRef error = JSObjectGetProperty(*m_engine, globalObject, errorAttrName, /* exception */ 0);
+    JSValueRef exception = 0;
+    JSValueRef error = JSObjectGetProperty(*m_engine, globalObject, errorAttrName, &exception);
     JSStringRelease(errorAttrName);
-    return JSValueIsInstanceOfConstructor(*m_engine, *this, JSValueToObject(*m_engine, error, /* exception */ 0), /* exception */ 0);
+    bool result = JSValueIsInstanceOfConstructor(*m_engine, *this, JSValueToObject(*m_engine, error, &exception), &exception);
+    m_engine->setException(exception);
+    return result;
 }
 
 /*!
diff --git a/JavaScriptCore/qt/benchmarks/benchmarks.pri b/JavaScriptCore/qt/benchmarks/benchmarks.pri
new file mode 100644
index 0000000..5af3383
--- /dev/null
+++ b/JavaScriptCore/qt/benchmarks/benchmarks.pri
@@ -0,0 +1,19 @@
+QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+QMAKE_LIBDIR = $$OUTPUT_DIR/lib $$QMAKE_LIBDIR
+mac:!static:contains(QT_CONFIG, qt_framework):!CONFIG(webkit_no_framework) {
+    LIBS += -framework QtScript
+    QMAKE_FRAMEWORKPATH = $$OUTPUT_DIR/lib $$QMAKE_FRAMEWORKPATH
+} else {
+    win32-*|wince* {
+        LIBS += -lQtScript$${QT_MAJOR_VERSION}
+    } else {
+        LIBS += -lQtScript
+    }
+}
+
+CONFIG(release, debug|release) {
+    DEFINES += NDEBUG
+}
+
+INCLUDEPATH += $$PWD/../api
+
diff --git a/JavaScriptCore/qt/benchmarks/benchmarks.pro b/JavaScriptCore/qt/benchmarks/benchmarks.pro
new file mode 100644
index 0000000..85fa82c
--- /dev/null
+++ b/JavaScriptCore/qt/benchmarks/benchmarks.pro
@@ -0,0 +1,4 @@
+TEMPLATE = subdirs
+SUBDIRS =   qscriptengine \
+            qscriptvalue \
+
diff --git a/JavaScriptCore/qt/benchmarks/qscriptengine/qscriptengine.pro b/JavaScriptCore/qt/benchmarks/qscriptengine/qscriptengine.pro
new file mode 100644
index 0000000..e94137d
--- /dev/null
+++ b/JavaScriptCore/qt/benchmarks/qscriptengine/qscriptengine.pro
@@ -0,0 +1,13 @@
+TEMPLATE = app
+TARGET = tst_bench_qscriptengine
+
+SOURCES += tst_qscriptengine.cpp
+
+QT += testlib
+
+include(../benchmarks.pri)
+
+symbian* {
+    TARGET.EPOCHEAPSIZE  = 0x20000 0x2000000 // Min 128kB, Max 32MB
+    TARGET.EPOCSTACKSIZE = 0x14000
+}
diff --git a/JavaScriptCore/qt/benchmarks/qscriptengine/tst_qscriptengine.cpp b/JavaScriptCore/qt/benchmarks/qscriptengine/tst_qscriptengine.cpp
new file mode 100644
index 0000000..0c447c6
--- /dev/null
+++ b/JavaScriptCore/qt/benchmarks/qscriptengine/tst_qscriptengine.cpp
@@ -0,0 +1,142 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "qscriptengine.h"
+#include "qscriptvalue.h"
+#include <qtest.h>
+
+class tst_QScriptEngine : public QObject {
+    Q_OBJECT
+
+private slots:
+    void checkSyntax_data();
+    void checkSyntax();
+    void constructor();
+    void evaluateString_data();
+    void evaluateString();
+    void evaluateProgram_data();
+    void evaluateProgram();
+    void newObject();
+    void nullValue();
+    void undefinedValue();
+    void globalObject();
+    void toStringHandle();
+};
+
+void tst_QScriptEngine::checkSyntax_data()
+{
+    evaluateString_data();
+}
+
+void tst_QScriptEngine::checkSyntax()
+{
+    QFETCH(QString, code);
+    QScriptEngine engine;
+    QBENCHMARK {
+        engine.checkSyntax(code);
+    }
+}
+
+void tst_QScriptEngine::constructor()
+{
+    QBENCHMARK {
+        QScriptEngine engine;
+    }
+}
+
+void tst_QScriptEngine::evaluateString_data()
+{
+    QTest::addColumn<QString>("code");
+    QTest::newRow("empty script") << QString::fromLatin1("");
+    QTest::newRow("number literal") << QString::fromLatin1("123");
+    QTest::newRow("string literal") << QString::fromLatin1("'ciao'");
+    QTest::newRow("regexp literal") << QString::fromLatin1("/foo/gim");
+    QTest::newRow("null literal") << QString::fromLatin1("null");
+    QTest::newRow("undefined literal") << QString::fromLatin1("undefined");
+    QTest::newRow("empty object literal") << QString::fromLatin1("{}");
+    QTest::newRow("this") << QString::fromLatin1("this");
+}
+
+void tst_QScriptEngine::evaluateString()
+{
+    QFETCH(QString, code);
+    QScriptEngine engine;
+    QBENCHMARK {
+        engine.evaluate(code);
+    }
+}
+
+void tst_QScriptEngine::evaluateProgram_data()
+{
+    evaluateString_data();
+}
+
+void tst_QScriptEngine::evaluateProgram()
+{
+    QFETCH(QString, code);
+    QScriptEngine engine;
+    QScriptProgram program(code);
+    QBENCHMARK {
+        engine.evaluate(program);
+    }
+}
+
+void tst_QScriptEngine::newObject()
+{
+    QScriptEngine engine;
+    QBENCHMARK {
+        engine.newObject();
+    }
+}
+
+void tst_QScriptEngine::nullValue()
+{
+    QScriptEngine engine;
+    QBENCHMARK {
+        engine.nullValue();
+    }
+}
+
+void tst_QScriptEngine::undefinedValue()
+{
+    QScriptEngine engine;
+    QBENCHMARK {
+        engine.undefinedValue();
+    }
+}
+
+void tst_QScriptEngine::globalObject()
+{
+    QScriptEngine engine;
+    QBENCHMARK {
+        engine.globalObject();
+    }
+}
+
+void tst_QScriptEngine::toStringHandle()
+{
+    QScriptEngine engine;
+    QString str = QString::fromLatin1("foobarbaz");
+    QBENCHMARK {
+        engine.toStringHandle(str);
+    }
+}
+
+QTEST_MAIN(tst_QScriptEngine)
+#include "tst_qscriptengine.moc"
diff --git a/JavaScriptCore/qt/benchmarks/qscriptvalue/qscriptvalue.pro b/JavaScriptCore/qt/benchmarks/qscriptvalue/qscriptvalue.pro
new file mode 100644
index 0000000..673fe65
--- /dev/null
+++ b/JavaScriptCore/qt/benchmarks/qscriptvalue/qscriptvalue.pro
@@ -0,0 +1,9 @@
+TEMPLATE = app
+TARGET = tst_bench_qscriptvalue
+QT += testlib
+
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+include(../benchmarks.pri)
+
+SOURCES += tst_qscriptvalue.cpp
+
diff --git a/JavaScriptCore/qt/benchmarks/qscriptvalue/tst_qscriptvalue.cpp b/JavaScriptCore/qt/benchmarks/qscriptvalue/tst_qscriptvalue.cpp
new file mode 100644
index 0000000..7c39b8e
--- /dev/null
+++ b/JavaScriptCore/qt/benchmarks/qscriptvalue/tst_qscriptvalue.cpp
@@ -0,0 +1,442 @@
+/*
+    Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "qscriptengine.h"
+#include "qscriptstring.h"
+#include "qscriptvalue.h"
+#include <qtest.h>
+
+Q_DECLARE_METATYPE(QScriptValue);
+
+class tst_QScriptValue : public QObject {
+    Q_OBJECT
+
+public:
+    tst_QScriptValue()
+        : m_engine(0)
+    {}
+
+    ~tst_QScriptValue()
+    {
+        if (m_engine)
+            delete m_engine;
+    }
+
+private slots:
+    void values_data();
+
+    void ctorBool();
+    void ctorReal();
+    void ctorNumber();
+    void ctorQString();
+    void ctorCString();
+    void ctorSpecial();
+    void ctorQScriptValue();
+
+    void isValid_data();
+    void isValid();
+    void isBool_data();
+    void isBool();
+    void isNumber_data();
+    void isNumber();
+    void isFunction_data();
+    void isFunction();
+    void isNull_data();
+    void isNull();
+    void isString_data();
+    void isString();
+    void isUndefined_data();
+    void isUndefined();
+    void isObject_data();
+    void isObject();
+    void isError_data();
+    void isError();
+
+    void toString_data();
+    void toString();
+    void toNumber_data();
+    void toNumber();
+    void toBool_data();
+    void toBool();
+    void toInteger_data();
+    void toInteger();
+    void toInt32_data();
+    void toInt32();
+    void toUInt32_data();
+    void toUInt32();
+    void toUInt16_data();
+    void toUInt16();
+    void toObject_data();
+    void toObject();
+
+    void equals_data();
+    void equals();
+    void strictlyEquals_data();
+    void strictlyEquals();
+    void instanceOf_data();
+    void instanceOf();
+
+private:
+    QScriptEngine* m_engine;
+};
+
+void tst_QScriptValue::values_data()
+{
+    if (m_engine)
+        delete m_engine;
+    m_engine = new QScriptEngine;
+
+    QTest::addColumn<QScriptValue>("value");
+
+    QTest::newRow("invalid") << QScriptValue();
+
+    QTest::newRow("cbool") << QScriptValue(true);
+    QTest::newRow("cnumber") << QScriptValue(1234);
+    QTest::newRow("cstring") << QScriptValue("abc");
+    QTest::newRow("cnull") << QScriptValue(QScriptValue::NullValue);
+    QTest::newRow("cundefined") << QScriptValue(QScriptValue::UndefinedValue);
+
+    QTest::newRow("jsbool") << m_engine->evaluate("true");
+    QTest::newRow("jsnumber") << m_engine->evaluate("12345");
+    QTest::newRow("jsstring") << m_engine->evaluate("'go'");
+    QTest::newRow("jsfunction") << m_engine->evaluate("(function {})");
+    QTest::newRow("jsnull") << m_engine->nullValue();
+    QTest::newRow("jsundefined") << m_engine->undefinedValue();
+    QTest::newRow("jsobject") << m_engine->newObject();
+    QTest::newRow("jserror") << m_engine->evaluate("new Error()");
+}
+
+void tst_QScriptValue::ctorBool()
+{
+    QBENCHMARK {
+        QScriptValue(true);
+    }
+}
+
+void tst_QScriptValue::ctorReal()
+{
+    QBENCHMARK {
+        QScriptValue(12.3);
+    }
+}
+
+void tst_QScriptValue::ctorNumber()
+{
+    QBENCHMARK {
+        QScriptValue(123);
+    }
+}
+
+void tst_QScriptValue::ctorQString()
+{
+    QString str = QString::fromLatin1("ciao");
+    QBENCHMARK {
+        QScriptValue(str);
+    }
+}
+
+void tst_QScriptValue::ctorCString()
+{
+    QBENCHMARK {
+        QScriptValue("Pong!");
+    }
+}
+
+void tst_QScriptValue::ctorSpecial()
+{
+    QBENCHMARK {
+        (void)QScriptValue(QScriptValue::NullValue);
+    }
+}
+
+void tst_QScriptValue::ctorQScriptValue()
+{
+    QScriptValue tmp(1234);
+    QBENCHMARK {
+        QScriptValue(tmp);
+    }
+}
+
+void tst_QScriptValue::isValid_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::isValid()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.isValid();
+    }
+}
+
+void tst_QScriptValue::isBool_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::isBool()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.isBool();
+    }
+}
+
+void tst_QScriptValue::isNumber_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::isNumber()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.isNumber();
+    }
+}
+
+void tst_QScriptValue::isFunction_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::isFunction()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.isFunction();
+    }
+}
+
+void tst_QScriptValue::isNull_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::isNull()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.isNull();
+    }
+}
+
+void tst_QScriptValue::isString_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::isString()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.isString();
+    }
+}
+
+void tst_QScriptValue::isUndefined_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::isUndefined()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.isUndefined();
+    }
+}
+
+void tst_QScriptValue::isObject_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::isObject()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.isObject();
+    }
+}
+
+void tst_QScriptValue::isError_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::isError()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.isError();
+    }
+}
+
+void tst_QScriptValue::toString_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::toString()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.toString();
+    }
+}
+
+void tst_QScriptValue::toNumber_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::toNumber()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.toNumber();
+    }
+}
+
+void tst_QScriptValue::toBool_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::toBool()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.toBool();
+    }
+}
+
+void tst_QScriptValue::toInteger_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::toInteger()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.toInteger();
+    }
+}
+
+void tst_QScriptValue::toInt32_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::toInt32()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.toInt32();
+    }
+}
+
+void tst_QScriptValue::toUInt32_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::toUInt32()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.toUInt32();
+    }
+}
+
+void tst_QScriptValue::toUInt16_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::toUInt16()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.toUInt16();
+    }
+}
+
+void tst_QScriptValue::toObject_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::toObject()
+{
+    QFETCH(QScriptValue, value);
+    QBENCHMARK {
+        value.toObject();
+    }
+}
+
+void tst_QScriptValue::equals_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::equals()
+{
+    QFETCH(QScriptValue, value);
+    static QScriptValue previous;
+    QBENCHMARK {
+        value.equals(previous);
+    }
+    previous = value;
+}
+
+void tst_QScriptValue::strictlyEquals_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::strictlyEquals()
+{
+    QFETCH(QScriptValue, value);
+    static QScriptValue previous;
+    QBENCHMARK {
+        value.strictlyEquals(previous);
+    }
+    previous = value;
+}
+
+void tst_QScriptValue::instanceOf_data()
+{
+    values_data();
+}
+
+void tst_QScriptValue::instanceOf()
+{
+    QFETCH(QScriptValue, value);
+    static QScriptValue object = m_engine->newObject();
+    QBENCHMARK {
+        value.instanceOf(object);
+    }
+}
+
+QTEST_MAIN(tst_QScriptValue)
+#include "tst_qscriptvalue.moc"
diff --git a/JavaScriptCore/qt/tests/qscriptengine/tst_qscriptengine.cpp b/JavaScriptCore/qt/tests/qscriptengine/tst_qscriptengine.cpp
index d545f37..753fcd0 100644
--- a/JavaScriptCore/qt/tests/qscriptengine/tst_qscriptengine.cpp
+++ b/JavaScriptCore/qt/tests/qscriptengine/tst_qscriptengine.cpp
@@ -47,6 +47,8 @@ private slots:
     void checkSyntax();
     void toObject();
     void toObjectTwoEngines();
+    void newArray();
+    void uncaughtException();
 };
 
 /* Evaluating a script that throw an unhandled exception should return an invalid value. */
@@ -409,5 +411,107 @@ void tst_QScriptEngine::toObjectTwoEngines()
     }
 }
 
+void tst_QScriptEngine::newArray()
+{
+    QScriptEngine eng;
+    QScriptValue array = eng.newArray();
+    QCOMPARE(array.isValid(), true);
+    // QCOMPARE(array.isArray(), true);
+    QCOMPARE(array.isObject(), true);
+    QVERIFY(!array.isFunction());
+    // QCOMPARE(array.scriptClass(), (QScriptClass*)0);
+
+    // Prototype should be Array.prototype.
+    QCOMPARE(array.prototype().isValid(), true);
+    // QCOMPARE(array.prototype().isArray(), true);
+    QCOMPARE(array.prototype().strictlyEquals(eng.evaluate("Array.prototype")), true);
+
+    QScriptValue arrayWithSize = eng.newArray(42);
+    QCOMPARE(arrayWithSize.isValid(), true);
+    // QCOMPARE(arrayWithSize.isArray(), true);
+    QCOMPARE(arrayWithSize.isObject(), true);
+    QCOMPARE(arrayWithSize.property("length").toInt32(), 42);
+}
+
+void tst_QScriptEngine::uncaughtException()
+{
+    QScriptEngine eng;
+    QScriptValue fun = eng.evaluate("(function foo () { return null; });");
+    QVERIFY(!eng.uncaughtException().isValid());
+    QVERIFY(fun.isFunction());
+    QScriptValue throwFun = eng.evaluate("( function() { throw new Error('Pong'); });");
+    QVERIFY(throwFun.isFunction());
+    {
+        eng.evaluate("a = 10");
+        QVERIFY(!eng.hasUncaughtException());
+        QVERIFY(!eng.uncaughtException().isValid());
+    }
+    {
+        eng.evaluate("1 = 2");
+        QVERIFY(eng.hasUncaughtException());
+        eng.clearExceptions();
+        QVERIFY(!eng.hasUncaughtException());
+    }
+    {
+        // Check if the call or toString functions can remove the last exception.
+        QVERIFY(throwFun.call().isError());
+        QVERIFY(eng.hasUncaughtException());
+        QScriptValue exception = eng.uncaughtException();
+        fun.call();
+        exception.toString();
+        QVERIFY(eng.hasUncaughtException());
+        QVERIFY(eng.uncaughtException().strictlyEquals(exception));
+    }
+    eng.clearExceptions();
+    {
+        // Check if in the call function a new exception can override an existing one.
+        throwFun.call();
+        QVERIFY(eng.hasUncaughtException());
+        QScriptValue exception = eng.uncaughtException();
+        throwFun.call();
+        QVERIFY(eng.hasUncaughtException());
+        QVERIFY(!exception.strictlyEquals(eng.uncaughtException()));
+    }
+    {
+        eng.evaluate("throwFun = (function foo () { throw new Error('bla') });");
+        eng.evaluate("1;\nthrowFun();");
+        QVERIFY(eng.hasUncaughtException());
+        QCOMPARE(eng.uncaughtExceptionLineNumber(), 1);
+        eng.clearExceptions();
+        QVERIFY(!eng.hasUncaughtException());
+    }
+    for (int x = 1; x < 4; ++x) {
+        QScriptValue ret = eng.evaluate("a = 10;\nb = 20;\n0 = 0;\n",
+                                        QString::fromLatin1("FooScript") + QString::number(x),
+                                        /* lineNumber */ x);
+        QVERIFY(eng.hasUncaughtException());
+        QCOMPARE(eng.uncaughtExceptionLineNumber(), x + 2);
+        QVERIFY(eng.uncaughtException().strictlyEquals(ret));
+        QVERIFY(eng.hasUncaughtException());
+        QVERIFY(eng.uncaughtException().strictlyEquals(ret));
+        QString backtrace = QString::fromLatin1("<anonymous>()@FooScript") + QString::number(x) + ":" + QString::number(x + 2);
+        QCOMPARE(eng.uncaughtExceptionBacktrace().join(""), backtrace);
+        QVERIFY(fun.call().isNull());
+        QVERIFY(eng.hasUncaughtException());
+        QCOMPARE(eng.uncaughtExceptionLineNumber(), x + 2);
+        QVERIFY(eng.uncaughtException().strictlyEquals(ret));
+        eng.clearExceptions();
+        QVERIFY(!eng.hasUncaughtException());
+        QCOMPARE(eng.uncaughtExceptionLineNumber(), -1);
+        QVERIFY(!eng.uncaughtException().isValid());
+        eng.evaluate("2 = 3");
+        QVERIFY(eng.hasUncaughtException());
+        QScriptValue ret2 = throwFun.call();
+        QVERIFY(ret2.isError());
+        QVERIFY(eng.hasUncaughtException());
+        QVERIFY(eng.uncaughtException().strictlyEquals(ret2));
+        QCOMPARE(eng.uncaughtExceptionLineNumber(), 1);
+        eng.clearExceptions();
+        QVERIFY(!eng.hasUncaughtException());
+        eng.evaluate("1 + 2");
+        QVERIFY(!eng.hasUncaughtException());
+    }
+}
+
 QTEST_MAIN(tst_QScriptEngine)
 #include "tst_qscriptengine.moc"
diff --git a/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.cpp b/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.cpp
index 27d6df2..2a2a6b1 100644
--- a/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.cpp
+++ b/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.cpp
@@ -580,4 +580,17 @@ void tst_QScriptValue::toObjectSimple()
     }
 }
 
+void tst_QScriptValue::propertySimple()
+{
+    QScriptEngine eng;
+
+    QScriptValue simpleObject(eng.evaluate("new Object({ test: 1, other: 2 })"));
+    QCOMPARE(simpleObject.property("test").toUInt32(), quint32(1));
+    QCOMPARE(simpleObject.property("other").toUInt32(), quint32(2));
+
+    QScriptValue simpleArray(eng.evaluate("new Array(7, 8, 9)"));
+    QCOMPARE(simpleArray.property("length").toUInt32(), quint32(3));
+    QCOMPARE(simpleArray.property(2).toUInt32(), quint32(9));
+}
+
 QTEST_MAIN(tst_QScriptValue)
diff --git a/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.h b/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.h
index f9fcedb..af600a6 100644
--- a/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.h
+++ b/JavaScriptCore/qt/tests/qscriptvalue/tst_qscriptvalue.h
@@ -51,6 +51,7 @@ private slots:
     void call();
     void ctor();
     void toObjectSimple();
+    void propertySimple();
 
     // Generated test functions.
     void isBool_data();
diff --git a/JavaScriptCore/runtime/Arguments.h b/JavaScriptCore/runtime/Arguments.h
index 169c6f6..6bb180c 100644
--- a/JavaScriptCore/runtime/Arguments.h
+++ b/JavaScriptCore/runtime/Arguments.h
@@ -55,6 +55,10 @@ namespace JSC {
 
     class Arguments : public JSObject {
     public:
+        // Use an enum because otherwise gcc insists on doing a memory
+        // read.
+        enum { MaxArguments = 0x10000 };
+
         enum NoParametersType { NoParameters };
 
         Arguments(CallFrame*);
diff --git a/JavaScriptCore/runtime/Collector.cpp b/JavaScriptCore/runtime/Collector.cpp
index 03389c4..38f3ce5 100644
--- a/JavaScriptCore/runtime/Collector.cpp
+++ b/JavaScriptCore/runtime/Collector.cpp
@@ -245,7 +245,7 @@ NEVER_INLINE CollectorBlock* Heap::allocateBlock()
 
     Structure* dummyMarkableCellStructure = m_globalData->dummyMarkableCellStructure.get();
     for (size_t i = 0; i < HeapConstants::cellsPerBlock; ++i)
-        new (block->cells + i) JSCell(dummyMarkableCellStructure);
+        new (&block->cells[i]) JSCell(dummyMarkableCellStructure);
     
     // Add block to blocks vector.
 
@@ -384,7 +384,7 @@ allocate:
         do {
             ASSERT(m_heap.nextCell < HeapConstants::cellsPerBlock);
             if (!block->marked.get(m_heap.nextCell)) { // Always false for the last cell in the block
-                Cell* cell = block->cells + m_heap.nextCell;
+                Cell* cell = &block->cells[m_heap.nextCell];
 
                 m_heap.operationInProgress = Allocation;
                 JSCell* imp = reinterpret_cast<JSCell*>(cell);
diff --git a/JavaScriptCore/runtime/Collector.h b/JavaScriptCore/runtime/Collector.h
index 34e238c..f5bf113 100644
--- a/JavaScriptCore/runtime/Collector.h
+++ b/JavaScriptCore/runtime/Collector.h
@@ -24,6 +24,7 @@
 
 #include <stddef.h>
 #include <string.h>
+#include <wtf/FixedArray.h>
 #include <wtf/HashCountedSet.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
@@ -215,11 +216,11 @@ namespace JSC {
     const size_t BITMAP_WORDS = (BITMAP_SIZE + 3) / sizeof(uint32_t);
 
     struct CollectorBitmap {
-        uint32_t bits[BITMAP_WORDS];
+        FixedArray<uint32_t, BITMAP_WORDS> bits;
         bool get(size_t n) const { return !!(bits[n >> 5] & (1 << (n & 0x1F))); } 
         void set(size_t n) { bits[n >> 5] |= (1 << (n & 0x1F)); } 
         void clear(size_t n) { bits[n >> 5] &= ~(1 << (n & 0x1F)); } 
-        void clearAll() { memset(bits, 0, sizeof(bits)); }
+        void clearAll() { memset(bits.data(), 0, sizeof(bits)); }
         ALWAYS_INLINE void advanceToNextPossibleFreeCell(size_t& startCell)
         {
             if (!~bits[startCell >> 5])
@@ -248,12 +249,12 @@ namespace JSC {
     };
   
     struct CollectorCell {
-        double memory[CELL_ARRAY_LENGTH];
+        FixedArray<double, CELL_ARRAY_LENGTH> memory;
     };
 
     class CollectorBlock {
     public:
-        CollectorCell cells[CELLS_PER_BLOCK];
+        FixedArray<CollectorCell, CELLS_PER_BLOCK> cells;
         CollectorBitmap marked;
         Heap* heap;
     };
diff --git a/JavaScriptCore/runtime/CollectorHeapIterator.h b/JavaScriptCore/runtime/CollectorHeapIterator.h
index be6f3c9..9a3327c 100644
--- a/JavaScriptCore/runtime/CollectorHeapIterator.h
+++ b/JavaScriptCore/runtime/CollectorHeapIterator.h
@@ -77,7 +77,7 @@ namespace JSC {
 
     inline JSCell* CollectorHeapIterator::operator*() const
     {
-        return reinterpret_cast<JSCell*>(m_heap.blocks[m_block]->cells + m_cell);
+        return reinterpret_cast<JSCell*>(&m_heap.blocks[m_block]->cells[m_cell]);
     }
     
     // Iterators advance up to the next-to-last -- and not the last -- cell in a
diff --git a/JavaScriptCore/runtime/DateInstanceCache.h b/JavaScriptCore/runtime/DateInstanceCache.h
index d208580..b60c29a 100644
--- a/JavaScriptCore/runtime/DateInstanceCache.h
+++ b/JavaScriptCore/runtime/DateInstanceCache.h
@@ -86,7 +86,7 @@ namespace JSC {
 
         CacheEntry& lookup(double d) { return m_cache[WTF::FloatHash<double>::hash(d) & (cacheSize - 1)]; }
 
-        CacheEntry m_cache[cacheSize];
+        FixedArray<CacheEntry, cacheSize> m_cache;
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSArray.cpp b/JavaScriptCore/runtime/JSArray.cpp
index 05623f5..78667cd 100644
--- a/JavaScriptCore/runtime/JSArray.cpp
+++ b/JavaScriptCore/runtime/JSArray.cpp
@@ -948,10 +948,10 @@ void JSArray::fillArgList(ExecState* exec, MarkedArgumentBuffer& args)
 
 void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSize)
 {
-    ASSERT(m_storage->m_length == maxSize);
+    ASSERT(m_storage->m_length >= maxSize);
     UNUSED_PARAM(maxSize);
     JSValue* vector = m_storage->m_vector;
-    unsigned vectorEnd = min(m_storage->m_length, m_vectorLength);
+    unsigned vectorEnd = min(maxSize, m_vectorLength);
     unsigned i = 0;
     for (; i < vectorEnd; ++i) {
         JSValue& v = vector[i];
@@ -960,7 +960,7 @@ void JSArray::copyToRegisters(ExecState* exec, Register* buffer, uint32_t maxSiz
         buffer[i] = v;
     }
 
-    for (; i < m_storage->m_length; ++i)
+    for (; i < maxSize; ++i)
         buffer[i] = get(exec, i);
 }
 
diff --git a/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index 04cb7cf..f625323 100644
--- a/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -36,14 +36,13 @@
 #include "Nodes.h"
 #include "Parser.h"
 #include "StringBuilder.h"
-#include "StringExtras.h"
 #include "dtoa.h"
 #include <stdio.h>
 #include <stdlib.h>
-#include <string.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
+#include <wtf/StringExtras.h>
 #include <wtf/unicode/UTF8.h>
 
 using namespace WTF;
@@ -66,7 +65,7 @@ static JSValue encode(ExecState* exec, const char* doNotEscape)
             builder.append(c);
         else {
             char tmp[4];
-            snprintf(tmp, 4, "%%%02X", static_cast<unsigned char>(c));
+            snprintf(tmp, sizeof(tmp), "%%%02X", static_cast<unsigned char>(c));
             builder.append(tmp);
         }
     }
@@ -386,13 +385,13 @@ EncodedJSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec)
         int u = c[0];
         if (u > 255) {
             char tmp[7];
-            sprintf(tmp, "%%u%04X", u);
+            snprintf(tmp, sizeof(tmp), "%%u%04X", u);
             builder.append(tmp);
         } else if (u != 0 && strchr(do_not_escape, static_cast<char>(u)))
             builder.append(c, 1);
         else {
             char tmp[4];
-            sprintf(tmp, "%%%02X", u);
+            snprintf(tmp, sizeof(tmp), "%%%02X", u);
             builder.append(tmp);
         }
     }
diff --git a/JavaScriptCore/runtime/JSImmediate.h b/JavaScriptCore/runtime/JSImmediate.h
index f33d9fe..9127b6a 100644
--- a/JavaScriptCore/runtime/JSImmediate.h
+++ b/JavaScriptCore/runtime/JSImmediate.h
@@ -44,8 +44,6 @@ namespace JSC {
     class JSObject;
     class UString;
 
-    extern const size_t CELL_MASK;
-
 #if USE(JSVALUE64)
     inline intptr_t reinterpretDoubleToIntptr(double value)
     {
@@ -597,13 +595,7 @@ namespace JSC {
 
     inline bool JSValue::isCell() const
     {
-#ifndef NDEBUG
-        bool r = !JSImmediate::isImmediate(asValue());
-        ASSERT(!r || !(JSImmediate::rawValue(asValue()) & CELL_MASK));
-        return r;
-#else
         return !JSImmediate::isImmediate(asValue());
-#endif
     }
 
     inline bool JSValue::isInt32() const
diff --git a/JavaScriptCore/runtime/JSString.cpp b/JavaScriptCore/runtime/JSString.cpp
index 1d5e639..13c5a51 100644
--- a/JavaScriptCore/runtime/JSString.cpp
+++ b/JavaScriptCore/runtime/JSString.cpp
@@ -120,7 +120,7 @@ JSValue JSString::replaceCharacter(ExecState* exec, UChar character, const UStri
     size_t fiberCount = 0;
     UStringImpl* matchString = 0;
     int matchPosition = -1;
-    for (RopeIterator it(m_other.m_fibers, m_fiberCount); it != end; ++it) {
+    for (RopeIterator it(m_other.m_fibers.data(), m_fiberCount); it != end; ++it) {
         ++fiberCount;
         if (matchString)
             continue;
@@ -139,7 +139,7 @@ JSValue JSString::replaceCharacter(ExecState* exec, UChar character, const UStri
     if (UNLIKELY(builder.isOutOfMemory()))
         return throwOutOfMemoryError(exec);
 
-    for (RopeIterator it(m_other.m_fibers, m_fiberCount); it != end; ++it) {
+    for (RopeIterator it(m_other.m_fibers.data(), m_fiberCount); it != end; ++it) {
         UStringImpl* string = *it;
         if (string != matchString) {
             builder.append(UString(string));
diff --git a/JavaScriptCore/runtime/JSString.h b/JavaScriptCore/runtime/JSString.h
index 975ef45..53c144b 100644
--- a/JavaScriptCore/runtime/JSString.h
+++ b/JavaScriptCore/runtime/JSString.h
@@ -417,7 +417,7 @@ namespace JSC {
         struct JSStringFinalizerStruct {
             JSStringFinalizerStruct() : m_finalizerCallback(0) {}
             union {
-                mutable RopeImpl::Fiber m_fibers[s_maxInternalRopeLength];
+                mutable FixedArray<RopeImpl::Fiber, s_maxInternalRopeLength> m_fibers;
                 struct {
                     JSStringFinalizerCallback m_finalizerCallback;
                     void* m_finalizerContext;
diff --git a/JavaScriptCore/runtime/NumericStrings.h b/JavaScriptCore/runtime/NumericStrings.h
index 89235af..47fbbb2 100644
--- a/JavaScriptCore/runtime/NumericStrings.h
+++ b/JavaScriptCore/runtime/NumericStrings.h
@@ -27,6 +27,7 @@
 #define NumericStrings_h
 
 #include "UString.h"
+#include <wtf/FixedArray.h>
 #include <wtf/HashFunctions.h>
 
 namespace JSC {
@@ -86,10 +87,10 @@ namespace JSC {
             return smallIntCache[i];
         }
 
-        CacheEntry<double> doubleCache[cacheSize];
-        CacheEntry<int> intCache[cacheSize];
-        CacheEntry<unsigned> unsignedCache[cacheSize];
-        UString smallIntCache[cacheSize];
+        FixedArray<CacheEntry<double>, cacheSize> doubleCache;
+        FixedArray<CacheEntry<int>, cacheSize> intCache;
+        FixedArray<CacheEntry<unsigned>, cacheSize> unsignedCache;
+        FixedArray<UString, cacheSize> smallIntCache;
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/RegExp.cpp b/JavaScriptCore/runtime/RegExp.cpp
index 0780984..d8b217d 100644
--- a/JavaScriptCore/runtime/RegExp.cpp
+++ b/JavaScriptCore/runtime/RegExp.cpp
@@ -46,30 +46,23 @@
 
 namespace JSC {
 
-inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern)
-    : m_pattern(pattern)
-    , m_flagBits(0)
-    , m_constructionError(0)
-    , m_numSubpatterns(0)
-{
-    compile(globalData);
-}
-
 inline RegExp::RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags)
     : m_pattern(pattern)
     , m_flagBits(0)
     , m_constructionError(0)
     , m_numSubpatterns(0)
+    , m_lastMatchStart(-1)
 {
     // NOTE: The global flag is handled on a case-by-case basis by functions like
     // String::match and RegExpObject::match.
-    if (flags.find('g') != UString::NotFound)
-        m_flagBits |= Global;
-    if (flags.find('i') != UString::NotFound)
-        m_flagBits |= IgnoreCase;
-    if (flags.find('m') != UString::NotFound)
-        m_flagBits |= Multiline;
-
+    if (!flags.isNull()) {
+        if (flags.find('g') != UString::NotFound)
+            m_flagBits |= Global;
+        if (flags.find('i') != UString::NotFound)
+            m_flagBits |= IgnoreCase;
+        if (flags.find('m') != UString::NotFound)
+            m_flagBits |= Multiline;
+    }
     compile(globalData);
 }
 
@@ -80,11 +73,6 @@ RegExp::~RegExp()
 }
 #endif
 
-PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern)
-{
-    return adoptRef(new RegExp(globalData, pattern));
-}
-
 PassRefPtr<RegExp> RegExp::create(JSGlobalData* globalData, const UString& pattern, const UString& flags)
 {
     return adoptRef(new RegExp(globalData, pattern, flags));
@@ -109,8 +97,24 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
     if (ovector)
         ovector->resize(0);
 
-    if (static_cast<unsigned>(startOffset) > s.size() || s.isNull())
+    if (static_cast<unsigned>(startOffset) > s.size() || s.isNull()) {
+        m_lastMatchString = UString();
+        m_lastMatchStart = -1;
+        m_lastOVector.shrink(0);
         return -1;
+    }
+    
+    // Perform check to see if this match call is the same as the last match invocation
+    // and if it is return the prior result.
+    if ((startOffset == m_lastMatchStart) && (s.rep() == m_lastMatchString.rep())) {
+        if (ovector)
+            *ovector = m_lastOVector;
+        
+        if (m_lastOVector.isEmpty())
+            return -1;
+
+        return m_lastOVector.at(0);
+    }
 
 #if ENABLE(YARR_JIT)
     if (!!m_regExpJITCode) {
@@ -147,9 +151,22 @@ int RegExp::match(const UString& s, int startOffset, Vector<int, 32>* ovector)
             if (ovector)
                 ovector->clear();
         }
+        
+        m_lastMatchString = s;
+        m_lastMatchStart = startOffset;
+
+        if (ovector)
+            m_lastOVector = *ovector;
+        else
+            m_lastOVector = nonReturnedOvector;
+
         return result;
     }
 
+    m_lastMatchString = UString();
+    m_lastMatchStart = -1;
+    m_lastOVector.shrink(0);
+
     return -1;
 }
 
diff --git a/JavaScriptCore/runtime/RegExp.h b/JavaScriptCore/runtime/RegExp.h
index 695b688..8ea44e3 100644
--- a/JavaScriptCore/runtime/RegExp.h
+++ b/JavaScriptCore/runtime/RegExp.h
@@ -37,7 +37,6 @@ namespace JSC {
 
     class RegExp : public RefCounted<RegExp> {
     public:
-        static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern);
         static PassRefPtr<RegExp> create(JSGlobalData* globalData, const UString& pattern, const UString& flags);
 #if !ENABLE(YARR)
         ~RegExp();
@@ -56,7 +55,6 @@ namespace JSC {
         unsigned numSubpatterns() const { return m_numSubpatterns; }
 
     private:
-        RegExp(JSGlobalData* globalData, const UString& pattern);
         RegExp(JSGlobalData* globalData, const UString& pattern, const UString& flags);
 
         void compile(JSGlobalData*);
@@ -67,6 +65,9 @@ namespace JSC {
         int m_flagBits;
         const char* m_constructionError;
         unsigned m_numSubpatterns;
+        UString m_lastMatchString;
+        int m_lastMatchStart;
+        Vector<int, 32> m_lastOVector;
 
 #if ENABLE(YARR_JIT)
         Yarr::RegexCodeBlock m_regExpJITCode;
diff --git a/JavaScriptCore/runtime/RegExpCache.cpp b/JavaScriptCore/runtime/RegExpCache.cpp
index 192df4d..b9d250d 100644
--- a/JavaScriptCore/runtime/RegExpCache.cpp
+++ b/JavaScriptCore/runtime/RegExpCache.cpp
@@ -34,25 +34,26 @@ namespace JSC {
 PassRefPtr<RegExp> RegExpCache::lookupOrCreate(const UString& patternString, const UString& flags)
 {
     if (patternString.size() < maxCacheablePatternLength) {
-        pair<HashMap<RegExpKey, RefPtr<RegExp> >::iterator, bool> result = m_cacheMap.add(RegExpKey(flags, patternString), 0);
+        pair<RegExpCacheMap::iterator, bool> result = m_cacheMap.add(RegExpKey(flags, patternString), 0);
         if (!result.second)
             return result.first->second;
+        else
+            return create(patternString, flags, result.first);
     }
-    return create(patternString, flags);
+    return create(patternString, flags, m_cacheMap.end());
 }
 
-PassRefPtr<RegExp> RegExpCache::create(const UString& patternString, const UString& flags) 
+PassRefPtr<RegExp> RegExpCache::create(const UString& patternString, const UString& flags, RegExpCacheMap::iterator iterator) 
 {
-    RefPtr<RegExp> regExp;
-
-    if (!flags.isNull())
-        regExp = RegExp::create(m_globalData, patternString, flags);
-    else
-        regExp = RegExp::create(m_globalData, patternString);
+    RefPtr<RegExp> regExp = RegExp::create(m_globalData, patternString, flags);
 
     if (patternString.size() >= maxCacheablePatternLength)
         return regExp;
 
+    RegExpKey key = RegExpKey(flags, patternString);
+    iterator->first = key;
+    iterator->second = regExp;
+
     ++m_nextKeyToEvict;
     if (m_nextKeyToEvict == maxCacheableEntries) {
         m_nextKeyToEvict = 0;
@@ -61,8 +62,6 @@ PassRefPtr<RegExp> RegExpCache::create(const UString& patternString, const UStri
     if (m_isFull)
         m_cacheMap.remove(RegExpKey(patternKeyArray[m_nextKeyToEvict].flagsValue, patternKeyArray[m_nextKeyToEvict].pattern));
 
-    RegExpKey key = RegExpKey(flags, patternString);
-    m_cacheMap.set(key, regExp);
     patternKeyArray[m_nextKeyToEvict].flagsValue = key.flagsValue;
     patternKeyArray[m_nextKeyToEvict].pattern = patternString.rep();
     return regExp;
diff --git a/JavaScriptCore/runtime/RegExpCache.h b/JavaScriptCore/runtime/RegExpCache.h
index 03b73ac..fb30a9e 100644
--- a/JavaScriptCore/runtime/RegExpCache.h
+++ b/JavaScriptCore/runtime/RegExpCache.h
@@ -35,17 +35,19 @@
 namespace JSC {
 
 class RegExpCache {
+
+typedef HashMap<RegExpKey, RefPtr<RegExp> > RegExpCacheMap;
+
 public:
     PassRefPtr<RegExp> lookupOrCreate(const UString& patternString, const UString& flags);
-    PassRefPtr<RegExp> create(const UString& patternString, const UString& flags);
+    PassRefPtr<RegExp> create(const UString& patternString, const UString& flags, RegExpCacheMap::iterator iterator);
     RegExpCache(JSGlobalData* globalData);
 
 private:
     static const unsigned maxCacheablePatternLength = 256;
     static const int maxCacheableEntries = 256;
 
-    typedef HashMap<RegExpKey, RefPtr<RegExp> > RegExpCacheMap;
-    RegExpKey patternKeyArray[maxCacheableEntries];
+    FixedArray<RegExpKey, maxCacheableEntries> patternKeyArray;
     RegExpCacheMap m_cacheMap;
     JSGlobalData* m_globalData;
     int m_nextKeyToEvict;
diff --git a/JavaScriptCore/runtime/SmallStrings.h b/JavaScriptCore/runtime/SmallStrings.h
index bc337c9..b550a04 100644
--- a/JavaScriptCore/runtime/SmallStrings.h
+++ b/JavaScriptCore/runtime/SmallStrings.h
@@ -27,6 +27,7 @@
 #define SmallStrings_h
 
 #include "UString.h"
+#include <wtf/FixedArray.h>
 #include <wtf/OwnPtr.h>
 
 namespace JSC {
@@ -61,14 +62,14 @@ namespace JSC {
 
         unsigned count() const;
 #if ENABLE(JIT)
-        JSString** singleCharacterStrings() { return m_singleCharacterStrings; }
+        JSString** singleCharacterStrings() { return m_singleCharacterStrings.data(); }
 #endif
     private:
         void createEmptyString(JSGlobalData*);
         void createSingleCharacterString(JSGlobalData*, unsigned char);
 
         JSString* m_emptyString;
-        JSString* m_singleCharacterStrings[0x100];
+        FixedArray<JSString*, 0x100> m_singleCharacterStrings;
         OwnPtr<SmallStringsStorage> m_storage;
     };
 
diff --git a/JavaScriptCore/runtime/UString.cpp b/JavaScriptCore/runtime/UString.cpp
index 1c11936..5a6a644 100644
--- a/JavaScriptCore/runtime/UString.cpp
+++ b/JavaScriptCore/runtime/UString.cpp
@@ -32,17 +32,14 @@
 #include <ctype.h>
 #include <limits.h>
 #include <limits>
-#include <math.h>
 #include <stdio.h>
 #include <stdlib.h>
-#include <string.h>
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Vector.h>
 #include <wtf/unicode/UTF8.h>
-#include <wtf/StringExtras.h>
 
 #if HAVE(STRINGS_H)
 #include <strings.h>
@@ -96,7 +93,7 @@ UString UString::from(int i)
         *--p = '0';
     else if (i == INT_MIN) {
         char minBuf[1 + sizeof(i) * 3];
-        sprintf(minBuf, "%d", INT_MIN);
+        snprintf(minBuf, sizeof(minBuf), "%d", INT_MIN);
         return UString(minBuf);
     } else {
         bool negative = false;
@@ -126,9 +123,9 @@ UString UString::from(long long i)
     else if (i == std::numeric_limits<long long>::min()) {
         char minBuf[1 + sizeof(i) * 3];
 #if OS(WINDOWS)
-        snprintf(minBuf, sizeof(minBuf) - 1, "%I64d", std::numeric_limits<long long>::min());
+        snprintf(minBuf, sizeof(minBuf), "%I64d", std::numeric_limits<long long>::min());
 #else
-        snprintf(minBuf, sizeof(minBuf) - 1, "%lld", std::numeric_limits<long long>::min());
+        snprintf(minBuf, sizeof(minBuf), "%lld", std::numeric_limits<long long>::min());
 #endif
         return UString(minBuf);
     } else {
@@ -176,7 +173,7 @@ UString UString::from(long l)
         *--p = '0';
     else if (l == LONG_MIN) {
         char minBuf[1 + sizeof(l) * 3];
-        sprintf(minBuf, "%ld", LONG_MIN);
+        snprintf(minBuf, sizeof(minBuf), "%ld", LONG_MIN);
         return UString(minBuf);
     } else {
         bool negative = false;
diff --git a/JavaScriptCore/runtime/UString.h b/JavaScriptCore/runtime/UString.h
index 4364021..bae9265 100644
--- a/JavaScriptCore/runtime/UString.h
+++ b/JavaScriptCore/runtime/UString.h
@@ -158,21 +158,43 @@ namespace JSC {
 
     ALWAYS_INLINE bool operator==(const UString& s1, const UString& s2)
     {
-        unsigned size = s1.size();
-        switch (size) {
-        case 0:
-            return !s2.size();
+        UString::Rep* rep1 = s1.rep();
+        UString::Rep* rep2 = s2.rep();
+        unsigned size1 = 0;
+        unsigned size2 = 0;
+
+        if (rep1 == rep2) // If they're the same rep, they're equal.
+            return true;
+        
+        if (rep1)
+            size1 = rep1->length();
+            
+        if (rep2)
+            size2 = rep2->length();
+            
+        if (size1 != size2) // If the lengths are not the same, we're done.
+            return false;
+        
+        if (!size1)
+            return true;
+        
+        // At this point we know 
+        //   (a) that the strings are the same length and
+        //   (b) that they are greater than zero length.
+        const UChar* d1 = rep1->characters();
+        const UChar* d2 = rep2->characters();
+        
+        if (d1 == d2) // Check to see if the data pointers are the same.
+            return true;
+        
+        // Do quick checks for sizes 1 and 2.
+        switch (size1) {
         case 1:
-            return s2.size() == 1 && s1.data()[0] == s2.data()[0];
-        case 2: {
-            if (s2.size() != 2)
-                return false;
-            const UChar* d1 = s1.data();
-            const UChar* d2 = s2.data();
+            return d1[0] == d2[0];
+        case 2:
             return (d1[0] == d2[0]) & (d1[1] == d2[1]);
-        }
         default:
-            return s2.size() == size && memcmp(s1.data(), s2.data(), size * sizeof(UChar)) == 0;
+            return memcmp(d1, d2, size1 * sizeof(UChar)) == 0;
         }
     }
 
diff --git a/JavaScriptCore/wtf/AVLTree.h b/JavaScriptCore/wtf/AVLTree.h
index d7470e7..ec8a639 100644
--- a/JavaScriptCore/wtf/AVLTree.h
+++ b/JavaScriptCore/wtf/AVLTree.h
@@ -33,6 +33,7 @@
 #define AVL_TREE_H_
 
 #include "Assertions.h"
+#include <wtf/FixedArray.h>
 
 namespace WTF {
 
@@ -70,7 +71,7 @@ public:
     void reset() { for (unsigned i = 0; i < maxDepth; ++i) m_data[i] = false; }
 
 private:
-    bool m_data[maxDepth];
+    FixedArray<bool, maxDepth> m_data;
 };
 
 // How to determine maxDepth:
diff --git a/JavaScriptCore/wtf/Assertions.h b/JavaScriptCore/wtf/Assertions.h
index d26b939..afeae0c 100644
--- a/JavaScriptCore/wtf/Assertions.h
+++ b/JavaScriptCore/wtf/Assertions.h
@@ -55,6 +55,10 @@
 #include <e32debug.h>
 #endif
 
+#if PLATFORM(BREWMP)
+#include <AEEStdLib.h>
+#endif
+
 #ifdef NDEBUG
 /* Disable ASSERT* macros in release mode. */
 #define ASSERTIONS_DISABLED_DEFAULT 1
@@ -163,6 +167,12 @@ void WTFLogVerbose(const char* file, int line, const char* function, WTFLogChann
     __DEBUGGER(); \
     User::Panic(_L("Webkit CRASH"),0); \
     } while(false)
+#elif PLATFORM(BREWMP)
+#define CRASH() do { \
+    DBGPRINTF_FATAL("WebKit CRASH"); \
+    *(int *)(uintptr_t)0xbbadbeef = 0; \
+    ((void(*)())0)(); /* More reliable, but doesn't say BBADBEEF */ \
+} while(false)
 #else
 #define CRASH() do { \
     *(int *)(uintptr_t)0xbbadbeef = 0; \
diff --git a/JavaScriptCore/wtf/FixedArray.h b/JavaScriptCore/wtf/FixedArray.h
new file mode 100644
index 0000000..66f2327
--- /dev/null
+++ b/JavaScriptCore/wtf/FixedArray.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FixedArray_h
+#define FixedArray_h
+
+#include <wtf/Assertions.h>
+
+namespace WTF {
+template <typename T, int Size> class FixedArray {
+public:
+    T& operator[](size_t i)
+    {
+        ASSERT(i < Size);
+        return m_data[i];
+    }
+
+    const T& operator[](size_t i) const
+    {
+        ASSERT(i < Size);
+        return m_data[i];
+    }
+
+    T* data() { return m_data; }
+private:
+    T m_data[Size];
+};
+}
+using WTF::FixedArray;
+
+#endif // FixedArray_h
diff --git a/JavaScriptCore/wtf/HashSet.h b/JavaScriptCore/wtf/HashSet.h
index 4429490..66639e4 100644
--- a/JavaScriptCore/wtf/HashSet.h
+++ b/JavaScriptCore/wtf/HashSet.h
@@ -48,7 +48,7 @@ namespace WTF {
             HashFunctions, ValueTraits, ValueTraits> HashTableType;
 
     public:
-        typedef HashTableIteratorAdapter<HashTableType, ValueType> iterator;
+        typedef HashTableConstIteratorAdapter<HashTableType, ValueType> iterator;
         typedef HashTableConstIteratorAdapter<HashTableType, ValueType> const_iterator;
 
         void swap(HashSet&);
@@ -57,13 +57,10 @@ namespace WTF {
         int capacity() const;
         bool isEmpty() const;
 
-        iterator begin();
-        iterator end();
-        const_iterator begin() const;
-        const_iterator end() const;
+        iterator begin() const;
+        iterator end() const;
 
-        iterator find(const ValueType&);
-        const_iterator find(const ValueType&) const;
+        iterator find(const ValueType&) const;
         bool contains(const ValueType&) const;
 
         // An alternate version of find() that finds the object by hashing and comparing
@@ -71,8 +68,7 @@ namespace WTF {
         // must have the following function members:
         //   static unsigned hash(const T&);
         //   static bool equal(const ValueType&, const T&);
-        template<typename T, typename HashTranslator> iterator find(const T&);
-        template<typename T, typename HashTranslator> const_iterator find(const T&) const;
+        template<typename T, typename HashTranslator> iterator find(const T&) const;
         template<typename T, typename HashTranslator> bool contains(const T&) const;
 
         // The return value is a pair of an interator to the new value's location, 
@@ -137,37 +133,19 @@ namespace WTF {
     }
 
     template<typename T, typename U, typename V>
-    inline typename HashSet<T, U, V>::iterator HashSet<T, U, V>::begin()
+    inline typename HashSet<T, U, V>::iterator HashSet<T, U, V>::begin() const
     {
         return m_impl.begin(); 
     }
 
     template<typename T, typename U, typename V>
-    inline typename HashSet<T, U, V>::iterator HashSet<T, U, V>::end()
+    inline typename HashSet<T, U, V>::iterator HashSet<T, U, V>::end() const
     {
         return m_impl.end(); 
     }
 
     template<typename T, typename U, typename V>
-    inline typename HashSet<T, U, V>::const_iterator HashSet<T, U, V>::begin() const
-    {
-        return m_impl.begin(); 
-    }
-
-    template<typename T, typename U, typename V>
-    inline typename HashSet<T, U, V>::const_iterator HashSet<T, U, V>::end() const
-    {
-        return m_impl.end(); 
-    }
-
-    template<typename T, typename U, typename V>
-    inline typename HashSet<T, U, V>::iterator HashSet<T, U, V>::find(const ValueType& value)
-    {
-        return m_impl.find(value); 
-    }
-
-    template<typename T, typename U, typename V>
-    inline typename HashSet<T, U, V>::const_iterator HashSet<T, U, V>::find(const ValueType& value) const
+    inline typename HashSet<T, U, V>::iterator HashSet<T, U, V>::find(const ValueType& value) const
     {
         return m_impl.find(value); 
     }
@@ -181,15 +159,6 @@ namespace WTF {
     template<typename Value, typename HashFunctions, typename Traits>
     template<typename T, typename HashTranslator>
     typename HashSet<Value, HashFunctions, Traits>::iterator
-    inline HashSet<Value, HashFunctions, Traits>::find(const T& value)
-    {
-        typedef HashSetTranslatorAdapter<ValueType, ValueTraits, T, HashTranslator> Adapter;
-        return m_impl.template find<T, Adapter>(value);
-    }
-
-    template<typename Value, typename HashFunctions, typename Traits>
-    template<typename T, typename HashTranslator>
-    typename HashSet<Value, HashFunctions, Traits>::const_iterator
     inline HashSet<Value, HashFunctions, Traits>::find(const T& value) const
     {
         typedef HashSetTranslatorAdapter<ValueType, ValueTraits, T, HashTranslator> Adapter;
diff --git a/JavaScriptCore/wtf/HashTable.h b/JavaScriptCore/wtf/HashTable.h
index ceb8963..1c4ae6d 100644
--- a/JavaScriptCore/wtf/HashTable.h
+++ b/JavaScriptCore/wtf/HashTable.h
@@ -333,6 +333,7 @@ namespace WTF {
         void remove(const KeyType&);
         void remove(iterator);
         void removeWithoutEntryConsistencyCheck(iterator);
+        void removeWithoutEntryConsistencyCheck(const_iterator);
         void clear();
 
         static bool isEmptyBucket(const ValueType& value) { return Extractor::extract(value) == KeyTraits::emptyValue(); }
@@ -854,6 +855,15 @@ namespace WTF {
     }
 
     template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
+    inline void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::removeWithoutEntryConsistencyCheck(const_iterator it)
+    {
+        if (it == end())
+            return;
+
+        removeAndInvalidateWithoutEntryConsistencyCheck(const_cast<ValueType*>(it.m_position));
+    }
+
+    template<typename Key, typename Value, typename Extractor, typename HashFunctions, typename Traits, typename KeyTraits>
     inline void HashTable<Key, Value, Extractor, HashFunctions, Traits, KeyTraits>::remove(const KeyType& key)
     {
         remove(find(key));
diff --git a/JavaScriptCore/wtf/PassRefPtr.h b/JavaScriptCore/wtf/PassRefPtr.h
index d7a9341..7c5d868 100644
--- a/JavaScriptCore/wtf/PassRefPtr.h
+++ b/JavaScriptCore/wtf/PassRefPtr.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2005, 2006, 2007 Apple Inc. All rights reserved.
+ *  Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -27,69 +27,61 @@ namespace WTF {
 
     template<typename T> class RefPtr;
     template<typename T> class PassRefPtr;
-    template <typename T> PassRefPtr<T> adoptRef(T*);
+    template<typename T> PassRefPtr<T> adoptRef(T*);
 
+    inline void adopted(const void*) { }
 
-    // Remove inline for WINSCW compiler to prevent the compiler agressively resolving
-    // T::ref() and T::deref(), which will fail compiling when PassRefPtr<T> is used as
-    // a class member or function arguments before T is defined.
-
-    // [Qt]r57240 broke Qt build (might be a gcc bug)
-    // FIXME! See: https://bugs.webkit.org/show_bug.cgi?id=37253
-    template<typename T>
 #if !COMPILER(WINSCW)
 #if !PLATFORM(QT)
-    ALWAYS_INLINE
+    #define REF_DEREF_INLINE ALWAYS_INLINE
 #else
-    inline
+    // Using ALWAYS_INLINE broke the Qt build. This may be a GCC bug.
+    // See https://bugs.webkit.org/show_bug.cgi?id=37253 for details.
+    #define REF_DEREF_INLINE inline
 #endif
+#else
+    // No inlining for WINSCW compiler to prevent the compiler agressively resolving
+    // T::ref() and T::deref(), which will fail compiling when PassRefPtr<T> is used as
+    // a class member or function arguments before T is defined.
+    #define REF_DEREF_INLINE
 #endif
-    void refIfNotNull(T* ptr)
+
+    template<typename T> REF_DEREF_INLINE void refIfNotNull(T* ptr)
     {
         if (UNLIKELY(ptr != 0))
             ptr->ref();
     }
 
-    // [Qt]r57240 broke Qt build (might be a gcc bug)
-    // FIXME! See: https://bugs.webkit.org/show_bug.cgi?id=37253
-    template<typename T> 
-#if !COMPILER(WINSCW)
-#if !PLATFORM(QT)
-    ALWAYS_INLINE
-#else
-    inline
-#endif
-#endif
-    void derefIfNotNull(T* ptr)
+    template<typename T> REF_DEREF_INLINE void derefIfNotNull(T* ptr)
     {
         if (UNLIKELY(ptr != 0))
             ptr->deref();
     }
 
+    #undef REF_DEREF_INLINE
+
     template<typename T> class PassRefPtr {
     public:
-        PassRefPtr() : m_ptr(0) {}
+        PassRefPtr() : m_ptr(0) { }
         PassRefPtr(T* ptr) : m_ptr(ptr) { refIfNotNull(ptr); }
         // It somewhat breaks the type system to allow transfer of ownership out of
         // a const PassRefPtr. However, it makes it much easier to work with PassRefPtr
-        // temporaries, and we don't really have a need to use real const PassRefPtrs 
-        // anyway.
-        PassRefPtr(const PassRefPtr& o) : m_ptr(o.releaseRef()) {}
-        template <typename U> PassRefPtr(const PassRefPtr<U>& o) : m_ptr(o.releaseRef()) { }
+        // temporaries, and we don't have a need to use real const PassRefPtrs anyway.
+        PassRefPtr(const PassRefPtr& o) : m_ptr(o.releaseRef()) { }
+        template<typename U> PassRefPtr(const PassRefPtr<U>& o) : m_ptr(o.releaseRef()) { }
 
         ALWAYS_INLINE ~PassRefPtr() { derefIfNotNull(m_ptr); }
 
-        template <class U> 
-        PassRefPtr(const RefPtr<U>& o) : m_ptr(o.get()) { T* ptr = m_ptr; refIfNotNull(ptr); }
+        template<typename U> PassRefPtr(const RefPtr<U>&);
         
         T* get() const { return m_ptr; }
 
         void clear() { T* ptr = m_ptr; derefIfNotNull(ptr); m_ptr = 0; }
-        T* releaseRef() const { T* tmp = m_ptr; m_ptr = 0; return tmp; }
+        T* leakRef() const;
 
         T& operator*() const { return *m_ptr; }
         T* operator->() const { return m_ptr; }
-        
+
         bool operator!() const { return !m_ptr; }
 
         // This conversion operator allows implicit conversion to bool but not to other integer types.
@@ -98,13 +90,18 @@ namespace WTF {
 
         PassRefPtr& operator=(T*);
         PassRefPtr& operator=(const PassRefPtr&);
-        template <typename U> PassRefPtr& operator=(const PassRefPtr<U>&);
-        template <typename U> PassRefPtr& operator=(const RefPtr<U>&);
+        template<typename U> PassRefPtr& operator=(const PassRefPtr<U>&);
+        template<typename U> PassRefPtr& operator=(const RefPtr<U>&);
 
         friend PassRefPtr adoptRef<T>(T*);
+
+        // FIXME: Remove releaseRef once we change all callers to call leakRef instead.
+        T* releaseRef() const { return leakRef(); }
+
     private:
         // adopting constructor
-        PassRefPtr(T* ptr, bool) : m_ptr(ptr) {}
+        PassRefPtr(T* ptr, bool) : m_ptr(ptr) { }
+
         mutable T* m_ptr;
     };
     
@@ -116,7 +113,7 @@ namespace WTF {
     // if we use inheritance, GCC's optimizer fails to realize that destruction
     // of a released NonNullPassRefPtr is a no-op. So, for now, just copy the
     // most important code from PassRefPtr.
-    template <typename T> class NonNullPassRefPtr {
+    template<typename T> class NonNullPassRefPtr {
     public:
         NonNullPassRefPtr(T* ptr)
             : m_ptr(ptr)
@@ -125,7 +122,7 @@ namespace WTF {
             m_ptr->ref();
         }
 
-        template <class U> NonNullPassRefPtr(const RefPtr<U>& o)
+        template<typename U> NonNullPassRefPtr(const RefPtr<U>& o)
             : m_ptr(o.get())
         {
             ASSERT(m_ptr);
@@ -138,13 +135,13 @@ namespace WTF {
             ASSERT(m_ptr);
         }
 
-        template <class U> NonNullPassRefPtr(const NonNullPassRefPtr<U>& o)
+        template<typename U> NonNullPassRefPtr(const NonNullPassRefPtr<U>& o)
             : m_ptr(o.releaseRef())
         {
             ASSERT(m_ptr);
         }
 
-        template <class U> NonNullPassRefPtr(const PassRefPtr<U>& o)
+        template<typename U> NonNullPassRefPtr(const PassRefPtr<U>& o)
             : m_ptr(o.releaseRef())
         {
             ASSERT(m_ptr);
@@ -164,7 +161,21 @@ namespace WTF {
         mutable T* m_ptr;
     };
 
-    template <typename T> template <typename U> inline PassRefPtr<T>& PassRefPtr<T>::operator=(const RefPtr<U>& o) 
+    template<typename T> template<typename U> inline PassRefPtr<T>::PassRefPtr(const RefPtr<U>& o)
+        : m_ptr(o.get())
+    {
+        T* ptr = m_ptr;
+        refIfNotNull(ptr);
+    }
+
+    template<typename T> inline T* PassRefPtr<T>::leakRef() const
+    {
+        T* ptr = m_ptr;
+        m_ptr = 0;
+        return ptr;
+    }
+
+    template<typename T> template<typename U> inline PassRefPtr<T>& PassRefPtr<T>::operator=(const RefPtr<U>& o)
     {
         T* optr = o.get();
         refIfNotNull(optr);
@@ -174,7 +185,7 @@ namespace WTF {
         return *this;
     }
     
-    template <typename T> inline PassRefPtr<T>& PassRefPtr<T>::operator=(T* optr)
+    template<typename T> inline PassRefPtr<T>& PassRefPtr<T>::operator=(T* optr)
     {
         refIfNotNull(optr);
         T* ptr = m_ptr;
@@ -183,7 +194,7 @@ namespace WTF {
         return *this;
     }
 
-    template <typename T> inline PassRefPtr<T>& PassRefPtr<T>::operator=(const PassRefPtr<T>& ref)
+    template<typename T> inline PassRefPtr<T>& PassRefPtr<T>::operator=(const PassRefPtr<T>& ref)
     {
         T* ptr = m_ptr;
         m_ptr = ref.releaseRef();
@@ -191,7 +202,7 @@ namespace WTF {
         return *this;
     }
     
-    template <typename T> template <typename U> inline PassRefPtr<T>& PassRefPtr<T>::operator=(const PassRefPtr<U>& ref)
+    template<typename T> template<typename U> inline PassRefPtr<T>& PassRefPtr<T>::operator=(const PassRefPtr<U>& ref)
     {
         T* ptr = m_ptr;
         m_ptr = ref.releaseRef();
@@ -199,72 +210,73 @@ namespace WTF {
         return *this;
     }
     
-    template <typename T, typename U> inline bool operator==(const PassRefPtr<T>& a, const PassRefPtr<U>& b) 
+    template<typename T, typename U> inline bool operator==(const PassRefPtr<T>& a, const PassRefPtr<U>& b) 
     { 
         return a.get() == b.get(); 
     }
 
-    template <typename T, typename U> inline bool operator==(const PassRefPtr<T>& a, const RefPtr<U>& b) 
+    template<typename T, typename U> inline bool operator==(const PassRefPtr<T>& a, const RefPtr<U>& b) 
     { 
         return a.get() == b.get(); 
     }
 
-    template <typename T, typename U> inline bool operator==(const RefPtr<T>& a, const PassRefPtr<U>& b) 
+    template<typename T, typename U> inline bool operator==(const RefPtr<T>& a, const PassRefPtr<U>& b) 
     { 
         return a.get() == b.get(); 
     }
 
-    template <typename T, typename U> inline bool operator==(const PassRefPtr<T>& a, U* b) 
+    template<typename T, typename U> inline bool operator==(const PassRefPtr<T>& a, U* b) 
     { 
         return a.get() == b; 
     }
     
-    template <typename T, typename U> inline bool operator==(T* a, const PassRefPtr<U>& b) 
+    template<typename T, typename U> inline bool operator==(T* a, const PassRefPtr<U>& b) 
     {
         return a == b.get(); 
     }
     
-    template <typename T, typename U> inline bool operator!=(const PassRefPtr<T>& a, const PassRefPtr<U>& b) 
+    template<typename T, typename U> inline bool operator!=(const PassRefPtr<T>& a, const PassRefPtr<U>& b) 
     { 
         return a.get() != b.get(); 
     }
 
-    template <typename T, typename U> inline bool operator!=(const PassRefPtr<T>& a, const RefPtr<U>& b) 
+    template<typename T, typename U> inline bool operator!=(const PassRefPtr<T>& a, const RefPtr<U>& b) 
     { 
         return a.get() != b.get(); 
     }
 
-    template <typename T, typename U> inline bool operator!=(const RefPtr<T>& a, const PassRefPtr<U>& b) 
+    template<typename T, typename U> inline bool operator!=(const RefPtr<T>& a, const PassRefPtr<U>& b) 
     { 
         return a.get() != b.get(); 
     }
 
-    template <typename T, typename U> inline bool operator!=(const PassRefPtr<T>& a, U* b)
+    template<typename T, typename U> inline bool operator!=(const PassRefPtr<T>& a, U* b)
     {
         return a.get() != b; 
     }
 
-    template <typename T, typename U> inline bool operator!=(T* a, const PassRefPtr<U>& b) 
+    template<typename T, typename U> inline bool operator!=(T* a, const PassRefPtr<U>& b) 
     { 
         return a != b.get(); 
     }
     
-    template <typename T> inline PassRefPtr<T> adoptRef(T* p)
+    template<typename T> inline PassRefPtr<T> adoptRef(T* p)
     {
+        adopted(p);
         return PassRefPtr<T>(p, true);
     }
 
-    template <typename T, typename U> inline PassRefPtr<T> static_pointer_cast(const PassRefPtr<U>& p) 
+    template<typename T, typename U> inline PassRefPtr<T> static_pointer_cast(const PassRefPtr<U>& p) 
     { 
         return adoptRef(static_cast<T*>(p.releaseRef())); 
     }
 
-    template <typename T, typename U> inline PassRefPtr<T> const_pointer_cast(const PassRefPtr<U>& p) 
+    template<typename T, typename U> inline PassRefPtr<T> const_pointer_cast(const PassRefPtr<U>& p) 
     { 
         return adoptRef(const_cast<T*>(p.releaseRef())); 
     }
 
-    template <typename T> inline T* getPtr(const PassRefPtr<T>& p)
+    template<typename T> inline T* getPtr(const PassRefPtr<T>& p)
     {
         return p.get();
     }
diff --git a/JavaScriptCore/wtf/Platform.h b/JavaScriptCore/wtf/Platform.h
index b92d267..feb3a4d 100644
--- a/JavaScriptCore/wtf/Platform.h
+++ b/JavaScriptCore/wtf/Platform.h
@@ -615,6 +615,10 @@
 #define WTF_USE_CARBON_SECURE_INPUT_MODE 1
 #endif
 
+#if PLATFORM(BREWMP)
+#define ENABLE_SINGLE_THREADED 1
+#endif
+
 #if PLATFORM(QT) && OS(DARWIN)
 #define WTF_PLATFORM_CF 1
 #endif
@@ -719,6 +723,7 @@
 #if !defined(TARGETING_TIGER) && !defined(TARGETING_LEOPARD)
 
 #define HAVE_DISPATCH_H 1
+#define HAVE_HOSTED_CORE_ANIMATION 1
 
 #if !PLATFORM(IPHONE)
 #define HAVE_MADV_FREE_REUSE 1
@@ -986,7 +991,8 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 #endif
 #endif
 #if (CPU(X86) && USE(JSVALUE32_64)) || (CPU(X86_64) && USE(JSVALUE64)) \
-     || CPU(ARM)
+     || CPU(ARM) \
+     || CPU(MIPS)
 #if ENABLE(JIT) && !defined(ENABLE_JIT_OPTIMIZE_NATIVE_CALL)
 #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 1
 #endif
@@ -1105,10 +1111,6 @@ on MinGW. See https://bugs.webkit.org/show_bug.cgi?id=29268 */
 
 #define ENABLE_JSC_ZOMBIES 0
 
-#if !defined(BUILDING_ON_TIGER)
-#define ENABLE_RECURSIVE_PARSE 1
-#endif
-
 /* FIXME: Eventually we should enable this for all platforms and get rid of the define. */
 #if PLATFORM(MAC)
 #define WTF_USE_PLATFORM_STRATEGIES 1
diff --git a/JavaScriptCore/wtf/RefCounted.h b/JavaScriptCore/wtf/RefCounted.h
index 761a856..5aedac3 100644
--- a/JavaScriptCore/wtf/RefCounted.h
+++ b/JavaScriptCore/wtf/RefCounted.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -24,6 +24,9 @@
 #include <wtf/Assertions.h>
 #include <wtf/Noncopyable.h>
 
+// Remove this once we make all WebKit code compatible with stricter rules about RefCounted.
+#define LOOSE_REF_COUNTED
+
 namespace WTF {
 
 // This base class holds the non-template methods and attributes.
@@ -34,6 +37,9 @@ public:
     void ref()
     {
         ASSERT(!m_deletionHasBegun);
+#ifndef LOOSE_REF_COUNTED
+        ASSERT(!m_adoptionIsRequired);
+#endif
         ++m_refCount;
     }
 
@@ -53,18 +59,27 @@ protected:
         : m_refCount(1)
 #ifndef NDEBUG
         , m_deletionHasBegun(false)
+        , m_adoptionIsRequired(true)
 #endif
     {
     }
 
     ~RefCountedBase()
     {
+#ifndef LOOSE_REF_COUNTED
+        ASSERT(m_deletionHasBegun);
+        ASSERT(!m_adoptionIsRequired);
+#endif
     }
 
     // Returns whether the pointer should be freed or not.
     bool derefBase()
     {
         ASSERT(!m_deletionHasBegun);
+#ifndef LOOSE_REF_COUNTED
+        ASSERT(!m_adoptionIsRequired);
+#endif
+
         ASSERT(m_refCount > 0);
         if (m_refCount == 1) {
 #ifndef NDEBUG
@@ -91,17 +106,32 @@ protected:
 #endif
 
 private:
-    template<class T>
-    friend class CrossThreadRefCounted;
+    template<typename T> friend class CrossThreadRefCounted;
+
+#ifndef NDEBUG
+    friend void adopted(RefCountedBase*);
+#endif
 
     int m_refCount;
 #ifndef NDEBUG
     bool m_deletionHasBegun;
+    bool m_adoptionIsRequired;
 #endif
 };
 
+#ifndef NDEBUG
+
+inline void adopted(RefCountedBase* object)
+{
+    if (!object)
+        return;
+    ASSERT(!object->m_deletionHasBegun);
+    object->m_adoptionIsRequired = false;
+}
+
+#endif
 
-template<class T> class RefCounted : public RefCountedBase, public Noncopyable {
+template<typename T> class RefCounted : public RefCountedBase, public Noncopyable {
 public:
     void deref()
     {
@@ -115,7 +145,7 @@ protected:
     }
 };
 
-template<class T> class RefCountedCustomAllocated : public RefCountedBase, public NoncopyableCustomAllocated {
+template<typename T> class RefCountedCustomAllocated : public RefCountedBase, public NoncopyableCustomAllocated {
 public:
     void deref()
     {
diff --git a/JavaScriptCore/wtf/StringExtras.h b/JavaScriptCore/wtf/StringExtras.h
index 8156580..342261b 100644
--- a/JavaScriptCore/wtf/StringExtras.h
+++ b/JavaScriptCore/wtf/StringExtras.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,17 +44,30 @@ inline int snprintf(char* buffer, size_t count, const char* format, ...)
     va_start(args, format);
     result = _vsnprintf(buffer, count, format, args);
     va_end(args);
+
+    // In the case where the string entirely filled the buffer, _vsnprintf will not
+    // null-terminate it, but snprintf must.
+    if (count > 0)
+        buffer[count - 1] = '\0';
+
     return result;
 }
 
-#if COMPILER(MSVC7_OR_LOWER) || OS(WINCE)
-
-inline int vsnprintf(char* buffer, size_t count, const char* format, va_list args)
+inline double wtf_vsnprintf(char* buffer, size_t count, const char* format, va_list args)
 {
-    return _vsnprintf(buffer, count, format, args);
+    int result = _vsnprintf(buffer, count, format, args);
+
+    // In the case where the string entirely filled the buffer, _vsnprintf will not
+    // null-terminate it, but vsnprintf must.
+    if (count > 0)
+        buffer[count - 1] = '\0';
+
+    return result;
 }
 
-#endif
+// Work around a bug in Microsoft's implementation of vsnprintf, where 
+// vsnprintf does not null terminate the buffer
+#define vsnprintf(buffer, count, format, args) wtf_vsnprintf(buffer, count, format, args)
 
 #if OS(WINCE)
 
diff --git a/JavaScriptCore/wtf/efl/MainThreadEfl.cpp b/JavaScriptCore/wtf/efl/MainThreadEfl.cpp
index fe32d1b..8774d20 100644
--- a/JavaScriptCore/wtf/efl/MainThreadEfl.cpp
+++ b/JavaScriptCore/wtf/efl/MainThreadEfl.cpp
@@ -42,7 +42,7 @@ void initializeMainThreadPlatform()
 {
 }
 
-static int timeoutFired(void*)
+static Eina_Bool timeoutFired(void*)
 {
     dispatchFunctionsFromMainThread();
     return ECORE_CALLBACK_CANCEL;
diff --git a/JavaScriptCore/wtf/text/StringImpl.h b/JavaScriptCore/wtf/text/StringImpl.h
index 244009f..a172e2c 100644
--- a/JavaScriptCore/wtf/text/StringImpl.h
+++ b/JavaScriptCore/wtf/text/StringImpl.h
@@ -257,6 +257,37 @@ public:
             memcpy(destination, source, numCharacters * sizeof(UChar));
     }
 
+    PassRefPtr<StringImpl> copyStringWithoutBOMs(bool definitelyHasBOMs, bool& hasBOMs)
+    {
+        static const UChar byteOrderMark = 0xFEFF;
+        size_t i = 0;
+        if (!definitelyHasBOMs) {
+            hasBOMs = false;
+            // ECMA-262 calls for stripping all Cf characters, but we only strip BOM characters.
+            // See <https://bugs.webkit.org/show_bug.cgi?id=4931> for details.
+            for (; i < m_length; i++) {
+                if (UNLIKELY(m_data[i] == byteOrderMark)) {
+                    hasBOMs = true;
+                    break;
+                }
+            }
+            if (!hasBOMs)
+                return this;
+        }
+        Vector<UChar> result;
+        result.reserveInitialCapacity(m_length);
+        size_t firstBOM = i;
+        i = 0;
+        for (; i < firstBOM; i++)
+            result.append(m_data[i]);
+        for (; i < m_length; i++) {
+            UChar c = m_data[i];
+            if (c != byteOrderMark)
+                result.append(c);
+        }
+        return StringImpl::adopt(result);
+    }
+
     // Returns a StringImpl suitable for use on another thread.
     PassRefPtr<StringImpl> crossThreadString();
     // Makes a deep copy. Helpful only if you need to use a String on another thread
diff --git a/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp b/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
index 2df44f8..42f0ff8 100644
--- a/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
+++ b/JavaScriptCore/wtf/unicode/wince/UnicodeWince.cpp
@@ -77,6 +77,11 @@ bool isPunct(wchar_t c)
     return !!iswpunct(c);
 }
 
+bool isAlphanumeric(wchar_t c)
+{
+    return !!iswalnum(c);
+}
+
 int toLower(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError)
 {
     const UChar* sourceIterator = source;
diff --git a/JavaScriptCore/wtf/unicode/wince/UnicodeWince.h b/JavaScriptCore/wtf/unicode/wince/UnicodeWince.h
index 5bed9e8..68da35a 100644
--- a/JavaScriptCore/wtf/unicode/wince/UnicodeWince.h
+++ b/JavaScriptCore/wtf/unicode/wince/UnicodeWince.h
@@ -165,6 +165,7 @@ namespace WTF {
         bool isLower(wchar_t);
         bool isPunct(wchar_t);
         bool isDigit(wchar_t);
+        bool isAlphanumeric(wchar_t);
         inline bool isSeparatorSpace(wchar_t c) { return category(c) == Separator_Space; }
         inline bool isHighSurrogate(wchar_t c) { return (c & 0xfc00) == 0xd800; }
         inline bool isLowSurrogate(wchar_t c) { return (c & 0xfc00) == 0xdc00; }
@@ -183,9 +184,9 @@ namespace WTF {
         unsigned char combiningClass(UChar32);
         DecompositionType decompositionType(UChar32);
         Direction direction(UChar32);
-        inline bool isArabicChar(UChar32)
+        inline bool isArabicChar(UChar32 c)
         {
-            return false; // FIXME: implement!
+            return c >= 0x0600 && c <= 0x06FF;
         }
 
         inline bool hasLineBreakingPropertyComplexContext(UChar32)
diff --git a/JavaScriptCore/yarr/RegexInterpreter.cpp b/JavaScriptCore/yarr/RegexInterpreter.cpp
index 34ccc00..09c82d1 100644
--- a/JavaScriptCore/yarr/RegexInterpreter.cpp
+++ b/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -1554,7 +1554,7 @@ public:
                 }
 
                 case PatternTerm::TypeParentheticalAssertion: {
-                    unsigned alternativeFrameLocation = term.inputPosition + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
+                    unsigned alternativeFrameLocation = term.frameLocation + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
 
                     atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invertOrCapture, term.frameLocation, alternativeFrameLocation);
                     emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
diff --git a/JavaScriptGlue/ChangeLog b/JavaScriptGlue/ChangeLog
index a1f0d48..4dc0cf0 100644
--- a/JavaScriptGlue/ChangeLog
+++ b/JavaScriptGlue/ChangeLog
@@ -1,3 +1,14 @@
+2010-07-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a FixedArray template to encapsulate fixed length arrays
+        https://bugs.webkit.org/show_bug.cgi?id=41506
+
+        Add forwarding header.
+
+        * ForwardingHeaders/wtf/FixedArray.h: Added.
+
 2010-06-02  Gavin Barraclough  <barraclough@apple.com>
 
         Reviewed by Oliver Hunt.
diff --git a/JavaScriptGlue/Configurations/Version.xcconfig b/JavaScriptGlue/Configurations/Version.xcconfig
index f775a54..2749545 100644
--- a/JavaScriptGlue/Configurations/Version.xcconfig
+++ b/JavaScriptGlue/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 2;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/JavaScriptGlue/ForwardingHeaders/wtf/FixedArray.h b/JavaScriptGlue/ForwardingHeaders/wtf/FixedArray.h
new file mode 100644
index 0000000..cc9f599
--- /dev/null
+++ b/JavaScriptGlue/ForwardingHeaders/wtf/FixedArray.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/FixedArray.h>
diff --git a/LayoutTests/storage/open-database-creation-callback.html b/LayoutTests/storage/open-database-creation-callback.html
index ac24942..081645c 100644
--- a/LayoutTests/storage/open-database-creation-callback.html
+++ b/LayoutTests/storage/open-database-creation-callback.html
@@ -26,7 +26,8 @@ function runTest()
 
     // Open a new database with a creation callback, and make sure the creation callback is queued
     var creationCallbackCalled1 = false;
-    var db1 = openDatabase("OpenDatabaseCreationCallback1", "1.0", "", 1,
+    var db1Name = "OpenDatabaseCreationCallback1" + (new Date()).getTime();
+    var db1 = openDatabase(db1Name, "1.0", "", 1,
                            function(db) {
                                creationCallbackCalled1 = true;
                                if (db.version != "") {
@@ -52,7 +53,7 @@ function runTest()
     // a null handle and throw a INVALID_STATE_ERR exception.
     var db1Fail = null;
     try {
-        db1Fail = openDatabase("OpenDatabaseCreationCallback1", "1.0", "", 1);
+        db1Fail = openDatabase(db1Name, "1.0", "", 1);
         log("This statement should not have been executed; an INVALID_STATE_ERR exception should've been thrown.");
         finishTest();
     } catch(err) {
diff --git a/LayoutTests/storage/sql-error-codes.js b/LayoutTests/storage/sql-error-codes.js
index 9d6f6d3..2d2c97c 100644
--- a/LayoutTests/storage/sql-error-codes.js
+++ b/LayoutTests/storage/sql-error-codes.js
@@ -64,17 +64,10 @@ function testBindParameterOfWrongType(db)
     var badString = { };
     badString.toString = function() { throw "Cannot call toString() on this object." };
 
-    // JSC will throw an exception when calling badString.toString(). V8 will catch it.
-    // So we run this transaction using a custom success callback.
-    db.transaction(function(tx) {
+    testTransaction(db, function(tx) {
         tx.executeSql("CREATE TABLE IF NOT EXISTS BadBindTypeTest (Foo TEXT)");
         tx.executeSql("INSERT INTO BadBindTypeTest VALUES (?)", [badString]);
-    }, function(error) {
-        transactionErrorCallback(error, "UNKNOWN_ERR");
-    }, function() {
-        log("The transaction in testBindParameterOfWrongType() was successful.");
-        testsRun++;
-    });
+    }, "UNKNOWN_ERR");
 }
 
 function testQuotaExceeded(db)
diff --git a/WebCore/Android.derived.jscbindings.mk b/WebCore/Android.derived.jscbindings.mk
index 130b0c4..799c41d 100644
--- a/WebCore/Android.derived.jscbindings.mk
+++ b/WebCore/Android.derived.jscbindings.mk
@@ -446,6 +446,7 @@ GEN := \
     $(intermediates)/svg/JSSVGFEColorMatrixElement.h \
     $(intermediates)/svg/JSSVGFEComponentTransferElement.h \
     $(intermediates)/svg/JSSVGFECompositeElement.h \
+    $(intermediates)/svg/JSSVGFEConvolveMatrixElement.h \
     $(intermediates)/svg/JSSVGFEDiffuseLightingElement.h \
     $(intermediates)/svg/JSSVGFEDisplacementMapElement.h \
     $(intermediates)/svg/JSSVGFEDistantLightElement.h \
diff --git a/WebCore/Android.derived.v8bindings.mk b/WebCore/Android.derived.v8bindings.mk
index b5c3ada..45d8de4 100644
--- a/WebCore/Android.derived.v8bindings.mk
+++ b/WebCore/Android.derived.v8bindings.mk
@@ -429,6 +429,7 @@ GEN += \
     $(intermediates)/bindings/V8SVGFEColorMatrixElement.h \
     $(intermediates)/bindings/V8SVGFEComponentTransferElement.h \
     $(intermediates)/bindings/V8SVGFECompositeElement.h \
+    $(intermediates)/bindings/V8SVGFEConvolveMatrixElement.h \
     $(intermediates)/bindings/V8SVGFEDiffuseLightingElement.h \
     $(intermediates)/bindings/V8SVGFEDisplacementMapElement.h \
     $(intermediates)/bindings/V8SVGFEDistantLightElement.h \
diff --git a/WebCore/Android.jscbindings.mk b/WebCore/Android.jscbindings.mk
index c6feb26..56c8908 100644
--- a/WebCore/Android.jscbindings.mk
+++ b/WebCore/Android.jscbindings.mk
@@ -113,7 +113,6 @@ LOCAL_SRC_FILES += \
 	bindings/js/JSHTMLFormElementCustom.cpp \
 	bindings/js/JSHTMLFrameElementCustom.cpp \
 	bindings/js/JSHTMLFrameSetElementCustom.cpp \
-	bindings/js/JSHTMLIFrameElementCustom.cpp \
 	bindings/js/JSHTMLInputElementCustom.cpp \
 	bindings/js/JSHTMLObjectElementCustom.cpp \
 	bindings/js/JSHTMLOptionsCollectionCustom.cpp \
diff --git a/WebCore/Android.mk b/WebCore/Android.mk
index bd6765d..1475fca 100644
--- a/WebCore/Android.mk
+++ b/WebCore/Android.mk
@@ -118,9 +118,11 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/ContainerNode.cpp \
 	dom/CustomEvent.cpp \
 	dom/DOMImplementation.cpp \
-        dom/DOMStringList.cpp \
+	dom/DOMStringList.cpp \
+	dom/DecodedDataDocumentParser.cpp \
 	dom/Document.cpp \
 	dom/DocumentFragment.cpp \
+	dom/DocumentParser.cpp \
 	dom/DocumentType.cpp \
 	dom/DynamicNodeList.cpp \
 	dom/EditingText.cpp \
@@ -163,6 +165,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/QualifiedName.cpp \
 	dom/Range.cpp \
 	dom/RegisteredEventListener.cpp \
+	dom/ScriptableDocumentParser.cpp \
 	dom/ScriptElement.cpp \
 	dom/ScriptExecutionContext.cpp \
 	dom/SelectElement.cpp \
@@ -273,6 +276,8 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	html/HTMLDocument.cpp \
 	html/HTMLDocumentParser.cpp \
 	html/HTMLElementsAllInOne.cpp \
+	html/HTMLElementStack.cpp \
+	html/HTMLFormattingElementList.cpp \
 	html/HTMLFormCollection.cpp \
 	html/HTMLImageLoader.cpp \
 	html/HTMLNameCollection.cpp \
@@ -378,12 +383,14 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	page/Location.cpp \
 	page/MemoryInfo.cpp \
 	page/MouseEventWithHitTestResults.cpp \
+	page/Navigation.cpp \
 	page/Navigator.cpp \
 	page/NavigatorBase.cpp \
 	page/OriginAccessEntry.cpp \
 	page/Page.cpp \
 	page/PageGroup.cpp \
 	page/PageGroupLoadDeferrer.cpp \
+	page/Performance.cpp \
 	page/PluginHalter.cpp \
 	page/PrintContext.cpp \
 	page/Screen.cpp \
@@ -391,6 +398,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	page/Settings.cpp \
 	page/SpatialNavigation.cpp \
 	page/SuspendableTimer.cpp \
+	page/Timing.cpp \
 	page/UserContentURLPattern.cpp \
 	page/WindowFeatures.cpp \
 	page/WorkerNavigator.cpp \
@@ -854,6 +862,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	svg/SVGFEColorMatrixElement.cpp \
 	svg/SVGFEComponentTransferElement.cpp \
 	svg/SVGFECompositeElement.cpp \
+	svg/SVGFEConvolveMatrixElement.cpp \
 	svg/SVGFEDiffuseLightingElement.cpp \
 	svg/SVGFEDisplacementMapElement.cpp \
 	svg/SVGFEDistantLightElement.cpp \
diff --git a/WebCore/Android.v8bindings.mk b/WebCore/Android.v8bindings.mk
index 30a49c7..9eda878 100644
--- a/WebCore/Android.v8bindings.mk
+++ b/WebCore/Android.v8bindings.mk
@@ -136,7 +136,6 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8HTMLFormElementCustom.cpp \
 	bindings/v8/custom/V8HTMLFrameElementCustom.cpp \
 	bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp \
-	bindings/v8/custom/V8HTMLIFrameElementCustom.cpp \
 	bindings/v8/custom/V8HTMLImageElementConstructor.cpp \
 	bindings/v8/custom/V8HTMLInputElementCustom.cpp \
 	bindings/v8/custom/V8HTMLOptionElementConstructor.cpp \
diff --git a/WebCore/CMakeLists.txt b/WebCore/CMakeLists.txt
index ad93634..c8fdde5 100644
--- a/WebCore/CMakeLists.txt
+++ b/WebCore/CMakeLists.txt
@@ -145,6 +145,7 @@ SET(WebCore_IDL_FILES
     dom/DOMCoreException.idl
     dom/DOMImplementation.idl
     dom/DOMStringList.idl
+    dom/DOMStringMap.idl
     dom/Element.idl
     dom/Entity.idl
     dom/EntityReference.idl
@@ -309,9 +310,12 @@ SET(WebCore_IDL_FILES
     page/History.idl
     page/Location.idl
     page/MemoryInfo.idl
+    page/Navigation.idl
     page/Navigator.idl
+    page/Performance.idl
     page/PositionError.idl
     page/Screen.idl
+    page/Timing.idl
     page/WebKitPoint.idl
     page/WorkerNavigator.idl
 
@@ -411,6 +415,7 @@ IF (ENABLE_SVG)
         svg/SVGFEColorMatrixElement.idl
         svg/SVGFEComponentTransferElement.idl
         svg/SVGFECompositeElement.idl
+        svg/SVGFEConvolveMatrixElement.idl
         svg/SVGFEDiffuseLightingElement.idl
         svg/SVGFEDisplacementMapElement.idl
         svg/SVGFEDistantLightElement.idl
@@ -580,6 +585,7 @@ SET(WebCore_SOURCES
     bindings/js/JSDOMBinding.cpp
     bindings/js/JSDOMFormDataCustom.cpp
     bindings/js/JSDOMGlobalObject.cpp
+    bindings/js/JSDOMStringMapCustom.cpp
     bindings/js/JSDOMWindowBase.cpp
     bindings/js/JSDOMWindowCustom.cpp
     bindings/js/JSDOMWindowShell.cpp
@@ -603,7 +609,6 @@ SET(WebCore_SOURCES
     bindings/js/JSHTMLFormElementCustom.cpp
     bindings/js/JSHTMLFrameElementCustom.cpp
     bindings/js/JSHTMLFrameSetElementCustom.cpp
-    bindings/js/JSHTMLIFrameElementCustom.cpp
     bindings/js/JSHTMLInputElementCustom.cpp
     bindings/js/JSHTMLObjectElementCustom.cpp
     bindings/js/JSHTMLOptionsCollectionCustom.cpp
@@ -752,9 +757,8 @@ SET(WebCore_SOURCES
     dom/Attribute.cpp
     dom/BeforeTextInsertedEvent.cpp
     dom/BeforeUnloadEvent.cpp
-    dom/CDATASection.cpp
-    dom/CSSMappedAttributeDeclaration.cpp
     dom/CanvasSurface.cpp
+    dom/CDATASection.cpp
     dom/CharacterData.cpp
     dom/CheckedRadioButtons.cpp
     dom/ChildNodeList.cpp
@@ -766,14 +770,19 @@ SET(WebCore_SOURCES
     dom/Comment.cpp
     dom/CompositionEvent.cpp
     dom/ContainerNode.cpp
+    dom/CSSMappedAttributeDeclaration.cpp
     dom/CustomEvent.cpp
-    dom/DOMImplementation.cpp
-    dom/DOMStringList.cpp
+    dom/DatasetDOMStringMap.cpp
+    dom/DecodedDataDocumentParser.cpp
     dom/DeviceOrientation.cpp
     dom/DeviceOrientationEvent.cpp
     dom/Document.cpp
     dom/DocumentFragment.cpp
+    dom/DocumentParser.cpp
     dom/DocumentType.cpp
+    dom/DOMImplementation.cpp
+    dom/DOMStringList.cpp
+    dom/DOMStringMap.cpp
     dom/DynamicNodeList.cpp
     dom/EditingText.cpp
     dom/Element.cpp
@@ -789,16 +798,16 @@ SET(WebCore_SOURCES
     dom/KeyboardEvent.cpp
     dom/MessageChannel.cpp
     dom/MessageEvent.cpp
-    dom/MessagePort.cpp
     dom/MessagePortChannel.cpp
+    dom/MessagePort.cpp
     dom/MouseEvent.cpp
     dom/MouseRelatedEvent.cpp
     dom/MutationEvent.cpp
-    dom/NameNodeList.cpp
     dom/NamedNodeMap.cpp
+    dom/NameNodeList.cpp
     dom/Node.cpp
-    dom/NodeFilter.cpp
     dom/NodeFilterCondition.cpp
+    dom/NodeFilter.cpp
     dom/NodeIterator.cpp
     dom/Notation.cpp
     dom/OptionElement.cpp
@@ -813,6 +822,7 @@ SET(WebCore_SOURCES
     dom/QualifiedName.cpp
     dom/Range.cpp
     dom/RegisteredEventListener.cpp
+    dom/ScriptableDocumentParser.cpp
     dom/ScriptElement.cpp
     dom/ScriptExecutionContext.cpp
     dom/SelectElement.cpp
@@ -820,8 +830,8 @@ SET(WebCore_SOURCES
     dom/SpaceSplitString.cpp
     dom/StaticHashSetNodeList.cpp
     dom/StaticNodeList.cpp
-    dom/StyleElement.cpp
     dom/StyledElement.cpp
+    dom/StyleElement.cpp
     dom/TagNodeList.cpp
     dom/Text.cpp
     dom/TextEvent.cpp
@@ -935,8 +945,10 @@ SET(WebCore_SOURCES
     html/HTMLDivElement.cpp
     html/HTMLDocument.cpp
     html/HTMLElement.cpp
+    html/HTMLElementStack.cpp
     html/HTMLEmbedElement.cpp
     html/HTMLFieldSetElement.cpp
+    html/HTMLFormattingElementList.cpp
     html/HTMLFontElement.cpp
     html/HTMLFormCollection.cpp
     html/HTMLFormControlElement.cpp
@@ -1112,12 +1124,14 @@ SET(WebCore_SOURCES
     page/Location.cpp
     page/MemoryInfo.cpp
     page/MouseEventWithHitTestResults.cpp
+    page/Navigation.cpp
     page/Navigator.cpp
     page/NavigatorBase.cpp
     page/OriginAccessEntry.cpp
     page/Page.cpp
     page/PageGroup.cpp
     page/PageGroupLoadDeferrer.cpp
+    page/Performance.cpp
     page/PluginHalter.cpp
     page/PrintContext.cpp
     page/Screen.cpp
@@ -1125,6 +1139,7 @@ SET(WebCore_SOURCES
     page/Settings.cpp
     page/SpatialNavigation.cpp
     page/SuspendableTimer.cpp
+    page/Timing.cpp
     page/UserContentURLPattern.cpp
     page/WindowFeatures.cpp
     page/WorkerNavigator.cpp
@@ -1553,6 +1568,7 @@ IF (ENABLE_SVG)
         svg/SVGFEColorMatrixElement.cpp
         svg/SVGFEComponentTransferElement.cpp
         svg/SVGFECompositeElement.cpp
+        svg/SVGFEConvolveMatrixElement.cpp
         svg/SVGFEDiffuseLightingElement.cpp
         svg/SVGFEDisplacementMapElement.cpp
         svg/SVGFEDistantLightElement.cpp
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index 8ab39c5..c27e3b2 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,6113 @@
+2010-07-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Joseph Pecoraro.
+
+        Web Inspector: preserve scroll positions in source frame when switching between panes.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41620
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.hide):
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.set visible):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.hide):
+
+2010-07-05  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Dirk Schulze.
+
+        IE SVG test fails
+        https://bugs.webkit.org/show_bug.cgi?id=41619
+
+        Make SVGSVGElement.createSVGTransform create a SVGTransform with the
+        right type, thereby fixing the IE test.
+
+        Test: svg/custom/svg-createsvgtransform-type.html
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::createSVGTransform):
+
+2010-07-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: computed style pane is not updated when styles pane is collapsed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41615
+
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel.prototype.updateStyles):
+
+2010-07-05  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Logic to track whether elements are using relative lengths is incomplete
+        https://bugs.webkit.org/show_bug.cgi?id=41566
+
+        Add logic to all SVG elements which create renderes to expose a method
+        "bool selfHasRelativeLengths()", that returns whether the element uses relative
+        lengths (eg. <rect x="50%"...). This will be used soon to avoid relayouts of
+        container children, when the bounds have not changed.
+
+        A new method SVGStyledElement::updateRelativeLengthsInformation() is added,
+        which is called from the various svgAttributeChanged() methods and insertedIntoDocument/removedFromDocument.
+        It will be implemented in a follow-up patch. This patch does not affect any test behaviour related
+        to relayouting. As SVGFilterElement finally got a proper svgAttributeChanged() method, it now
+        properly invalidates clients on attribute changes - covered by a new test.
+
+        Tests: svg/custom/relative-sized-inner-svg.xhtml
+               svg/custom/relative-sized-use-without-attributes-on-symbol.xhtml
+               svg/filters/filter-width-update.svg
+ 
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::layout): Rename hasRelativeValues to hasRelativeLengths.
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout): Ditto.
+        (WebCore::RenderSVGRoot::calcViewport): Ditto.
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::calcViewport): Ditto
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::layoutChildren): Ditto.
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::svgAttributeChanged): Call updateRelativeLengthsInformation() if any attribute which may contain relative lengths changes.
+        (WebCore::SVGCircleElement::selfHasRelativeLengths): Ditto. Same for all other SVG*Elements below.
+        * svg/SVGCircleElement.h:
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::svgAttributeChanged):
+        (WebCore::SVGEllipseElement::selfHasRelativeLengths):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGFilterElement.cpp:
+        (WebCore::SVGFilterElement::svgAttributeChanged):
+        (WebCore::SVGFilterElement::selfHasRelativeLengths):
+        * svg/SVGFilterElement.h:
+        * svg/SVGForeignObjectElement.cpp:
+        (WebCore::SVGForeignObjectElement::svgAttributeChanged):
+        (WebCore::SVGForeignObjectElement::selfHasRelativeLengths):
+        * svg/SVGForeignObjectElement.h:
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::svgAttributeChanged):
+        (WebCore::SVGImageElement::selfHasRelativeLengths):
+        * svg/SVGImageElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::svgAttributeChanged):
+        (WebCore::SVGLineElement::selfHasRelativeLengths):
+        * svg/SVGLineElement.h:
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::svgAttributeChanged):
+        (WebCore::SVGLinearGradientElement::selfHasRelativeLengths):
+        * svg/SVGLinearGradientElement.h:
+        * svg/SVGMarkerElement.cpp:
+        (WebCore::SVGMarkerElement::svgAttributeChanged):
+        (WebCore::SVGMarkerElement::selfHasRelativeLengths):
+        * svg/SVGMarkerElement.h:
+        * svg/SVGMaskElement.cpp:
+        (WebCore::SVGMaskElement::svgAttributeChanged):
+        (WebCore::SVGMaskElement::selfHasRelativeLengths):
+        * svg/SVGMaskElement.h:
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::svgAttributeChanged):
+        (WebCore::SVGPatternElement::selfHasRelativeLengths):
+        * svg/SVGPatternElement.h:
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::svgAttributeChanged):
+        (WebCore::SVGRadialGradientElement::selfHasRelativeLengths):
+        * svg/SVGRadialGradientElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::svgAttributeChanged):
+        (WebCore::SVGRectElement::selfHasRelativeLengths):
+        * svg/SVGRectElement.h:
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::svgAttributeChanged):
+        (WebCore::SVGSVGElement::selfHasRelativeLengths):
+        * svg/SVGSVGElement.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::insertedIntoDocument): Call updateRelativeLengthsInformation().
+        (WebCore::SVGStyledElement::removedFromDocument): Ditto.
+        (WebCore::SVGStyledElement::updateRelativeLengthsInformation): Not implemented so far. Will land in a follow-up patch, together with the render tree changes.
+        * svg/SVGStyledElement.h:
+        (WebCore::SVGStyledElement::hasRelativeLengths): Devirtualized. For now, just call selfHasRelativeLengths() - this will change in a follow-up patch.
+        (WebCore::SVGStyledElement::updateRelativeLengthsInformation):
+        (WebCore::SVGStyledElement::selfHasRelativeLengths): Renamed from hasRelativeValues().
+        * svg/SVGSymbolElement.cpp:
+        (WebCore::SVGSymbolElement::svgAttributeChanged):
+        (WebCore::SVGSymbolElement::selfHasRelativeLengths):
+        * svg/SVGSymbolElement.h:
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::selfHasRelativeLengths):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::svgAttributeChanged):
+        (WebCore::SVGTextPathElement::insertedIntoDocument): Call right base class' method. Skipped one in the hierachy before.
+        (WebCore::SVGTextPathElement::selfHasRelativeLengths):
+        * svg/SVGTextPathElement.h:
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::svgAttributeChanged):
+        (WebCore::listContainsRelativeValue): New helper funtion that checks wheter a SVGLengthList contains relative lengths.
+        (WebCore::SVGTextPositioningElement::selfHasRelativeLengths):
+        * svg/SVGTextPositioningElement.h:
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::insertedIntoDocument): Call right base class' method. Skipped on in the hierachy before.
+        (WebCore::SVGUseElement::removedFromDocument): Ditto.
+        (WebCore::SVGUseElement::svgAttributeChanged):
+        (WebCore::SVGUseElement::buildShadowAndInstanceTree): Call updateRelativeLengthsInformation() after building the shadow tree.
+        (WebCore::SVGUseElement::selfHasRelativeLengths): Same as all other methods, except that it includes the shadow tree root element.
+        * svg/SVGUseElement.h:
+
+2010-07-05  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Problem with copying a code from Scripts panel.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40432
+
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype._getSelection):
+        (WebInspector.TextViewer.prototype._selectionToPosition):
+
+2010-07-05  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze / Darin Adler.
+
+        Node.cloneNode does not work on SVG nodes
+        https://bugs.webkit.org/show_bug.cgi?id=41421
+
+        Be sure to synchronize animated SVG properties before checking whether NamedNodeMap exists.
+        When creating a SVG element from JS, and setting all attributes via SVG DOM, and not using setAttribute
+        the NamedNodeMap does not exist. When cloning such an element, be sure to synchronize SVG <-> XML DOM
+        attributes before attempting to clone, otherwhise the SVG animated properties are lost while cloning.
+
+        Test: svg/custom/clone-element-with-animated-svg-properties.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::cloneElementWithoutChildren):
+
+2010-07-05  Antti Koivisto  <koivisto@iki.fi>
+
+        Revert unplanned project file change.
+
+        * WebCore.pri:
+        * WebCore.pro:
+
+2010-07-05  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Memory corruption with SVG <use> element
+        https://bugs.webkit.org/show_bug.cgi?id=40994
+
+        Fix race condition in svgAttributeChanged. Never call svgAttributeChanged() from attributeChanged()
+        when we're synchronizing SVG attributes. It leads to either unnecessary extra work being done or
+        crashes. Especially together with <polyline>/<polygon> which always synchronize the SVGAnimatedPoints
+        datastructure with the points attribute, no matter if there are changes are not. This should be
+        furhter optimized, but this fix is sane and fixes the root of the evil races.
+
+        Test: svg/custom/use-property-synchronization-crash.svg
+
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::attributeChanged):
+
+2010-07-05  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [v8] Web Inspector: remove v8-specific code dealing with getOwnPropertyNames from InjectedScript.js
+        https://bugs.webkit.org/show_bug.cgi?id=41595
+
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor):
+
+2010-07-04  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Dirk Schulze.
+
+        SVG polygons should draw polygons up to the first parsing error
+        https://bugs.webkit.org/show_bug.cgi?id=41140
+
+        Render polygons up until the first parsing error.
+
+        Test: svg/custom/poly-parsing-error.html
+
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::parseMappedAttribute):
+
+2010-07-04  Alice Liu  <alice.liu@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Crash reading past end of block in UniscribeController::shapeAndPlaceItem
+        https://bugs.webkit.org/show_bug.cgi?id=41554
+
+        Test: platform/win/fast/text/uniscribe-item-boundary-crash.html
+
+        * platform/graphics/win/UniscribeController.cpp:
+        (WebCore::UniscribeController::shapeAndPlaceItem):
+        Don't look one past the end of str. Instead look to the next item, if applicable.
+
+2010-07-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add basic "in table body" mode to support <tr> insertion
+        https://bugs.webkit.org/show_bug.cgi?id=41587
+
+        This also adds a (currently untestable?)
+        popUntilTableBodyScopeMarker code path.
+        Any tags which would be between a tbody a <tr> would end up
+        foster parented outside the <table>.  I think the spec was
+        just being over-cautious with popUntilTableBodyScopeMarker.
+
+        * html/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isTableScopeMarker):
+        (WebCore::HTMLNames::isTableBodyScopeMarker):
+        (WebCore::HTMLElementStack::popUntilTableBodyScopeMarker):
+        * html/HTMLElementStack.h:
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+
+2010-07-04  Anders Carlsson  <andersca@apple.com>
+
+        Fix Windows build.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-07-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        HTMLTreeBuilder needs an adoption agency
+        https://bugs.webkit.org/show_bug.cgi?id=41453
+
+        Fix Qt Minimal build.  SVGNames.h should always
+        be generated, even when SVG is off, however that's
+        not how things currently work.
+
+        * html/HTMLTreeBuilder.cpp:
+
+2010-07-04  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add a very basic InTable insertion mode
+        https://bugs.webkit.org/show_bug.cgi?id=41581
+
+        There is still a bunch of low-hanging fruit left for this
+        mode, but even this most-basic support lets us pass 6 more tests. :)
+
+        It's a progression, ship it! :)
+
+        * html/HTMLElementStack.cpp:
+        (WebCore::HTMLNames::isScopeMarker):
+        (WebCore::HTMLNames::isListItemScopeMarker):
+        (WebCore::HTMLNames::isTableScopeMarker):
+        (WebCore::HTMLElementStack::popUntilTableScopeMarker):
+        * html/HTMLElementStack.h:
+        * html/HTMLFormattingElementList.cpp:
+        (WebCore::HTMLFormattingElementList::appendMarker):
+        * html/HTMLFormattingElementList.h:
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        * html/HTMLTreeBuilder.h:
+
+2010-07-01  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        HTMLTreeBuilder needs an adoption agency
+        https://bugs.webkit.org/show_bug.cgi?id=41453
+
+        This changes some test results, but only makes the simplest
+        adoption agency cases pass.  I think the code is likely
+        very close, but further iteration to make this change larger
+        seems counter-productive.  I recommend we check in this
+        progression and work from here.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::addChildCommon):
+         - Make sure callers don't assume this will reparent.
+        (WebCore::ContainerNode::parserAddChild):
+         - Update comment to document lack of reparenting behavior.
+        * html/HTMLElementStack.cpp:
+        (WebCore::HTMLElementStack::ElementRecord::ElementRecord):
+        (WebCore::HTMLElementStack::ElementRecord::~ElementRecord):
+        (WebCore::HTMLElementStack::ElementRecord::replaceElement):
+        (WebCore::HTMLElementStack::ElementRecord::isAbove):
+         - Added for debugging.
+        (WebCore::HTMLElementStack::pushHTMLHtmlElement):
+        (WebCore::HTMLElementStack::insertAbove):
+         - Needed for the adoption agency.
+        (WebCore::HTMLElementStack::topRecord):
+        (WebCore::HTMLElementStack::bottom):
+        (WebCore::HTMLElementStack::removeHTMLHeadElement):
+        (WebCore::HTMLElementStack::remove):
+        (WebCore::HTMLElementStack::find):
+        (WebCore::HTMLElementStack::topmost):
+        (WebCore::HTMLElementStack::contains):
+        (WebCore::HTMLElementStack::htmlElement):
+        (WebCore::HTMLElementStack::headElement):
+        (WebCore::HTMLElementStack::bodyElement):
+        (WebCore::HTMLElementStack::pushCommon):
+        (WebCore::HTMLElementStack::removeNonTopCommon):
+         - Fix the name to match top/bottom.
+        * html/HTMLElementStack.h:
+        (WebCore::HTMLElementStack::ElementRecord::element):
+        (WebCore::HTMLElementStack::ElementRecord::next):
+        (WebCore::HTMLElementStack::ElementRecord::releaseNext):
+        (WebCore::HTMLElementStack::ElementRecord::setNext):
+        * html/HTMLFormattingElementList.cpp:
+        (WebCore::HTMLFormattingElementList::closestElementInScopeWithName):
+        (WebCore::HTMLFormattingElementList::contains):
+        (WebCore::HTMLFormattingElementList::find):
+        (WebCore::HTMLFormattingElementList::remove):
+        * html/HTMLFormattingElementList.h:
+        (WebCore::HTMLFormattingElementList::isEmpty):
+        (WebCore::HTMLFormattingElementList::size):
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::furthestBlockForFormattingElement):
+         - Part of the Adoption Agency algorithm.
+        (WebCore::HTMLTreeBuilder::findFosterParentFor):
+         - Used to move mis-nested content out of tables.
+           This doesn't seem to work quite right yet.
+        (WebCore::HTMLTreeBuilder::reparentChildren):
+        (WebCore::HTMLTreeBuilder::callTheAdoptionAgency):
+         - The ridiculously long/complicated adoption agency algorithm from HTML5.
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        * html/HTMLTreeBuilder.h:
+
+2010-07-04  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove custom src bindings for HTMLFrameElement and HTMLIFrameElement
+        https://bugs.webkit.org/show_bug.cgi?id=41578
+
+        Remove bindings obsoleted by: http://trac.webkit.org/changeset/59866
+        No new tests because behavior is not changed.
+
+        * Android.jscbindings.mk:
+        * Android.v8bindings.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        * bindings/js/JSHTMLIFrameElementCustom.cpp: Removed.
+        * bindings/v8/custom/V8HTMLFrameElementCustom.cpp:
+        * bindings/v8/custom/V8HTMLIFrameElementCustom.cpp: Removed.
+        * html/HTMLFrameElement.idl:
+        * html/HTMLIFrameElement.idl:
+
+2010-07-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        Implement AfterAfterFramesetMode
+        https://bugs.webkit.org/show_bug.cgi?id=41561
+
+        This mode is almost unobservable.  The main way to observe it seems to
+        be seeing where comment nodes get attached to the DOM.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processComment):
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+
+2010-07-03  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        WebGLRenderingContext::vertexAttrib* leads to possible out-of-range vector member visit
+        https://bugs.webkit.org/show_bug.cgi?id=41572
+
+        * html/canvas/WebGLRenderingContext.cpp: Fix the out-of-range vector member visit, also refactor the code.
+        (WebCore::WebGLRenderingContext::vertexAttrib1f):
+        (WebCore::WebGLRenderingContext::vertexAttrib1fv):
+        (WebCore::WebGLRenderingContext::vertexAttrib2f):
+        (WebCore::WebGLRenderingContext::vertexAttrib2fv):
+        (WebCore::WebGLRenderingContext::vertexAttrib3f):
+        (WebCore::WebGLRenderingContext::vertexAttrib3fv):
+        (WebCore::WebGLRenderingContext::vertexAttrib4f):
+        (WebCore::WebGLRenderingContext::vertexAttrib4fv):
+        (WebCore::WebGLRenderingContext::vertexAttribfImpl):
+        (WebCore::WebGLRenderingContext::vertexAttribfvImpl):
+        * html/canvas/WebGLRenderingContext.h: Helper function declaration.
+
+2010-07-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Ugh.  Have to put the destructor in the .h file since the .ccp isn't compiled yet.
+
+        * storage/IDBKey.h:
+        (WebCore::IDBKey::~IDBKey):
+
+2010-07-03  Jeremy Orlow  <jorlow@chromium.org>
+
+        Build fix.  Forgot destructor.
+
+        * storage/IDBKey.cpp:
+        (WebCore::IDBKey::~IDBKey):
+
+2010-06-26  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Dumitru Daniliuc.
+
+        Support for keys and in-memory storage for IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=41252
+
+        It'll take some time to get data persistence working for IndexedDB,
+        so until then, we'll just store everything in an in memory tree.
+        The tree uses WTF::AVLTree and is a template so that it can be used by
+        object stores (IDBKey -> SerializedScriptValue) and indexes (IDBKey ->
+        IDBKey).  This class will be used in a subsequent patch.
+
+        Also add an IDBKey type that represents one of these keys.  We use a
+        custom toJS function in a way similar to IDBAny to convert from WebCore
+        to a JS value.  For converting the other way, we have to teach the code
+        generators what to do (unfortunately).  This is done in a way similar
+        to serialized script value.  Unlike serialized script value, IDBKey is
+        in WebCore and only a helper function is JS engine specific.
+
+        This code is not accessable from layout tests.  (Will fix in
+        https://bugs.webkit.org/show_bug.cgi?id=41250)  The bindings tests
+        show us that the generated bindings are what we expect.
+
+        * ForwardingHeaders/wtf/AVLTree.h: Added.
+        * bindings/js/IDBBindingUtilities.cpp: Added.
+        (WebCore::createIDBKeyFromValue):
+        * bindings/js/IDBBindingUtilities.h: Added.
+        * bindings/js/JSIDBKeyCustom.cpp: Added.
+        (WebCore::toJS):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/scripts/test/CPP/WebDOMTestObj.cpp:
+        (WebDOMTestObj::idbKey):
+        * bindings/scripts/test/CPP/WebDOMTestObj.h:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+        (webkit_dom_test_obj_idb_key):
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.h:
+        * bindings/scripts/test/JS/JSTestObj.cpp:
+        (WebCore::):
+        (WebCore::jsTestObjPrototypeFunctionIdbKey):
+        * bindings/scripts/test/JS/JSTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.h:
+        * bindings/scripts/test/ObjC/DOMTestObj.mm:
+        (-[DOMTestObj idbKey:]):
+        * bindings/scripts/test/TestObj.idl:
+        * bindings/scripts/test/V8/V8TestObj.cpp:
+        (WebCore::TestObjInternal::idbKeyCallback):
+        (WebCore::):
+        * bindings/v8/IDBBindingUtilities.cpp: Added.
+        (WebCore::createIDBKeyFromValue):
+        * bindings/v8/IDBBindingUtilities.h: Added.
+        * bindings/v8/custom/V8IDBKeyCustom.cpp: Added.
+        (WebCore::toV8):
+        * storage/IDBCallbacks.h:
+        * storage/IDBKey.cpp: Added.
+        (WebCore::IDBKey::IDBKey):
+        (WebCore::IDBKey::~IDBKey):
+        * storage/IDBKey.h: Added.
+        (WebCore::IDBKey::create):
+        (WebCore::IDBKey::):
+        (WebCore::IDBKey::type):
+        (WebCore::IDBKey::string):
+        (WebCore::IDBKey::number):
+        * storage/IDBKey.idl: Added.
+        * storage/IDBKeyTree.h: Added.
+        (WebCore::IDBKeyTree::create):
+        (WebCore::IDBKeyTree::AVLTreeAbstractor::get_less):
+        (WebCore::IDBKeyTree::AVLTreeAbstractor::set_less):
+        (WebCore::IDBKeyTree::AVLTreeAbstractor::get_greater):
+        (WebCore::IDBKeyTree::AVLTreeAbstractor::set_greater):
+        (WebCore::IDBKeyTree::AVLTreeAbstractor::get_balance_factor):
+        (WebCore::IDBKeyTree::AVLTreeAbstractor::set_balance_factor):
+        (WebCore::IDBKeyTree::AVLTreeAbstractor::null):
+        (WebCore::IDBKeyTree::AVLTreeAbstractor::compare_key_node):
+        (WebCore::IDBKeyTree::AVLTreeAbstractor::compare_node_node):
+        (WebCore::::IDBKeyTree):
+        (WebCore::::~IDBKeyTree):
+        (WebCore::::AVLTreeAbstractor::compare_key_key):
+        (WebCore::::get):
+        (WebCore::::insert):
+        (WebCore::::remove):
+
+2010-07-03  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        The missing plug-in indicator should be clickable
+
+        https://bugs.webkit.org/show_bug.cgi?id=41550
+        <rdar://problem/8132162>
+
+        From an original patch by Kevin Decker.
+
+        Reviewed by Darin Adler.
+
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::defaultEventHandler):
+        If the renderer is a RenderEmbeddedWidget showing the missing plug-in
+        indicator, and the event is a click even, call the ChromeClient's
+        missingPluginButtonClicked() function.
+
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::missingPluginButtonClicked):
+        Declare missingPluginButtonClicked(), and stub the default
+        implementation.
+
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::RenderEmbeddedObject):
+        Initialize m_showsMissingPluginIndicator.
+        (WebCore::RenderEmbeddedObject::setShowsMissingPluginIndicator):
+        Assert that we're not currently showing any replacement text. Set
+        m_showsMissingPluginIndicator after setting the replacement text.
+        (WebCore::RenderEmbeddedObject::setShowsCrashedPluginIndicator):
+        Add the same assert as above.
+
+        * rendering/RenderEmbeddedObject.h:
+        (WebCore::RenderEmbeddedObject::showsMissingPluginIndicator):
+        Getter for m_showsMissingPluginIndicator.
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Move BOM handling out of the lexer and parser
+        https://bugs.webkit.org/show_bug.cgi?id=41539
+
+        Update WebCore to ensure that SourceProviders don't
+        produce strings with BOMs in them.
+
+        * bindings/js/ScriptSourceProvider.h:
+        (WebCore::ScriptSourceProvider::ScriptSourceProvider):
+        * bindings/js/StringSourceProvider.h:
+        (WebCore::StringSourceProvider::StringSourceProvider):
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::CachedScript):
+        (WebCore::CachedScript::script):
+        * loader/CachedScript.h:
+        (WebCore::CachedScript::):
+          CachedScript now stores decoded data with the BOMs stripped,
+          and caches the presence of BOMs across memory purges.
+
+2010-07-03  Xan Lopez  <xlopez@igalia.com>
+
+        Include DerivedSources/WebCore before DerivedSources/
+
+        Recently DerivedSources generation was changed, with some files no
+        longer being generated in the toplevel DerivedSources
+        directory. Since that directory is first in the -I flags the build
+        can be broken in some cases by including old files unless a 'make
+        clean' is done. Change the -I order to fix the build in the 32 bit
+        Release bot.
+
+        * GNUmakefile.am:
+
+2010-07-03  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Fix issue where a contextmenu event was reporting the wrong target if
+        the context menu was shown due to pressing the context menu key
+        (or Shift+F10).
+        
+        Split sendContextMenuForEvent into one case for keyboard events and use
+        that when the contextmenu event should be dispatched due to a keypress.
+
+        For the keboard case we now use the focused node as the target for the
+        event and use the clipped rect to determine the position of the menu.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=38129
+
+        Use manual test since DRT does not handle context menu keys.
+
+        * manual-tests/win/contextmenu-key.html: Added.
+        * page/EventHandler.cpp:
+        (WebCore::EventHandler::sendContextMenuEvent):
+        (WebCore::EventHandler::sendContextMenuEventForKey):
+        * page/EventHandler.h:
+
+2010-07-03  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed sort of XCode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-07-03  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Port Widget
+        https://bugs.webkit.org/show_bug.cgi?id=41538
+
+        Make Widget a dummy class. WebKit Brew MP uses the full screen mode
+        and does not use the window system introduced in Brew MP.
+
+        * platform/Widget.h:
+        * platform/brew/WidgetBrew.cpp: Added.
+        (WebCore::Widget::Widget):
+        (WebCore::Widget::~Widget):
+        (WebCore::Widget::frameRect):
+        (WebCore::Widget::setFrameRect):
+        (WebCore::Widget::setFocus):
+        (WebCore::Widget::setCursor):
+        (WebCore::Widget::show):
+        (WebCore::Widget::hide):
+        (WebCore::Widget::paint):
+        (WebCore::Widget::setIsSelected):
+
+2010-07-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement AfterFramesetMode
+        https://bugs.webkit.org/show_bug.cgi?id=41560
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+
+2010-07-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement InFramesetMode
+        https://bugs.webkit.org/show_bug.cgi?id=41559
+
+        Pretty straighforward.  We still don't handle character tokens
+        correctly.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+
+2010-07-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle <frameset> InBody
+        https://bugs.webkit.org/show_bug.cgi?id=41558
+
+        Handling the <frameset> tag in the InBody mode is somewhat delicate.
+
+        * html/HTMLElementStack.cpp:
+        (WebCore::HTMLElementStack::popHTMLBodyElement):
+        (WebCore::HTMLElementStack::popUntil):
+        (WebCore::HTMLElementStack::popCommon):
+        * html/HTMLElementStack.h:
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+
+2010-07-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Special handling of <rp> and <rt> tags
+        https://bugs.webkit.org/show_bug.cgi?id=41557
+
+        So sayeth the spec.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+
+2010-07-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement special optgroup processing
+        https://bugs.webkit.org/show_bug.cgi?id=41556
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+
+2010-07-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle <image> in new parser
+        https://bugs.webkit.org/show_bug.cgi?id=41555
+
+        This patch is kind of goofy but apparently how the world works.
+
+        * html/HTMLToken.h:
+        (WebCore::AtomicHTMLToken::setName):
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+
+2010-07-02  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove extra semicolon at the end of HTMLTreeBuilder::attach
+        https://bugs.webkit.org/show_bug.cgi?id=41546
+
+        This is not critical, but the extra semicolon at the end of HTMLTreeBuilder::attach
+        causes a warning in RVCT.
+
+        * html/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::attach):
+
+2010-07-02  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Performance::disconnectFrame() needs to disconnect its children
+        https://bugs.webkit.org/show_bug.cgi?id=41533
+
+        No new tests because no new functionality.
+
+        * page/Performance.cpp:
+        (WebCore::Performance::disconnectFrame):
+
+2010-07-02  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Sam Weinig.
+
+        Checking if WTF_USE_JSC is defined before redefining it in config.h
+        https://bugs.webkit.org/show_bug.cgi?id=41530
+
+        * config.h:
+
+2010-07-02  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add vendor prefix to window.performance
+        https://bugs.webkit.org/show_bug.cgi?id=41525
+
+        No new tests because window.performance tests not landed yet.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitPerformance):
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::optionalWebkitPerformance):
+        * page/DOMWindow.idl:
+
+2010-07-02  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        Minor fix: Diffuse constant is float (not integer)
+        https://bugs.webkit.org/show_bug.cgi?id=10412
+
+        * svg/SVGFEDiffuseLightingElement.cpp:
+        (WebCore::SVGFEDiffuseLightingElement::parseMappedAttribute):
+
+2010-07-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed.
+
+        Build fix for GTK+. Try to force a rebuild of the HTMLNames.h
+        file first by touching HTMLTagNames.in.
+
+        * html/HTMLTagNames.in:
+
+2010-07-02  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        RGB colors should be clamped to the 0-255 range
+        https://bugs.webkit.org/show_bug.cgi?id=39482
+
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#colors
+
+        Test: fast/canvas/canvas-color-clamping.html
+
+        * css/CSSParser.cpp:
+        (WebCore::parseColorInt):
+        (WebCore::CSSParser::parseColor):
+        (WebCore::parseColorIntFromValue):
+        (WebCore::CSSParser::parseColorParameters):
+
+2010-07-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62410.
+        http://trac.webkit.org/changeset/62410
+        https://bugs.webkit.org/show_bug.cgi?id=41549
+
+        accursed last minute changes (Requested by olliej on #webkit).
+
+        * bindings/js/ScriptSourceProvider.h:
+        (WebCore::ScriptSourceProvider::ScriptSourceProvider):
+        * bindings/js/StringSourceProvider.h:
+        (WebCore::StringSourceProvider::StringSourceProvider):
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::CachedScript):
+        (WebCore::CachedScript::script):
+        * loader/CachedScript.h:
+
+2010-07-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed.
+
+        Further Build fix for GTK+. Also include HTMLElementFactory.h in
+        the list of dependencies.
+
+        * GNUmakefile.am:
+
+2010-07-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed.
+
+        Build fix for GTK+. *Names.{cpp,h} targets should now include the
+        header files. Also adds the header files to the generated sources list.
+
+        * GNUmakefile.am:
+
+2010-07-02  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        DB clean up.
+        https://bugs.webkit.org/show_bug.cgi?id=41404
+
+        1. Made all DatabaseTasks internal classes of Database and made
+           the Database methods called by those tasks private.
+        2. Removed the Database::stop{ed}() methods.
+        3. Removed the code that kept track of open databases from
+           ScriptExecutionContext (no longer needed).
+        4. Made minor changes to Database::closeImmediately() to make it
+           possible for DatabaseThread to call that method instead of
+           close().
+        5. Minor fix to DatabaseTracker: addOpenDatabase() should call
+           OriginQuotaManager::addDatabase() if the origin quota manager
+           is not tracking this origin.
+        6. Removed Database::performPolicyChecks(). We already update the
+           DB size after each transaction, and we enforce a max size for
+           the DB at the beginning of each transaction.
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::stopDatabases):
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::hasOpenDatabases):
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::close):
+        (WebCore::Database::closeImmediately):
+        * storage/Database.h:
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseTask::performTask):
+        (WebCore::Database::DatabaseOpenTask::DatabaseOpenTask):
+        (WebCore::Database::DatabaseOpenTask::doPerformTask):
+        (WebCore::Database::DatabaseOpenTask::debugTaskName):
+        (WebCore::Database::DatabaseCloseTask::DatabaseCloseTask):
+        (WebCore::Database::DatabaseCloseTask::doPerformTask):
+        (WebCore::Database::DatabaseCloseTask::debugTaskName):
+        (WebCore::Database::DatabaseTransactionTask::DatabaseTransactionTask):
+        (WebCore::Database::DatabaseTransactionTask::doPerformTask):
+        (WebCore::Database::DatabaseTransactionTask::debugTaskName):
+        (WebCore::Database::DatabaseTableNamesTask::DatabaseTableNamesTask):
+        (WebCore::Database::DatabaseTableNamesTask::doPerformTask):
+        (WebCore::Database::DatabaseTableNamesTask::debugTaskName):
+        * storage/DatabaseTask.h:
+        (WebCore::Database::DatabaseOpenTask::create):
+        (WebCore::Database::DatabaseCloseTask::create):
+        (WebCore::Database::DatabaseTransactionTask::create):
+        (WebCore::Database::DatabaseTableNamesTask::create):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::checkAndHandleClosedDatabase):
+
+2010-07-02  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Move BOM handling out of the lexer and parser
+        https://bugs.webkit.org/show_bug.cgi?id=41539
+
+        Update WebCore to ensure that SourceProviders don't
+        produce strings with BOMs in them.
+
+        * bindings/js/ScriptSourceProvider.h:
+        (WebCore::ScriptSourceProvider::ScriptSourceProvider):
+        * bindings/js/StringSourceProvider.h:
+        (WebCore::StringSourceProvider::StringSourceProvider):
+        * loader/CachedScript.cpp:
+        (WebCore::CachedScript::CachedScript):
+        (WebCore::CachedScript::script):
+        * loader/CachedScript.h:
+        (WebCore::CachedScript::):
+          CachedScript now stores decoded data with the BOMs stripped,
+          and caches the presence of BOMs across memory purges.
+
+2010-07-02  Sam Weinig  <sam@webkit.org>
+
+        Add missing symbol to exports file.
+
+        * WebCore.base.exp:
+
+2010-07-02  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove the extra setFailed() call in JPEG decoder to prevent
+        re-using an already freed object.
+        https://bugs.webkit.org/show_bug.cgi?id=41487
+
+        Test: fast/images/large-size-image-crash.html
+
+        * platform/image-decoders/jpeg/JPEGImageDecoder.cpp:
+        (WebCore::JPEGImageReader::decode):
+
+2010-07-02  Peter Beverloo  <peter@lvp-media.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add the HTML5 <mark> element. Text content of the element will have
+        a yellow background color and black text.
+
+        Test: fast/html/mark-element.html
+        Tests for <p> closing, phrasing child content and residual style.
+
+        * css/html.css:
+        (mark):
+        * html/HTMLElement.cpp:
+        (WebCore::inlineTagList):
+        * html/HTMLTagNames.in:
+        * html/LegacyHTMLTreeBuilder.cpp:
+        (WebCore::LegacyHTMLTreeBuilder::getNode):
+        (WebCore::LegacyHTMLTreeBuilder::isInline):
+        (WebCore::LegacyHTMLTreeBuilder::isResidualStyleTag):
+
+2010-07-02  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Fix issues in boundary situations for WebGLRenderingContext::drawArrays/drawElements
+        https://bugs.webkit.org/show_bug.cgi?id=41473
+
+        * WebCore.gypi: Add CheckedInt.h.
+        * WebCore.xcodeproj/project.pbxproj: Add CheckedInt.h.
+        * html/canvas/CheckedInt.h: Added support of safe integer operations.
+        (mozilla::CheckedInt_internal::integer_type_manually_recorded_info::):
+        (mozilla::CheckedInt_internal::is_unsupported_type::):
+        (mozilla::CheckedInt_internal::):
+        (mozilla::CheckedInt_internal::integer_traits::):
+        (mozilla::CheckedInt_internal::integer_traits::min):
+        (mozilla::CheckedInt_internal::integer_traits::max):
+        (mozilla::CheckedInt_internal::has_sign_bit):
+        (mozilla::CheckedInt_internal::binary_complement):
+        (mozilla::CheckedInt_internal::is_in_range):
+        (mozilla::CheckedInt_internal::is_add_valid):
+        (mozilla::CheckedInt_internal::is_sub_valid):
+        (mozilla::CheckedInt_internal::is_mul_valid):
+        (mozilla::CheckedInt_internal::is_div_valid):
+        (mozilla::CheckedInt::CheckedInt):
+        (mozilla::CheckedInt::value):
+        (mozilla::CheckedInt::valid):
+        (mozilla::CheckedInt::operator -):
+        (mozilla::CheckedInt::operator ==):
+        (mozilla::CheckedInt::operator !=):
+        (mozilla::operator /):
+        (mozilla::cast_to_CheckedInt_impl::run):
+        (mozilla::):
+        (mozilla::cast_to_CheckedInt):
+        (mozilla::operator ==):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateIndexArrayConservative): Fix a bug against 0-size buffer situation.
+        (WebCore::WebGLRenderingContext::drawArrays): Deal with overflows and count==0 situation.
+        (WebCore::WebGLRenderingContext::drawElements): Deal with count==0 situation.
+
+2010-07-02  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        linkProgram should fail when vertex/fragment shaders are not both present
+        https://bugs.webkit.org/show_bug.cgi?id=41380
+
+        Test: fast/canvas/webgl/program-test.html
+
+        * html/canvas/WebGLProgram.cpp: Add flag for link failure due to missing shaders.
+        (WebCore::WebGLProgram::WebGLProgram):
+        * html/canvas/WebGLProgram.h: Add interface for linkFailure flag.
+        (WebCore::WebGLProgram::isLinkFailureFlagSet):
+        (WebCore::WebGLProgram::setLinkFailureFlag):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getProgramParameter): Intercept when linkFailureFlag is set.
+        (WebCore::WebGLRenderingContext::linkProgram): Check if there are missing shaders and don't link if yes.
+        * html/canvas/WebGLShader.cpp: Cache shader type.
+        (WebCore::WebGLShader::WebGLShader):
+        * html/canvas/WebGLShader.h: Ditto.
+        (WebCore::WebGLShader::getType):
+
+2010-07-02  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt]  Failed on http://philip.html5.org/tests/canvas/suite/tests/2d.drawImage.negativesource.html
+
+        Support negative width and height in canvas image draw
+
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/qt/FloatRectQt.cpp:
+        (WebCore::FloatRect::normalized):
+        * platform/graphics/qt/ImageQt.cpp:
+        (WebCore::BitmapImage::draw):
+
+2010-06-24  Dimitri Glazkov  <dglazkov@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        REGRESSION: Enter does not trigger submit of forms when focus is on select.
+        https://bugs.webkit.org/show_bug.cgi?id=39532
+
+        Restore behavior where hitting "Enter" on a select element attempts to submit
+        form implicitly.
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler): Added htmlForm argument,
+            and attempting to submit implicitly.
+        (WebCore::SelectElement::listBoxDefaultEventHandler): Ditto.
+        (WebCore::SelectElement::defaultEventHandler): Plumbed through htmlForm argument.
+        * dom/SelectElement.h: Added htmlForm argument to method declaration.
+        * html/HTMLSelectElement.cpp:
+        (WebCore::HTMLSelectElement::defaultEventHandler): Changed to provide submitting form
+            as the argument.
+
+2010-07-02  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Support indeterminate checkbox for Linux, and a small fix for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=41508
+
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+          Use dedicated images for indeterminate states.
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineClassicState):
+          Do not use DFCS_CHECKED in a case of indeterminate state in
+          order to have consistent appearance of indeterminate checkbox.
+
+2010-07-02  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Fixes https://bugs.webkit.org/show_bug.cgi?id=41323.
+        Provides an implementation of the 'squiggle' used for
+        bad grammar or spelling, based on the Pango logic used
+        by the GTK builds.
+
+        No new tests. Covered by LayoutTests/editing/spelling
+
+        * WebCore.vcproj/WebCore.vcproj: Add new file holding underline
+        implementation, set to build only for WinCairo port.
+        * platform/graphics/cairo/DrawErrorUnderline.cpp: Added.
+        (drawErrorUnderline): New file containing the squiggle drawing
+        logic based on the Pango implementation.  Placed in its own file
+        to isolate licenses.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawLineForMisspellingOrBadGrammar):
+        Have WinCairo build call new 'drawErrorUnderline' implementation.
+
+2010-07-02  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Separate DerivedSources per-project
+        https://bugs.webkit.org/show_bug.cgi?id=41109
+
+        Generate WebCore derived sources in <builddir>/DerivedSources/WebCore.
+
+        * GNUmakefile.am:
+
+2010-07-02  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement OpenGL ES 2.0 semantics for vertex attribute 0
+        https://bugs.webkit.org/show_bug.cgi?id=41300
+
+        Test: fast/canvas/webgl/gl-bind-attrib-location-test.html
+              fast/canvas/webgl/gl-vertex-attrib.html
+
+        * html/canvas/WebGLProgram.cpp:
+        (WebCore::WebGLProgram::numActiveAttribLocations): const.
+        (WebCore::WebGLProgram::getActiveAttribLocation): const.
+        (WebCore::WebGLProgram::isUsingVertexAttrib0): Determine whether vertex attrib 0 is used by the program.
+        * html/canvas/WebGLProgram.h: Declare isUsingVertexAttrib0.
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext): Deal with vertex attrib 0.
+        (WebCore::WebGLRenderingContext::disableVertexAttribArray): Ditto.
+        (WebCore::WebGLRenderingContext::drawArrays): Ditto.
+        (WebCore::WebGLRenderingContext::drawElements): Ditto.
+        (WebCore::WebGLRenderingContext::getVertexAttrib): Use cached value instead of calling glGetVertexAtrtrib.
+        (WebCore::WebGLRenderingContext::vertexAttrib1f): Validate input, deal with vertex attrib 0.
+        (WebCore::WebGLRenderingContext::vertexAttrib1fv): Ditto.
+        (WebCore::WebGLRenderingContext::vertexAttrib2f): Ditto.
+        (WebCore::WebGLRenderingContext::vertexAttrib2fv): Ditto.
+        (WebCore::WebGLRenderingContext::vertexAttrib3f): Ditto.
+        (WebCore::WebGLRenderingContext::vertexAttrib3fv): Ditto.
+        (WebCore::WebGLRenderingContext::vertexAttrib4f): Ditto.
+        (WebCore::WebGLRenderingContext::vertexAttrib4fv): Ditto.
+        (WebCore::WebGLRenderingContext::vertexAttribPointer): Ditto.
+        (WebCore::WebGLRenderingContext::handleNPOTTextures): Move isGLES2Compliant() to caller.
+        (WebCore::WebGLRenderingContext::vertexAttribImpl): Helper for vertexAttribNfv.
+        (WebCore::WebGLRenderingContext::initVertexAttrib0): Initialize vertex attrib 0.
+        (WebCore::WebGLRenderingContext::simulateVertexAttrib0): Simulate vertex attrib 0.
+        (WebCore::WebGLRenderingContext::restoreStatesAfterVertexAttrib0Simulation): Restore states after simulating vertex attrib 0.
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::VertexAttribState::VertexAttribState): Tracking full vertex attrib states.
+        (WebCore::WebGLRenderingContext::VertexAttribState::initValue): Init value to [0,0,0,1].
+
+2010-07-02  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Need to validate the size of the incoming arrays for uniform* functions
+        https://bugs.webkit.org/show_bug.cgi?id=41383
+
+        * html/canvas/WebGLRenderingContext.cpp: Validate input array size.
+        (WebCore::WebGLRenderingContext::uniform1fv):
+        (WebCore::WebGLRenderingContext::uniform1iv):
+        (WebCore::WebGLRenderingContext::uniform2fv):
+        (WebCore::WebGLRenderingContext::uniform2iv):
+        (WebCore::WebGLRenderingContext::uniform3fv):
+        (WebCore::WebGLRenderingContext::uniform3iv):
+        (WebCore::WebGLRenderingContext::uniform4fv):
+        (WebCore::WebGLRenderingContext::uniform4iv):
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv):
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv):
+        (WebCore::WebGLRenderingContext::validateUniformParameters):
+        (WebCore::WebGLRenderingContext::validateUniformMatrixParameters):
+        * html/canvas/WebGLRenderingContext.h: Add helper functions.
+
+2010-07-02  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Canvas arcTo() should draw straight line to p1 if p0, p1 and p2 are collinear
+
+        The implementation of PathQt's addArcTo() was not float-safe and also had
+        a case where it drew an 'infinite' line, which is not part of the spec.
+
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-arcto
+
+        We now use qFuzzyCompare() in both cases. The method isPointOnPathBorder()
+        also had the same problem, and was refactored a bit in the process of fixing
+        the bug.
+
+        Initial patch by Andreas Kling.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41412
+
+        * platform/graphics/qt/PathQt.cpp:
+
+2010-07-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [v8] Web Inspector: inspected page crashes on attempt to change iframe's src attribute
+        https://bugs.webkit.org/show_bug.cgi?id=41511
+
+        Tests: fast/events/popup-blocked-from-fake-user-gesture.html
+               http/tests/inspector/change-iframe-src.html
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture): use V8Proxy from the ScriptController instead of one
+        from the call stack. Get event directly from hidden property to avoid unnecessary checks.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::eventAccessorGetter):
+        (WebCore::V8DOMWindow::eventAccessorSetter):
+
+2010-07-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix tokenization of <!----->
+        https://bugs.webkit.org/show_bug.cgi?id=41505
+
+        I noticed this error when browsing through the HTML5lib failures.
+        We're adding an extra character to the comment token, contrary to what
+        the spec says to do.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::nextToken):
+
+2010-07-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement processFakePEndTagIfPInScope
+        https://bugs.webkit.org/show_bug.cgi?id=41503
+
+        This is a common idiom because <p> likes to close itself.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processFakePEndTagIfPInScope):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        * html/HTMLTreeBuilder.h:
+
+2010-07-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement AfterAfterBodyMode
+        https://bugs.webkit.org/show_bug.cgi?id=41501
+
+        In implementing this mode, I noticed a bug in the character processing
+        of the AfterBodyMode, which I fixed by adding a break statement.  Also,
+        to get one of the new tests to pass, I needed to implement one
+        notImplemented() in the InBody insertion mode.  Yay for testing.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processComment):
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+
+2010-07-02  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62371.
+        http://trac.webkit.org/changeset/62371
+        https://bugs.webkit.org/show_bug.cgi?id=41515
+
+        "Breaks media/controls-drag-timebar.html on 32-Bit Release"
+        (Requested by philn-tp on #webkit).
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivateGStreamer::updateStates):
+
+2010-06-28  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GStreamer] can't seek past maxTimeLoaded value
+        https://bugs.webkit.org/show_bug.cgi?id=40526
+
+        Extended the seekable range to the whole media. This allows video
+        played with progressive download to be seeked past the current
+        buffered position.
+
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::maxTimeSeekable):
+        (WebCore::MediaPlayerPrivateGStreamer::updateStates):
+
+2010-07-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement AfterBodyMode for HTML5 tree builder
+        https://bugs.webkit.org/show_bug.cgi?id=41500
+
+        In the coarse of implementing this state, I ran into an ASSERT in how
+        </br> tags where handled, which I fixed.  Technically, that could be a
+        separate patch, but it seemed harmless to include it here (with tests).
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processComment):
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+        (WebCore::HTMLTreeBuilder::insertCommentOnHTMLHtmlElement):
+        * html/HTMLTreeBuilder.h:
+
+2010-07-02  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Handle <base> and friends in AfterHeadMode
+        https://bugs.webkit.org/show_bug.cgi?id=41502
+
+        Implement notImplemented() per spec.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+
+2010-07-01  Oliver Hunt  <oliver@apple.com>
+
+        Build fix
+
+        * dom/Document.h:
+
+2010-07-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Maciej Stachowiak.
+
+        Add a FixedArray template to encapsulate fixed length arrays
+        https://bugs.webkit.org/show_bug.cgi?id=41506
+
+        Add forwarding header, and replace a few fixed length arrays
+        with the new FixedArray type.
+
+        * ForwardingHeaders/wtf/FixedArray.h: Added.
+        * dom/Document.h:
+        * platform/graphics/GlyphMetricsMap.h:
+
+2010-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+
+        Fix a link warning in 32-bit by not explicitly exporting WebCore::GraphicsLayer::syncCompositingStateForThisLayerOnly().
+
+        * WebCore.AcceleratedCompositing.exp:
+
+2010-07-01  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add window.performance.navigation namespace
+        https://bugs.webkit.org/show_bug.cgi?id=41442
+
+        Adds window.performance.navigation namespace consisting of ".type"
+        and ".redirectCount". As part of this change, I renmaed "NavigationTiming"
+        to just "Timing" to avoid confusion.
+
+        No new tests because tests will be added in a subsequent patch when
+        functionality is added.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/Navigation.cpp: Added.
+        (WebCore::Navigation::Navigation):
+        (WebCore::Navigation::frame):
+        (WebCore::Navigation::disconnectFrame):
+        (WebCore::Navigation::type):
+        (WebCore::Navigation::redirectCount):
+        * page/Navigation.h: Added.
+        (WebCore::Navigation::create):
+        * page/Navigation.idl: Added.
+        * page/NavigationTiming.cpp: Removed.
+        * page/NavigationTiming.h: Removed.
+        * page/NavigationTiming.idl: Removed.
+        * page/Performance.cpp:
+        (WebCore::Performance::navigation):
+        (WebCore::Performance::timing):
+        * page/Performance.h:
+        * page/Performance.idl:
+        * page/Timing.cpp: Added.
+        (WebCore::Timing::Timing):
+        (WebCore::Timing::frame):
+        (WebCore::Timing::disconnectFrame):
+        (WebCore::Timing::navigationStart):
+        * page/Timing.h: Added.
+        (WebCore::Timing::create):
+        * page/Timing.idl: Added.
+
+2010-07-01  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Jian Li.
+
+        [chromium] Dragging a link triggers an assert when accessing event.dataTransfer.types
+        https://bugs.webkit.org/show_bug.cgi?id=41493
+
+        ClipboardChromium::writeURL violates ClipboardChromium's assumption that uriList will always
+        be non-empty if url is valid.
+
+        No new tests.
+
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::writeURL):
+
+2010-07-01  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Clamp color stops passed to QGradient to 1.0
+        [https://bugs.webkit.org/show_bug.cgi?id=41484
+
+        Fixes an issue where color stops would be silently dropped from radial gradients.
+
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2010-07-01  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        HTMLTokenizer should ASSERT that it never emits a null character
+        https://bugs.webkit.org/show_bug.cgi?id=41448
+
+        No functional change, thus no tests.  These ASSERTs would have
+        caught the coding error which caused the trouble in bug 41436
+        (which was fixed by bug 41439).
+
+        * html/HTMLToken.h:
+        (WebCore::HTMLToken::beginStartTag):
+        (WebCore::HTMLToken::beginCharacter):
+        (WebCore::HTMLToken::beginDOCTYPE):
+        (WebCore::HTMLToken::appendToName):
+        (WebCore::HTMLToken::appendToComment):
+        (WebCore::HTMLToken::appendToAttributeName):
+        (WebCore::HTMLToken::appendToAttributeValue):
+        (WebCore::HTMLToken::appendToPublicIdentifier):
+        (WebCore::HTMLToken::appendToSystemIdentifier):
+
+2010-07-01  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Canvas: Don't paint with empty radial gradients
+        https://bugs.webkit.org/show_bug.cgi?id=41190
+
+        If a radial gradient has x0==x1 && y0==y1 && r0==r1, don't paint with it.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::fillRect):
+        * platform/graphics/Gradient.h:
+        (WebCore::Gradient::isZeroSize):
+
+2010-07-01  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add interface for network platform to pass up timing information
+        https://bugs.webkit.org/show_bug.cgi?id=41437
+
+        The Web Timing feature requires the network platform to expose detailed
+        timing information for the main resource. This patch adds that data to
+        the ResourceResponseBase. Since the 82 bytes of information is only
+        needed for the main resource, it is a RefPtr to avoid using the memory
+        for other resource types.
+
+        No new tests because no new functionality.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/ResourceLoadTiming.h: Added.
+        (WebCore::ResourceLoadTiming::create):
+        (WebCore::ResourceLoadTiming::deepCopy):
+        (WebCore::ResourceLoadTiming::operator==):
+        (WebCore::ResourceLoadTiming::operator!=):
+        (WebCore::ResourceLoadTiming::ResourceLoadTiming):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        (WebCore::ResourceResponseBase::resourceLoadTiming):
+        (WebCore::ResourceResponseBase::setResourceLoadTiming):
+        (WebCore::ResourceResponseBase::compare):
+        * platform/network/ResourceResponseBase.h:
+
+2010-07-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62321.
+        http://trac.webkit.org/changeset/62321
+        https://bugs.webkit.org/show_bug.cgi?id=41494
+
+        Broke the non-win builds. (Requested by dumi on #webkit).
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::addOpenDatabase):
+        (WebCore::ScriptExecutionContext::removeOpenDatabase):
+        (WebCore::ScriptExecutionContext::stopDatabases):
+        * dom/ScriptExecutionContext.h:
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::ContextRemoveOpenDatabaseTask::create):
+        (WebCore::ContextRemoveOpenDatabaseTask::performTask):
+        (WebCore::ContextRemoveOpenDatabaseTask::isCleanupTask):
+        (WebCore::ContextRemoveOpenDatabaseTask::ContextRemoveOpenDatabaseTask):
+        (WebCore::Database::close):
+        (WebCore::Database::closeImmediately):
+        (WebCore::Database::stop):
+        (WebCore::Database::performPolicyChecks):
+        * storage/Database.h:
+        (WebCore::Database::):
+        (WebCore::Database::stopped):
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseTask::performTask):
+        (WebCore::DatabaseOpenTask::DatabaseOpenTask):
+        (WebCore::DatabaseOpenTask::doPerformTask):
+        (WebCore::DatabaseOpenTask::debugTaskName):
+        (WebCore::DatabaseCloseTask::DatabaseCloseTask):
+        (WebCore::DatabaseCloseTask::doPerformTask):
+        (WebCore::DatabaseCloseTask::debugTaskName):
+        (WebCore::DatabaseTransactionTask::DatabaseTransactionTask):
+        (WebCore::DatabaseTransactionTask::~DatabaseTransactionTask):
+        (WebCore::DatabaseTransactionTask::doPerformTask):
+        (WebCore::DatabaseTransactionTask::debugTaskName):
+        (WebCore::DatabaseTableNamesTask::DatabaseTableNamesTask):
+        (WebCore::DatabaseTableNamesTask::doPerformTask):
+        (WebCore::DatabaseTableNamesTask::debugTaskName):
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+        (WebCore::DatabaseCloseTask::create):
+        (WebCore::DatabaseTransactionTask::create):
+        (WebCore::DatabaseTableNamesTask::create):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::checkAndHandleClosedDatabase):
+
+2010-07-01  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Stop using GdkRegion in 3.x mode
+        https://bugs.webkit.org/show_bug.cgi?id=41463
+
+        Make us compile without using GdkRegion, since it's gone from GTK+
+        3.x.
+
+        * platform/graphics/IntRect.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::cairo_region_shrink):
+        (WebCore::Font::drawComplexText):
+        * platform/gtk/GtkPluginWidget.cpp:
+        (WebCore::GtkPluginWidget::paint):
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/gtk/ScrollbarGtk.cpp:
+        (ScrollbarGtk::paint):
+
+2010-06-30  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        DB clean up.
+        https://bugs.webkit.org/show_bug.cgi?id=41404
+
+        1. Made all DatabaseTasks internal classes of Database and made
+           the Database methods called by those tasks private.
+        2. Removed the Database::stop{ed}() methods.
+        3. Removed the code that kept track of open databases from
+           ScriptExecutionContext (no longer needed).
+        4. Made minor changes to Database::closeImmediately() to make it
+           possible for DatabaseThread to call that method instead of
+           close().
+        5. Minor fix to DatabaseTracker: addOpenDatabase() should call
+           OriginQuotaManager::addDatabase() if the origin quota manager
+           is not tracking this origin.
+        6. Removed Database::performPolicyChecks(). We already update the
+           DB size after each transaction, and we enforce a max size for
+           the DB at the beginning of each transaction.
+
+        * dom/ScriptExecutionContext.cpp:
+        (WebCore::ScriptExecutionContext::stopDatabases):
+        * dom/ScriptExecutionContext.h:
+        (WebCore::ScriptExecutionContext::hasOpenDatabases):
+        * storage/Database.cpp:
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::markAsDeletedAndClose):
+        (WebCore::Database::close):
+        (WebCore::Database::closeImmediately):
+        * storage/Database.h:
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseTask::performTask):
+        (WebCore::Database::DatabaseOpenTask::DatabaseOpenTask):
+        (WebCore::Database::DatabaseOpenTask::doPerformTask):
+        (WebCore::Database::DatabaseOpenTask::debugTaskName):
+        (WebCore::Database::DatabaseCloseTask::DatabaseCloseTask):
+        (WebCore::Database::DatabaseCloseTask::doPerformTask):
+        (WebCore::Database::DatabaseCloseTask::debugTaskName):
+        (WebCore::Database::DatabaseTransactionTask::DatabaseTransactionTask):
+        (WebCore::Database::DatabaseTransactionTask::doPerformTask):
+        (WebCore::Database::DatabaseTransactionTask::debugTaskName):
+        (WebCore::Database::DatabaseTableNamesTask::DatabaseTableNamesTask):
+        (WebCore::Database::DatabaseTableNamesTask::doPerformTask):
+        (WebCore::Database::DatabaseTableNamesTask::debugTaskName):
+        * storage/DatabaseTask.h:
+        (WebCore::Database::DatabaseOpenTask::create):
+        (WebCore::Database::DatabaseCloseTask::create):
+        (WebCore::Database::DatabaseTransactionTask::create):
+        (WebCore::Database::DatabaseTableNamesTask::create):
+        * storage/DatabaseThread.cpp:
+        (WebCore::DatabaseThread::databaseThread):
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        * storage/SQLTransaction.cpp:
+        (WebCore::SQLTransaction::executeSQL):
+        (WebCore::SQLTransaction::checkAndHandleClosedDatabase):
+
+2010-07-01  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Support indeterminate checkbox for Windows
+        https://bugs.webkit.org/show_bug.cgi?id=41444
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::determineState):
+         Check isIndeterminate() and set an appropriate flag value.
+
+2010-07-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41488
+        <rdar://problem/7487420> Crash in SubresourceLoader::create when load is initiated from plug-in destructor
+
+        Test: plugins/js-from-destroy.html
+
+        * loader/SubresourceLoader.cpp: (WebCore::SubresourceLoader::create): Null check active
+        document loader.
+
+2010-07-01  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8113003> Correctly fire beforeload events for images
+        added to the DOM using .innerHTML.
+        https://bugs.webkit.org/show_bug.cgi?id=40919
+
+        Test: fast/dom/beforeload/image-before-load-innerHTML.html
+
+        * html/LegacyHTMLDocumentParser.cpp:
+        (WebCore::LegacyHTMLDocumentParser::write): Do not fire synchronous
+        image beforeload events immediately after parsing a document fragment.
+        Let the events fire later, giving the fragment time to potentially be
+        inserted into the document.
+
+2010-07-01  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Canvas: bezierCurveTo() and quadraticCurveTo() must ensure subpaths
+        https://bugs.webkit.org/show_bug.cgi?id=41192
+
+        If the current path is empty, bezierCurveTo() and quadraticCurveTo() will now
+        move to the (first) control point before adding the curve.
+
+        Spec links:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-beziercurveto
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-quadraticcurveto
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::quadraticCurveTo):
+        (WebCore::CanvasRenderingContext2D::bezierCurveTo):
+
+2010-07-01  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Canvas element cannot have negative width or height (HTML5 spec 4.8.11)
+        https://bugs.webkit.org/show_bug.cgi?id=39149
+
+        If assigned a negative value, it should default to 300 for width and 150 for height.
+
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#attr-canvas-width
+
+        Test: fast/canvas/canvas-negative-size.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::reset):
+
+2010-07-01  Darin Adler  <darin@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Turn on adoptRef assertion for TreeShared.
+
+        * platform/TreeShared.h: Remove LOOSE_TREE_SHARED and all the ifdefs.
+        Actually, I used LOOSE_REF_COUNTED by accident in a few places, but
+        removing them all now.
+
+        * rendering/ShadowElement.cpp:
+        (WebCore::ShadowBlockElement::create): Added adoptRef. This was a
+        storage leak before, probably recently introduced r61324.
+        (WebCore::ShadowInputElement::create): Ditto.
+
+2010-07-01  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Only include the geolocation IDL in the GObject DOM bindings set
+        if geolocation is enabled.
+
+        * GNUmakefile.am:
+
+2010-07-01  Timothy Hatcher  <timothy@apple.com>
+
+        Provide a WebView preference to disable DNS prefetching.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28825
+        rdar://problem/7181249
+
+        Reviewed by Darin Adler.
+
+        * WebCore.base.exp: Added Settings::setDNSPrefetchingEnabled.
+        * dom/Document.cpp:
+        (WebCore::Document::initDNSPrefetch): Check settings->dnsPrefetchingEnabled().
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings): Set m_dnsPrefetchingEnabled to true.
+        (WebCore::Settings::setDNSPrefetchingEnabled): Added. Set m_dnsPrefetchingEnabled.
+        * page/Settings.h:
+        (WebCore::Settings::dnsPrefetchingEnabled): Added. Return m_dnsPrefetchingEnabled.
+
+2010-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Get accelerated compositing working with webkit2
+        https://bugs.webkit.org/show_bug.cgi?id=41084
+
+        Step 2: add a  method, syncCompositingStateForThisLayerOnly(), to GraphicsLayer to commit
+        batched changes non-recursively. This allows us to use GraphicsLayer in places where we
+        don't want to kick off a recursive commit of the entire tree.
+
+        * platform/graphics/GraphicsLayer.h:
+        (WebCore::GraphicsLayer::syncCompositingStateForThisLayerOnly):
+        * platform/graphics/mac/GraphicsLayerCA.h:
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::GraphicsLayerCA::syncCompositingStateForThisLayerOnly):
+        * WebCore.AcceleratedCompositing.exp: Export the new method for use in WebKit2.
+
+2010-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Get accelerated compositing working with webkit2
+        https://bugs.webkit.org/show_bug.cgi?id=41084
+
+        Step 1: add a new .exp file for WebCore, which exports symbols only when USE(ACCELERATED_COMPOSITING)
+        is defined.
+        
+        Also export WebCore::FloatSize::FloatSize(WebCore::IntSize const&) from WebCore.
+
+        * DerivedSources.make:
+        * WebCore.AcceleratedCompositing.exp: Added.
+        * WebCore.base.exp:
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-07-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/8148656> <https://bugs.webkit.org/show_bug.cgi?id=41431>
+        REGRESSION (r49411): Various crashes due to JavaScript execution during plug-in destruction
+
+        Test: plugins/write-xssauditor-from-destroy.html
+
+        Fix specific known cases that also crash in same process case. I don't know if there is
+        any rule for when documentLoader should be checked for being null, it looks like a mess.
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::referrer):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::findInRequest):
+
+2010-07-01  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        The HTML5 canvas 2d.drawImage.zerocanvas test does not pass
+        https://bugs.webkit.org/show_bug.cgi?id=40271
+
+        Throw INVALID_STATE_ERR when attempting to draw a canvas with zero width or height.
+
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-drawimage
+
+        * bindings/js/JSCanvasRenderingContext2DCustom.cpp:
+        (WebCore::JSCanvasRenderingContext2D::drawImage): Call setDOMException after drawImage(canvas, x, y)
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2010-07-01  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Oliver Hunt.
+
+        [Qt] Canvas: clip() should use non-zero winding rule
+        https://bugs.webkit.org/show_bug.cgi?id=41466
+
+        Use non-zero winding number rule when clipping a GraphicsContext from canvas.
+        Fixes appearance of the "pill" in the web inspector.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::canvasClip):
+
+2010-07-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62246.
+        http://trac.webkit.org/changeset/62246
+        https://bugs.webkit.org/show_bug.cgi?id=41470
+
+        "Worker tests are broken in Chromium" (Requested by yurys on
+        #webkit).
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::eventAccessorGetter):
+        (WebCore::V8DOMWindow::eventAccessorSetter):
+
+2010-07-01  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        Canvas: Exception erroneously thrown for drawImage() when image.complete=false
+        https://bugs.webkit.org/show_bug.cgi?id=33968
+
+        Do nothing in drawImage() if called with an image whose 'complete'
+        attribute is false, or a video whose readyState is either HAVE_NOTHING
+        or HAVE_METADATA.
+
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#dom-context-2d-drawimage
+
+        Test: fast/canvas/canvas-drawImage-incomplete.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2010-07-01  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Prevent crash on counter destruction
+        https://bugs.webkit.org/show_bug.cgi?id=40032
+
+        Added counter destruction to RenderWidget::destroy()
+
+        Test: fast/css/counters/destroy-counter-crash.html
+
+        * rendering/RenderWidget.cpp:
+        (WebCore::RenderWidget::destroy):
+
+2010-07-01  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Unreviewed build fix after r62215.
+
+        No new functionality, so no new tests.
+
+        * CMakeLists.txt: Add missing files and re-sort.
+
+2010-07-01  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Remove an unneeded assert.
+
+        This assert is triggered for example while showing the falling leaves demo.
+        GraphicsLayerQtImpl::toGraphicsLayerQtImpl asserts that its input
+        pointer is null. Looking at the uses of this method it seems like
+        it is expected to return null if a null pointer is given to it.
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::toGraphicsLayerQtImpl):
+
+2010-06-16  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix qmake vcproj generation for QtWebKit.
+
+        qmake use TARGET=/LIBS+= -lTARGET to create dependencies
+        between projects in a subdir template.
+
+        Since when compiling outside of Qt we hijack the target name of
+        QtWebKit to add the configuration and version suffix to the binary
+        filename, qmake can't establish the WebCore project as a dependency
+        to QtTestBrowser.
+
+        This patch makes sure that the target is not hijacked on the
+        first of the three passes where the dependencies are determined.
+
+        * WebCore.pro:
+
+2010-07-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        SVGRenderStyle::diff() is missing
+        https://bugs.webkit.org/show_bug.cgi?id=41455
+
+        Don't just return StyleDifferenceLayout when two SVGRenderStyle objects differ.
+        Figure out when to repaint, and as last resort do a relayout.
+
+        Lively Kernel doesn't do any relayouts anymore, same for lots of demos in the IE9 testcenter.
+
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::diff):
+        * rendering/style/SVGRenderStyle.h:
+
+2010-07-01  Antti Koivisto  <koivisto@iki.fi>
+
+        Revert accidental commit.
+
+        * platform/network/qt/ResourceRequestQt.cpp:
+        (WebCore::ResourceRequest::toNetworkRequest):
+
+2010-07-01  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Buildfix for !ENABLE(SVG_FOREIGN_OBJECT) after r62196.
+        https://bugs.webkit.org/show_bug.cgi?id=40984
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::finishRenderSVGContent):
+
+2010-07-04  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Dirk Schulze.
+
+        Buildfix for !ENABLE(FILTERS) after r62238.
+        https://bugs.webkit.org/show_bug.cgi?id=41456
+
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::prepareToRenderSVGContent):
+
+2010-07-01  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed build fix.
+
+        * rendering/RenderInputSpeech.cpp:
+        (WebCore::RenderInputSpeech::paintInputFieldSpeechButton):
+        * rendering/RenderInputSpeech.h:
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paintInputFieldSpeechButton):
+        * rendering/RenderTheme.h:
+
+2010-07-01  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Rendering the speech button in input elements.
+        https://bugs.webkit.org/show_bug.cgi?id=40984
+
+        The button currently has only one state and rendered as an image on all platforms. Subsequent
+        patches will add user input handling and more states + rendering code to the button. The
+        button's appearance can be customized by individual ports in their RenderTheme implementation
+        if required.
+
+        Tests: platform/mac/fast/forms/input-appearance-numberandspeech.html
+               platform/mac/fast/forms/input-appearance-searchandspeech.html
+               platform/mac/fast/forms/input-appearance-speechbutton.html
+
+        * GNUmakefile.am:
+        * Resources/inputSpeech.png: Added.
+        * Resources/inputSpeech.tiff: Added. Used by the Mac implementation.
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.qrc:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/qt/ImageQt.cpp:
+        (loadResourcePixmap): Load the speech button images for Qt port.
+        * rendering/RenderInputSpeech.cpp: Added.
+        (WebCore::RenderInputSpeech::adjustInputFieldSpeechButtonStyle): Sets the button's dimensions.
+        (WebCore::RenderInputSpeech::paintInputFieldSpeechButton):
+        * rendering/RenderInputSpeech.h: Added.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::layout):
+        (WebCore::RenderTextControlSingleLine::forwardEvent):
+        (WebCore::RenderTextControlSingleLine::createSubtreeIfNeeded): Create the speech button.
+        (WebCore::RenderTextControlSingleLine::createInnerBlockStyle):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::adjustStyle):
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::adjustInputFieldSpeechButtonStyle):
+        (WebCore::RenderTheme::paintInputFieldSpeechButton):
+        * rendering/RenderTheme.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton): Get cancel button to render to the left of
+        speech button when enabled.
+
+2010-07-01  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Extra nullcheck needed at SelectionControllerGtk.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=41447
+
+        Extra null check added.
+
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange):
+
+2010-07-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] Web Inspector: inspected page crashes on attempt to change iframe's src attribute
+        https://bugs.webkit.org/show_bug.cgi?id=41350
+
+        Tests: fast/events/popup-blocked-from-fake-user-gesture.html
+               http/tests/inspector/change-iframe-src.html
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture): use V8Proxy from the ScriptController instead of one
+        from the call stack. Get event directly from hidden property to avoid unnecessary checks.
+        * bindings/v8/V8AbstractEventListener.cpp:
+        (WebCore::V8AbstractEventListener::invokeEventHandler):
+        * bindings/v8/V8HiddenPropertyName.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::eventAccessorGetter):
+        (WebCore::V8DOMWindow::eventAccessorSetter):
+
+2010-07-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        RenderSVGContainer/RenderSVGRoot report wrong strokeBoundingBox()
+        https://bugs.webkit.org/show_bug.cgi?id=41450
+
+        strokeBoundingBox() was reporting the repaintRectInLocalCoordinates() for children of a container,
+        instead of the actual strokeBoundingBox(). Only visible in WebInspector when looking at a container
+        which has a resource applied and contains a children which also has a resource applied.
+
+        Doesn't affect any test results.
+
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::objectBoundingBox):
+        (WebCore::RenderSVGContainer::strokeBoundingBox):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::objectBoundingBox): Deinlined this functions, it's virtual so there's no gain.
+        (WebCore::RenderSVGRoot::strokeBoundingBox): Ditto.
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGRoot.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::computeContainerBoundingBox):
+        * rendering/SVGRenderSupport.h: Add enum controlling the mode of container bounding box mode calculation.
+
+2010-07-01  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Implementing feConvolveMatrix svg filter
+        https://bugs.webkit.org/show_bug.cgi?id=5861
+
+        The implementation is optimized for speed, and uses
+        multiple algorithms for different parts of the image.
+        See SVGFEConvolveMatrixElement.cpp for a detailed
+        description.
+
+        * svg/SVGFEConvolveMatrixElement.cpp:
+        (WebCore::SVGFEConvolveMatrixElement::build):
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        (WebCore::clampRGBAValue):
+        (WebCore::FEConvolveMatrix::fastSetInteriorPixels):
+        (WebCore::FEConvolveMatrix::getPixelValue):
+        (WebCore::FEConvolveMatrix::fastSetOuterPixels):
+        (WebCore::FEConvolveMatrix::setInteriorPixels):
+        (WebCore::FEConvolveMatrix::setOuterPixels):
+        (WebCore::FEConvolveMatrix::apply):
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        (WebCore::FEConvolveMatrix::uniteChildEffectSubregions):
+
+2010-07-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Abstract 'a'-'z' checks into a function
+        https://bugs.webkit.org/show_bug.cgi?id=41438
+
+        Hopefully this version is more readable.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::nextToken):
+
+2010-07-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Parameter names in frame src URLs parsed incorrectly if resembles HTML entity code followed by underscore
+        https://bugs.webkit.org/show_bug.cgi?id=41345
+
+        Apparently whether an HTML entity requires a trailing semicolon varies
+        depending on the entity.  The full table is in the spec:
+
+        http://www.whatwg.org/specs/web-apps/current-work/multipage/named-character-references.html#named-character-references
+
+        I believe branch added in this patch is accurate.  At some point, I'll
+        add a full test suite for all the named entities.
+
+        * html/HTMLEntityParser.cpp:
+        (WebCore::consumeHTMLEntity):
+
+2010-07-01  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed.  Fix paste-o in Gtk build file.
+
+        Split out HTMLFormattingElementList into its own file
+        https://bugs.webkit.org/show_bug.cgi?id=41440
+
+        * GNUmakefile.am:
+
+2010-07-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Eric Seidel & Dirk Schulze.
+
+        Performance regression for setting content of <text> in SVG
+        https://bugs.webkit.org/show_bug.cgi?id=36564
+
+        Dramatically reducing the number of repaintRectInLocalCoordinates() calls needed while painting.
+        Do not pass the repaintRect to prepareToRenderSVGContent, only calculate it if opacity < 1 or -webkit-svg-shadow is set.
+        Most noticeable is that RenderSVGRoot had to visit all children, before actually painting, just to calculate the repaint rect.
+        And as RenderSVGRoot never carries shadow or opacity it was completly useless.
+
+        RenderSVGContainer also called repaintRectInLocalCoordinates, but the result is only needed when painting outlines, which is a rare case.
+        These modifications fix the performance regression and the number of repaintRectInLocalCoordinate calls for the complex example in
+        the bug report with 500 runs shrinks from 1.7 million calls to less than 105.000.
+
+        50 runs without the patch: ~ 520.8ms
+        50 runs with the patch   : ~ 501.8ms
+
+        The test calls setTimeout(0) 50 times, that already accounts for the 500ms. So setting the content of a <text>
+        element withs clippers applied, is very cheap now.
+
+        Also remove the need to pass in a filter argument to prepareToRenderSVGContent/finishRenderSVGContent, it can easily be grabbed
+        of the cache - just like all other resources are handled, simplifying the code.
+
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        * rendering/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::paint):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::prepareToRenderSVGContent):
+        (WebCore::SVGRenderSupport::finishRenderSVGContent):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::paint):
+
+2010-07-01  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Split out HTMLFormattingElementList into its own file
+        https://bugs.webkit.org/show_bug.cgi?id=41440
+
+        No functional changes, thus no tests.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::indexOfFirstUnopenFormattingElement):
+        (WebCore::HTMLTreeBuilder::reconstructTheActiveFormattingElements):
+        * html/HTMLTreeBuilder.h:
+
+2010-07-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        BogusCommentState should come in from the cold
+        https://bugs.webkit.org/show_bug.cgi?id=41439
+
+        The BogusCommentState has always been wrong.  The proximate issue is
+        that it didn't handle resuming correctly when parsing a partial input
+        stream.  Now that we have EOF working properly, we can actually
+        implement this state correctly.
+
+        We need to distinguish when we enter this state from when we continue
+        in this state.  We could do that with a branch for each character, but
+        it seemed easier to split the state in two, even though that leaves us
+        with one more state in our tokenizer than we have in the HTML5 spec.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::nextToken):
+        * html/HTMLTokenizer.h:
+        (WebCore::HTMLTokenizer::):
+
+2010-06-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        HTMLTokenizer's whitespace checks are very redundant
+        https://bugs.webkit.org/show_bug.cgi?id=41434
+
+        This patch adds isTokenizerWhitespace, which replaces a lot of
+        redundant logic in nextToken.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::nextToken):
+
+2010-06-30  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Crash when uploading document to Google Docs
+        https://bugs.webkit.org/show_bug.cgi?id=40795
+
+        Fix bug where the local file wasn't opened (for POSTing)
+        if it were the first element in the form.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::FormDataIODevice::FormDataIODevice):
+        (WebCore::FormDataIODevice::moveToNextElement):
+        (WebCore::FormDataIODevice::openFileForCurrentElement):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2010-06-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Implement generateImpliedEndTags and deploy to steps which were blocked on it
+        https://bugs.webkit.org/show_bug.cgi?id=41432
+
+        This fixes one subtest in html5lib/runner.html and positively
+        effects a couple others.
+
+        More code sharing will be needed here.  For the moment
+        we're using copy/paste code, but that will soon be shared.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::generateImpliedEndTagsWithExclusion):
+        (WebCore::HTMLTreeBuilder::generateImpliedEndTags):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-30  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Unreviewed buildfix after r62196 and r62214.
+
+        * html/HTMLElementStack.cpp: Put !ENABLE(SVG) guard instead of 
+        !ENABLE(SVG_FOREIGN_OBJECT) around include of SVGNames.h.
+
+2010-06-30  Sam Weinig  <sam@webkit.org>
+
+        Really fix the windows build.
+
+        * bindings/js/JSBindingsAllInOne.cpp:
+
+2010-06-30  Sam Weinig  <sam@webkit.org>
+
+        Another Chromium build fix.
+
+        * page/DOMWindow.idl:
+
+2010-06-30  Sam Weinig  <sam@webkit.org>
+
+        Fix Chromium build.
+
+        * WebCore.gyp/WebCore.gyp:
+
+2010-06-30  Sam Weinig  <sam@webkit.org>
+
+        Fix Windows build.
+
+        * bindings/js/JSBindingsAllInOne.cpp:
+
+2010-06-30  Sam Weinig  <sam@webkit.org>
+
+        Fix Gtk build.
+
+        * GNUmakefile.am:
+
+2010-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41146
+        <rdar://problem/8126069>
+        Implement the .dataset DOM property
+
+        Tests: fast/dom/dataset-xhtml.xhtml
+               fast/dom/dataset.html
+
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMStringMapCustom.cpp: Added.
+        (WebCore::JSDOMStringMap::canGetItemsForName):
+        (WebCore::JSDOMStringMap::nameGetter):
+        (WebCore::JSDOMStringMap::getOwnPropertyNames):
+        (WebCore::JSDOMStringMap::deleteProperty):
+        (WebCore::JSDOMStringMap::putDelegate):
+        * bindings/js/JSDOMStringMapCustom.h: Added.
+        * dom/DOMStringMap.cpp: Added.
+        (WebCore::DOMStringMap::~DOMStringMap):
+        * dom/DOMStringMap.h: Added.
+        (WebCore::DOMStringMap::DOMStringMap):
+        * dom/DOMStringMap.idl: Added.
+        * dom/DatasetDOMStringMap.cpp: Added.
+        (WebCore::isValidAttributeName):
+        (WebCore::convertAttributeNameToPropertyName):
+        (WebCore::propertyNameMatchesAttributeName):
+        (WebCore::isValidPropertyName):
+        (WebCore::convertPropertyNameToAttributeName):
+        (WebCore::DatasetDOMStringMap::ref):
+        (WebCore::DatasetDOMStringMap::deref):
+        (WebCore::DatasetDOMStringMap::getNames):
+        (WebCore::DatasetDOMStringMap::item):
+        (WebCore::DatasetDOMStringMap::contains):
+        (WebCore::DatasetDOMStringMap::setItem):
+        (WebCore::DatasetDOMStringMap::deleteItem):
+        * dom/DatasetDOMStringMap.h: Added.
+        (WebCore::DatasetDOMStringMap::create):
+        (WebCore::DatasetDOMStringMap::DatasetDOMStringMap):
+        * dom/Element.cpp:
+        (WebCore::Element::dataset):
+        * dom/Element.h:
+        * dom/Element.idl:
+        * dom/ElementRareData.h:
+        * page/DOMWindow.idl:
+
+2010-06-30  Darin Adler  <darin@apple.com>
+
+        More Qt build fix.
+
+        * html/HTMLElementStack.cpp: Put !ENABLE(SVG_FOREIGN_OBJECT) around
+        include of SVGNames.h too.
+
+2010-06-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Add assertion, off by default, for when you forget to do adoptRef
+        https://bugs.webkit.org/show_bug.cgi?id=41422
+
+        * platform/TreeShared.h: Added code to require adoption and assert if
+        you don't call adoptRef. For now, it is turned off because of the
+        LOOSE_TREE_SHARED define in this header. Later we can turn it on
+        once we get everything working without asserting. Note also that it
+        only works for objects with an initial reference count of 1.
+
+2010-06-30  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Buildfix for !ENABLE(SVG_FOREIGN_OBJECT) after r62196.
+        https://bugs.webkit.org/show_bug.cgi?id=41429
+
+        * html/HTMLElementStack.cpp:
+
+2010-06-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add new popUntil(tagName) function and deploy
+        https://bugs.webkit.org/show_bug.cgi?id=41405
+
+        Add a new popUntil function to share some common code
+        between states.  There is more code to share here, but this
+        is a start.
+
+        I also filled in a couple similar states to these with the
+        hope of sharing more code, but decided to wait for a later
+        patch.
+
+        No test changes, since this code doesn't do enough yet to
+        pass any more subtests.  Lack of generateImpliedEndTags is the main
+        blocking issue.
+
+        * html/HTMLElementStack.cpp:
+        (WebCore::HTMLElementStack::popUntil):
+        * html/HTMLElementStack.h:
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndTag):
+
+2010-06-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Unit test for DOM insertion methods
+        https://bugs.webkit.org/show_bug.cgi?id=40495
+
+        Fix typo in custom function detection method.
+
+        * bindings/scripts/CodeGeneratorGObject.pm:
+
+2010-06-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Implement HTML5 "in scope" algorithm and attempt to use it
+        https://bugs.webkit.org/show_bug.cgi?id=41402
+
+        Implemented the 4 needed "in scope" functions for HTML5.
+        3 for the different sets of scope markers, and one for
+        doing exact element comparisons instead of tag name searches.
+
+        I deployed inScope("body") for </body> and </html> in InBody.
+
+        Adds two new (expected) failures, since we're now
+        switching out of InBody to AfterBody when seeing
+        </html>.  We don't implement AfterBody yet, so
+        the rest of the content after </html> is ignored.
+
+        * html/HTMLElementStack.cpp:
+        (WebCore::inScopeCommon):
+        (WebCore::HTMLElementStack::inScope):
+        (WebCore::HTMLElementStack::inListItemScope):
+        (WebCore::HTMLElementStack::inTableScope):
+        * html/HTMLElementStack.h:
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processBodyEndTagForInBody):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Split HTMLElementStack out into its own file
+        https://bugs.webkit.org/show_bug.cgi?id=41399
+
+        No functional change, thus no tests.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/HTMLElementStack.cpp: Added.
+        (WebCore::HTMLElementStack::ElementRecord::ElementRecord):
+        (WebCore::HTMLElementStack::ElementRecord::element):
+        (WebCore::HTMLElementStack::ElementRecord::next):
+        (WebCore::HTMLElementStack::ElementRecord::releaseNext):
+        (WebCore::HTMLElementStack::ElementRecord::setNext):
+        (WebCore::HTMLElementStack::HTMLElementStack):
+        (WebCore::HTMLElementStack::~HTMLElementStack):
+        (WebCore::HTMLElementStack::popHTMLHeadElement):
+        (WebCore::HTMLElementStack::pop):
+        (WebCore::HTMLElementStack::pushHTMLHtmlElement):
+        (WebCore::HTMLElementStack::pushHTMLHeadElement):
+        (WebCore::HTMLElementStack::pushHTMLBodyElement):
+        (WebCore::HTMLElementStack::push):
+        (WebCore::HTMLElementStack::top):
+        (WebCore::HTMLElementStack::removeHTMLHeadElement):
+        (WebCore::HTMLElementStack::remove):
+        (WebCore::HTMLElementStack::contains):
+        (WebCore::HTMLElementStack::inScope):
+        (WebCore::HTMLElementStack::htmlElement):
+        (WebCore::HTMLElementStack::headElement):
+        (WebCore::HTMLElementStack::bodyElement):
+        (WebCore::HTMLElementStack::pushCommon):
+        (WebCore::HTMLElementStack::popCommon):
+        (WebCore::HTMLElementStack::removeNonFirstCommon):
+        * html/HTMLElementStack.h: Added.
+        * html/HTMLTreeBuilder.h:
+
+2010-06-30  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Oliver Hunt.
+
+        WebCore::WebGLArrayInternal::lengthAttrGetter ReadAV@NULL (b1a3e1a3e9d01f17fd493d68eeb2742f)
+        https://bugs.webkit.org/show_bug.cgi?id=38040
+
+        Changed custom ArrayBufferView constructors to create a
+        fully-initialized, zero-length array when called with zero
+        arguments. This is the simplest fix which works identically in
+        both the JSC and V8 bindings.
+
+        Test: fast/canvas/webgl/array-buffer-view-crash.html
+
+        * bindings/js/JSArrayBufferViewHelper.h:
+        (WebCore::constructArrayBufferView):
+        * bindings/v8/custom/V8ArrayBufferViewCustom.h:
+        (WebCore::constructWebGLArray):
+
+2010-06-30  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] update webcore gyp to use v8 dll for chromium multi dll build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41376
+
+        * WebCore.gyp/WebCore.gyp:
+
+2010-06-30  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        [Chromium] Add OOP font loading to FontPlatformDataChromiumMac.
+
+        On OS X, with font management software installed. Fonts
+        can reside in an arbitrary path on disk which is blocked by
+        Chromium's sandbox.
+
+        This change adds hooks to FontPlaformData which allow cross-process
+        font loading in case of need.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41148
+
+        Not possible to test - requires sandboxing which DRT doesn't support.
+
+        * WebCore.gypi:
+        * platform/graphics/chromium/FontPlatformDataChromiumMac.mm: Added.
+        (WebCore::FontPlatformData::FontPlatformData):
+        (WebCore::FontPlatformData::~FontPlatformData):
+        (WebCore::FontPlatformData::operator=):
+        (WebCore::FontPlatformData::setFont):
+        (WebCore::FontPlatformData::roundsGlyphAdvances):
+        (WebCore::FontPlatformData::allowsLigatures):
+        (WebCore::FontPlatformData::description):
+
+2010-06-30  Jeremy Moskovich  <jeremy@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        Minor tweaks to FontPlatformDataMac & SimpleFontDataMac.mm
+
+        * Avoid an extra FontPlatformData copy in SimpleFontDataMac.mm
+        * Fix a typo in FontPlatformDataMac.mm
+
+        https://bugs.webkit.org/show_bug.cgi?id=41152
+
+        No behavior changes so no new tests.
+
+        * platform/graphics/mac/FontPlatformDataMac.mm:
+        (WebCore::FontPlatformData::description):
+        * platform/graphics/mac/SimpleFontDataMac.mm:
+        (WebCore::copyFontTableForTag):
+
+2010-06-30  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Make "disallow multiple calls to SetWindow" on windowed plugins a quirk
+        https://bugs.webkit.org/show_bug.cgi?id=41407
+
+        Only disallow calling SetWindow more than once if we're using Flash 9 or older.
+        This fixes resizing of YouTube videos via the player's own button.
+
+        Removed copy-pasted logic in PluginViewGtk since the issue only exists
+        when running Flash with a non-Gtk toolkit.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        * plugins/PluginQuirkSet.h:
+        (WebCore::):
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded): Remove unnecessary logic copy-pasted from PluginViewQt.
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2010-06-30  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt, Gtk, Symbian] Mind the semantics of NPRect for windowed plugin clip rects
+        https://bugs.webkit.org/show_bug.cgi?id=41406
+
+        NPRect has right/bottom instead of width/height.
+        This was fixed in PluginViewMac with http://trac.webkit.org/changeset/45815
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::setNPWindowIfNeeded):
+
+2010-06-30  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        Spatial Navigation: make elements in inner frames nested more than 1 level deep focusable
+        https://bugs.webkit.org/show_bug.cgi?id=41160
+
+        Patch addresses the problem of spatial navigation not work properly with nested
+        inner frames by adding the isNodeDeepDescendantOfDocument method. It recursively checks
+        if a give node is descendant of a given document or any parent of it.
+
+        Test: fast/events/spatial-navigation/snav-iframe-nested.html
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::deepFindFocusableNodeInDirection):
+        * page/SpatialNavigation.cpp:
+        (WebCore::isNodeDeepDescendantOfDocument):
+        * page/SpatialNavigation.h:
+
+2010-06-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        HTMLTokenizer should use fewer macros
+        https://bugs.webkit.org/show_bug.cgi?id=41397
+
+        Macros are sadness.  Inline functions are the new hotness.
+
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::processEntity):
+        (WebCore::HTMLTokenizer::emitAndResumeIn):
+        (WebCore::HTMLTokenizer::emitAndReconsumeIn):
+        (WebCore::HTMLTokenizer::emitEndOfFile):
+        (WebCore::HTMLTokenizer::flushBufferedEndTag):
+        (WebCore::HTMLTokenizer::flushEmitAndResumeIn):
+        (WebCore::HTMLTokenizer::nextToken):
+        (WebCore::HTMLTokenizer::bufferCharacter):
+        (WebCore::HTMLTokenizer::bufferCodePoint):
+        (WebCore::HTMLTokenizer::bufferParseError):
+        (WebCore::HTMLTokenizer::bufferCurrentToken):
+        (WebCore::HTMLTokenizer::bufferEndOfFile):
+        * html/HTMLTokenizer.h:
+
+2010-06-30  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Remove dead binding code
+        https://bugs.webkit.org/show_bug.cgi?id=41388
+
+        Removed BindingElement because it was obsoleted by r59866.
+
+        * WebCore.gypi:
+        * bindings/generic/BindingElement.h: Removed.
+        * bindings/v8/SerializedScriptValue.cpp:
+        * bindings/v8/V8Binding.h:
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        * bindings/v8/custom/V8DatabaseSyncCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
+
+2010-06-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        HTMLTokenizer needs EndOfFile support
+        https://bugs.webkit.org/show_bug.cgi?id=41344
+
+        EndOfFile support uncovered a bug in our implementation of finish().
+        finish() may be called more than once if the first call does not
+        result in end() being called (and parsing thus actually stopping).
+
+        SegmentedString::close() should have ASSERTed that it was not already
+        closed when close() is called.  I've added such an assert now.
+
+        * html/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::finish):
+        * platform/text/SegmentedString.cpp:
+        (WebCore::SegmentedString::close):
+        * platform/text/SegmentedString.h:
+
+2010-06-29  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        HTMLTokenizer needs EndOfFile support
+        https://bugs.webkit.org/show_bug.cgi?id=41344
+
+        We're using \0 as the EndOfFile marker as HTML5 replaces
+        all other \0 with \0xFFFD.  Added some special case logic
+        to InputStreamPreprocessor::peek not to replace \0 when
+        its being used at the end of a stream.
+
+        This fixed 60 subtests in html5lib/runner.html.
+
+        There are still at least two states (BogusCommentState and
+        CDATASectionState) which do not have proper EOF support.
+
+        * html/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::finish):
+        (WebCore::HTMLDocumentParser::finishWasCalled):
+        * html/HTMLInputStream.h:
+        (WebCore::HTMLInputStream::markEndOfFile):
+        (WebCore::HTMLInputStream::haveSeenEndOfFile):
+        * html/HTMLToken.h:
+        (WebCore::HTMLToken::makeEndOfFile):
+        * html/HTMLTokenizer.cpp:
+        (WebCore::HTMLTokenizer::nextToken):
+        (WebCore::HTMLTokenizer::emitEndOfFile):
+        * html/HTMLTokenizer.h:
+        (WebCore::HTMLTokenizer::InputStreamPreprocessor::peek):
+        (WebCore::HTMLTokenizer::InputStreamPreprocessor::shouldTreatNullAsEndOfFileMarker):
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::passTokenToLegacyParser):
+
+2010-06-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Teach HTML5TreeBuilder how to merge attributes from extra html/body elements
+        https://bugs.webkit.org/show_bug.cgi?id=41337
+
+        Had to teach ElementStack to store pointers to html, head, and body
+        elements.
+
+        This fixed a few tests in LayoutTests/html5lib.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::insertHTMLStartTagBeforeHTML):
+        (WebCore::HTMLTreeBuilder::mergeAttributesFromTokenIntoElement):
+        (WebCore::HTMLTreeBuilder::insertHTMLStartTagInBody):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::createElementAndAttachToCurrent):
+        (WebCore::HTMLTreeBuilder::insertHTMLHtmlElement):
+        (WebCore::HTMLTreeBuilder::insertHTMLHeadElement):
+        (WebCore::HTMLTreeBuilder::insertHTMLBodyElement):
+        (WebCore::HTMLTreeBuilder::insertElement):
+        (WebCore::HTMLTreeBuilder::insertGenericRCDATAElement):
+        (WebCore::HTMLTreeBuilder::insertGenericRawTextElement):
+        * html/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::ElementStack::ElementStack):
+        (WebCore::HTMLTreeBuilder::ElementStack::popHTMLHeadElement):
+        (WebCore::HTMLTreeBuilder::ElementStack::pop):
+        (WebCore::HTMLTreeBuilder::ElementStack::pushHTMLHtmlElement):
+        (WebCore::HTMLTreeBuilder::ElementStack::pushHTMLHeadElement):
+        (WebCore::HTMLTreeBuilder::ElementStack::pushHTMLBodyElement):
+        (WebCore::HTMLTreeBuilder::ElementStack::push):
+        (WebCore::HTMLTreeBuilder::ElementStack::removeHTMLHeadElement):
+        (WebCore::HTMLTreeBuilder::ElementStack::remove):
+        (WebCore::HTMLTreeBuilder::ElementStack::htmlElement):
+        (WebCore::HTMLTreeBuilder::ElementStack::headElement):
+        (WebCore::HTMLTreeBuilder::ElementStack::bodyElement):
+        (WebCore::HTMLTreeBuilder::ElementStack::pushCommon):
+        (WebCore::HTMLTreeBuilder::ElementStack::popCommon):
+        (WebCore::HTMLTreeBuilder::ElementStack::removeNonFirstCommon):
+
+2010-06-30  José Millán Soto  <jmillan@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Text attributes not exposed
+        https://bugs.webkit.org/show_bug.cgi?id=25528
+
+        Implemented the get_run_attributes and get_default_attributes
+        functions for the ATK_TEXT role.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (getAttributeSetForAccessibilityObject):
+        (compareAttribute):
+        (attributeSetDifference):
+        (accessibilityObjectLength):
+        (getAccessibilityObjectForOffset):
+        (getRunAttributesFromAccesibilityObject):
+        (webkit_accessible_text_get_run_attributes):
+        (webkit_accessible_text_get_default_attributes):
+
+2010-06-30  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Fix Sec-WebSocketKey{1,2} headers.
+
+        According to WebSocket specification, a value of Sec-WebSocketKey{1,2} header
+        should not start or end with a space.
+
+        WebSocket: Malformed handshake headers in a worker due to rand_s failing
+        https://bugs.webkit.org/show_bug.cgi?id=41327
+
+        No new tests. ASSERT should catch the problem.
+
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::generateSecWebSocketKey):
+
+2010-06-30  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Dan Bernstein.
+
+        Fix for Bug 41339 - unicode-range property only with a descending range
+        causes a crash
+
+        https://bugs.webkit.org/show_bug.cgi?id=41339
+
+        Test: fast/css/font-face-descending-unicode-range.html
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseFontFaceUnicodeRange):
+
+2010-06-29  Abhinav Mithal <abhinav.mithal@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] [Symbian] Fix doube-deallocation while destroying PluginContainerSymbian
+        https://bugs.webkit.org/show_bug.cgi?id=37303
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformDestroy):
+
+2010-06-29  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement getAttachedShaders
+        https://bugs.webkit.org/show_bug.cgi?id=31172
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp: JS binding for getAttachedShaders().
+        (WebCore::JSWebGLRenderingContext::getAttachedShaders):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp: V8 binding for getAttachedShaders().
+        (WebCore::V8WebGLRenderingContext::getAttachedShadersCallback):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::getAttachedShaders): Implementation of getAttachedShaders().
+        (WebCore::WebGLRenderingContext::findShader): Helper function to find a shader object from its name.
+        * html/canvas/WebGLRenderingContext.h: Declaration of getAttachedShaders().
+        * html/canvas/WebGLRenderingContext.idl: Ditto.
+        * platform/graphics/GraphicsContext3D.h: Ditto.
+        * platform/graphics/mac/GraphicsContext3DMac.mm:
+        (WebCore::GraphicsContext3D::getAttachedShaders): Implementation of getAttachedShaders().
+
+2010-06-29  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        REGRESSION: [Chromium] <progress> appearance on windows looks not good
+        https://bugs.webkit.org/show_bug.cgi?id=41343
+        
+        RenderThemeChromiumWin::paintProgressBar() should return false,
+        which indicates the widget is painted.
+        
+        Test: fast/dom/HTMLProgressElement/progress-element.html
+              * rebaselined with a wrong expectation.
+
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintProgressBar):
+
+2010-06-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Jian Li.
+
+        Fix http/tests/local/blob/send-data-blob.html on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=41228
+
+        Fix a regression bug in the line-conversion code.
+        Rewrite the line-conversion function with simpler functions to
+        make it less error prone.
+
+        No new tests as this is for bug fixes.
+
+        * platform/BlobItem.cpp:
+        (WebCore::StringBlobItem::convertToCString):
+
+2010-06-29  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Implementing DatabaseSync::openDatabaseSync().
+        https://bugs.webkit.org/show_bug.cgi?id=40607
+
+        1. Moved some common code from Database to AbstractDatabase.
+        2. Made performOpenAndVerify() virtual, since DatabaseSync doesn't
+           need to interact with DatabaseThread.
+        3. Removed the m_creationCallback field, since it's only needed in
+           the openDatabase{Sync} methods.
+
+        * storage/AbstractDatabase.cpp:
+        (WebCore::retrieveTextResultFromDatabase):
+        (WebCore::setTextValueInDatabase):
+        (WebCore::guidMutex):
+        (WebCore::guidToVersionMap):
+        (WebCore::updateGuidVersionMap):
+        (WebCore::guidToDatabaseMap):
+        (WebCore::guidForOriginAndName):
+        (WebCore::AbstractDatabase::databaseInfoTableName):
+        (WebCore::AbstractDatabase::AbstractDatabase):
+        (WebCore::AbstractDatabase::closeDatabase):
+        (WebCore::AbstractDatabase::version):
+        (WebCore::AbstractDatabase::performOpenAndVerify):
+        (WebCore::AbstractDatabase::scriptExecutionContext):
+        (WebCore::AbstractDatabase::securityOrigin):
+        (WebCore::AbstractDatabase::stringIdentifier):
+        (WebCore::AbstractDatabase::displayName):
+        (WebCore::AbstractDatabase::estimatedSize):
+        (WebCore::AbstractDatabase::fileName):
+        (WebCore::AbstractDatabase::databaseVersionKey):
+        (WebCore::AbstractDatabase::getVersionFromDatabase):
+        (WebCore::AbstractDatabase::setVersionInDatabase):
+        (WebCore::AbstractDatabase::versionMatchesExpected):
+        (WebCore::AbstractDatabase::setExpectedVersion):
+        (WebCore::AbstractDatabase::disableAuthorizer):
+        (WebCore::AbstractDatabase::enableAuthorizer):
+        (WebCore::AbstractDatabase::setAuthorizerReadOnly):
+        (WebCore::AbstractDatabase::lastActionChangedDatabase):
+        (WebCore::AbstractDatabase::lastActionWasInsert):
+        (WebCore::AbstractDatabase::resetDeletes):
+        (WebCore::AbstractDatabase::hadDeletes):
+        (WebCore::AbstractDatabase::resetAuthorizer):
+        * storage/AbstractDatabase.h:
+        (WebCore::AbstractDatabase::opened):
+        (WebCore::AbstractDatabase::isNew):
+        (WebCore::AbstractDatabase::databaseDebugName):
+        * storage/Database.cpp:
+        (WebCore::DatabaseCreationCallbackTask::create):
+        (WebCore::DatabaseCreationCallbackTask::performTask):
+        (WebCore::DatabaseCreationCallbackTask::DatabaseCreationCallbackTask):
+        (WebCore::Database::openDatabase):
+        (WebCore::Database::Database):
+        (WebCore::Database::version):
+        (WebCore::Database::openAndVerifyVersion):
+        (WebCore::Database::close):
+        (WebCore::Database::stop):
+        (WebCore::Database::performOpenAndVerify):
+        * storage/Database.h:
+        (WebCore::Database::sqliteDatabase):
+        * storage/DatabaseAuthorizer.cpp:
+        (WebCore::DatabaseAuthorizer::create):
+        (WebCore::DatabaseAuthorizer::DatabaseAuthorizer):
+        (WebCore::DatabaseAuthorizer::denyBasedOnTableName):
+        * storage/DatabaseAuthorizer.h:
+        * storage/DatabaseSync.cpp:
+        (WebCore::DatabaseSync::openDatabaseSync):
+        (WebCore::DatabaseSync::DatabaseSync):
+        (WebCore::DatabaseSync::~DatabaseSync):
+        (WebCore::DatabaseSync::markAsDeletedAndClose):
+        (WebCore::CloseSyncDatabaseOnContextThreadTask::create):
+        (WebCore::CloseSyncDatabaseOnContextThreadTask::performTask):
+        (WebCore::CloseSyncDatabaseOnContextThreadTask::CloseSyncDatabaseOnContextThreadTask):
+        (WebCore::DatabaseSync::closeImmediately):
+        * storage/DatabaseSync.h:
+        * storage/DatabaseTask.cpp:
+        (WebCore::DatabaseOpenTask::DatabaseOpenTask):
+        (WebCore::DatabaseOpenTask::doPerformTask):
+        * storage/DatabaseTask.h:
+        (WebCore::DatabaseOpenTask::create):
+
+2010-06-29  François Sausset  <sausset@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix a bug when a msubsup element is inside a mrow element
+        https://bugs.webkit.org/show_bug.cgi?id=36525
+
+        Test: mathml/presentation/subsup.xhtml
+
+        * mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::stretchToHeight):
+
+2010-06-29  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        uniformmatrix* should generate INVALID_VALUE with transpose = true
+        https://bugs.webkit.org/show_bug.cgi?id=41235
+
+        Test: fast/canvas/webgl/gl-uniformmatrix4fv.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::uniformMatrix2fv): Call validateUniformMatrixParameters instead.
+        (WebCore::WebGLRenderingContext::uniformMatrix3fv): Ditto.
+        (WebCore::WebGLRenderingContext::uniformMatrix4fv): Ditto.
+        (WebCore::WebGLRenderingContext::validateUniformMatrixParameters): Validate input parameters for uniformMatrix*().
+        * html/canvas/WebGLRenderingContext.h: Declare validateUniformMatrixParameters().
+
+2010-06-29  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Support UNPACK_FLIP_Y_WEBGL and UNPACK_PREMULTIPLY_ALPHA_WEBGL for texImage2D taking ArrayBufferView
+        https://bugs.webkit.org/show_bug.cgi?id=40398
+
+        Added support for UNPACK_FLIP_Y_WEBGL and UNPACK_PREMULTIPLY_ALPHA_WEBGL pixel store
+        parameters to texImage2D and texSubImage2D entry points taking ArrayBufferView.
+        More cleanly separated the unpacking and packing phases of user-supplied pixel data
+        in GraphicsContext3D, and added support for unpack alignment. Fixed bug in handling
+        of unpackAlignment in GraphicsContext3D::flipVertically. Necessarily added
+        validation of the amount of data passed to texImage2D and texSubImage2D. Modified
+        fast/canvas/webgl/tex-image-with-format-and-type.html to include premultiplied alpha
+        tests for relevant source formats; added new test which exercises all combinations
+        of UNPACK_FLIP_Y_WEBGL, UNPACK_PREMULTIPLY_ALPHA_WEBGL, and UNPACK_ALIGNMENT pixel
+        store parameters.
+
+        Test: fast/canvas/webgl/tex-image-and-sub-image-2d-with-array-buffer-view.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::texImage2D):
+        (WebCore::WebGLRenderingContext::texSubImage2D):
+        (WebCore::WebGLRenderingContext::validateTexFuncData):
+        * html/canvas/WebGLRenderingContext.h:
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::extractImageData):
+        (WebCore::GraphicsContext3D::extractTextureData):
+        (WebCore::GraphicsContext3D::flipVertically):
+        (WebCore::doUnpackingAndPacking):
+        (WebCore::computeIncrementParameters):
+        (WebCore::doPacking):
+        (WebCore::GraphicsContext3D::packPixels):
+        * platform/graphics/GraphicsContext3D.h:
+        (WebCore::GraphicsContext3D::):
+        * platform/graphics/cg/GraphicsContext3DCG.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+        * platform/graphics/skia/GraphicsContext3DSkia.cpp:
+        (WebCore::GraphicsContext3D::getImageData):
+
+2010-06-29  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Dirk Schulze.
+
+        Buildfix for !ENABLE(SVG_FOREIGN_OBJECT) after r61667.
+        https://bugs.webkit.org/show_bug.cgi?id=41367
+
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::isOutermostSVG): Add missing ENABLE(SVG_FOREIGN_OBJECT).
+
+2010-06-29  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Buildfix after r62118.
+        https://bugs.webkit.org/show_bug.cgi?id=41365
+
+        * rendering/RenderSVGRoot.cpp: Inlude missing RenderSVGResource.h.
+
+2010-06-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62052.
+        http://trac.webkit.org/changeset/62052
+        https://bugs.webkit.org/show_bug.cgi?id=41357
+
+        Causes crashes in JSLazyEventListener::initializeFunction (see
+        bug 41352) (Requested by aroben on #webkit).
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/js/ScriptEventListener.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/ScriptEventListener.h:
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute):
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute):
+
+2010-06-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62129.
+        http://trac.webkit.org/changeset/62129
+        https://bugs.webkit.org/show_bug.cgi?id=41362
+
+        Needed to roll out r62052 (see bug 41357) (Requested by aroben
+        on #webkit).
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createWindowAttributeEventListener):
+
+2010-06-29  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Speculative fix for <rdar://problem/8071558> CrashTracer: [USER] 
+        2300+ crashes in Safari at com.apple.WebCore: 
+        WebCore::FrameView::scheduleRelayout + 352
+
+        Unfortunately, we don't have a reproducible case for this bug, and 
+        therefore, we do not have a layout test either. It is pretty clear 
+        from the logs that m_frame->settings() is null in 
+        FrameView::scheduleRelayout() in the crashing case. 
+        m_frame->settings() is null whenever page is null. Everywhere else 
+        in FrameView.cpp we null-check either page or settings before using 
+        settings. It seems plausible to me that scheduleRelayout could be 
+        called when page is null, so the fix is just to add null-checks. 
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::scheduleRelayout):
+
+2010-06-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Darin Adler.
+
+        <rdar://problem/7975842> Certain text is repeated after using splitText()
+
+        Tests: fast/text/setData-dirty-lines.html
+               fast/text/splitText-dirty-lines.html
+
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::setData): Call RenderText::setTextWithOffset() rather than
+        setText(), because only the former correctly dirties line boxes.
+        * dom/Text.cpp:
+        (WebCore::Text::splitText): Ditto.
+
+2010-06-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62073.
+        http://trac.webkit.org/changeset/62073
+        https://bugs.webkit.org/show_bug.cgi?id=41359
+
+        Necessary to fix chromium build when r62052 is rolled out.
+        (Requested by dave_levin on #webkit).
+
+        * bindings/v8/ScriptEventListener.h:
+
+2010-06-29  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Hooking up WebGL layers to the gpu-compositor. Implement missing
+        methods to set the contents of a GraphicsLayer with a platform specific WebGL
+        Layer, and to update the contents of the WebGL Layer when needed.
+        https://bugs.webkit.org/show_bug.cgi?id=41243
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/chromium/GraphicsLayerChromium.cpp:
+        (WebCore::GraphicsLayerChromium::setContentsToWebGL):
+        * platform/graphics/chromium/GraphicsLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::removeAllSublayers):
+          No need to call setNeedsCommit() from here as the previous call to
+          layer->removeFromSuperlayer() will have that effect (and we only need
+          to notify the owner if there were actually any sublayers removed).
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayer):
+        * platform/graphics/chromium/WebGLLayerChromium.cpp:
+        (WebCore::WebGLLayerChromium::create):
+        (WebCore::WebGLLayerChromium::updateTextureContents):
+        (WebCore::WebGLLayerChromium::setContext):
+
+2010-06-29  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Buildfix for --minimal build after r62052
+        https://bugs.webkit.org/show_bug.cgi?id=41338
+
+        * bindings/js/ScriptEventListener.cpp: #if ENABLE(SVG) guards added.
+        (WebCore::createWindowAttributeEventListener):
+
+2010-06-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Build fix. Not reviewd.
+
+        CGColor is only used for PLATFORM(CG).  Conditionalize include
+        to correct build failure for WinCairo.
+
+        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp:
+        Conditionalize use of CGColor.
+
+2010-06-29  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Clean up the source lists in the GNUMakefile.am files
+        https://bugs.webkit.org/show_bug.cgi?id=41229
+
+        Clean up the GNUMakefile.am a little bit. Alphabetize and conglomerate
+        the source lists.
+
+        * GNUmakefile.am:
+
+2010-06-29  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] DragDataGtk should use DataObjectGtk as the platformDragData
+        https://bugs.webkit.org/show_bug.cgi?id=40307
+
+        Use DataObjectGtk as the platformDragData for DragDataGtk. DataObjectGtk
+        contains all the information necessary to keep track of drops in progress.
+
+        * platform/DragData.h: Use a DataObjectGtk* as the platform drag data.
+        * platform/gtk/DragDataGtk.cpp:
+        (WebCore::DragData::containsFiles): Retrieve information via platformDragData.
+        (WebCore::DragData::asFilenames): Ditto.
+        (WebCore::DragData::containsPlainText): Ditto.
+        (WebCore::DragData::asPlainText): Ditto.
+        (WebCore::DragData::createClipboard): Create the Clipboard with the platformDragData.
+        (WebCore::DragData::containsCompatibleContent): Retrieve information via platformDragData.
+        (WebCore::DragData::containsURL): Ditto.
+        (WebCore::DragData::asURL): Ditto.
+        (WebCore::DragData::asFragment): Ditto.
+
+2010-06-29  Adam Langley  <agl@chromium.org>
+
+        Build fix. Not reviewd.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::setupPaint):
+          The name of the Skia function changed between writing this patch and
+          commiting it.
+
+2010-06-29  Adam Langley  <agl@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] Support forced autohinting.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40493
+
+        Freetype (the typical font rendering on Linux) includes an 'autohinter':
+        an algorithm for hinting glyph shapes without using the embedded hinting
+        bytecode in a font.
+
+        Some people prefer the autohinter's results, so we support forcing its
+        use.
+
+        This change also fixes a bug where two FontPlatformData structures would
+        compare equal, even if their rendering styles were different.
+
+        * platform/graphics/chromium/FontPlatformDataLinux.cpp:
+        (WebCore::FontPlatformData::setupPaint):
+          In order to compare FontPlatformData structures we need to make sure
+          that they are initialised.
+        (WebCore::FontPlatformData::operator==):
+        * platform/graphics/chromium/FontRenderStyle.h:
+        (WebCore::FontRenderStyle::FontRenderStyle):
+        (WebCore::FontRenderStyle::operator==):
+          This fixes the case where two FontPlatformData structures, differing
+          only by rendering style, would compare equal.
+
+2010-06-29  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed, Symbian build fix.
+
+        Add more directories to USERINCLUDE so that they get included
+        before the Symbian system headers.
+
+        This is a workaround to some toolchain problems; bug 31273 is used to
+        find a better solution.
+
+        No new tests as there is no new functionality.
+
+        * WebCore.pro:
+
+2010-06-29  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Cleanup SVGRenderSupport
+        https://bugs.webkit.org/show_bug.cgi?id=41347
+
+        Remove SVGRenderBase base class from all SVG renderers. It was meant as temporary solution until all SVG renderers inherit from RenderSVGModelObject,
+        though this is not going to happen. RenderSVGModelObject inherits from RenderObject, making it impossible to inherit eg. RenderSVGImage from it, as
+        it already indirectly inherits from RenderObject, through RenderImage. Other examples are RenderForeignObject (RenderBlock inheritance),
+        RenderSVGInlineText (RenderText inheritance) etc.
+
+        Rename SVGRenderBase to SVGRenderSupport, just like the file is named, remove all free functions, and make them all static functions in SVGRenderSupport.
+        We can still share code between all SVG renderers, but don't need a special base class for all renderers -> shrink size of all SVG renderers.
+
+        Doesn't affect any test.
+
+        * rendering/RenderBox.cpp: Remove localTransform() override, not needed at all.
+        * rendering/RenderBox.h: Ditto.
+        * rendering/RenderForeignObject.cpp: s/SVGRenderBase/SVGRenderSupport/
+        (WebCore::RenderForeignObject::paint):
+        (WebCore::RenderForeignObject::clippedOverflowRectForRepaint):
+        (WebCore::RenderForeignObject::computeRectForRepaint):
+        (WebCore::RenderForeignObject::nodeAtFloatPoint):
+        (WebCore::RenderForeignObject::mapLocalToContainer):
+        * rendering/RenderPath.cpp:
+        (WebCore::BoundingRectStrokeStyleApplier::strokeStyle): applyStrokeStyleToContext is a static function in SVGRenderSupport now.
+        (WebCore::RenderPath::paint): s/SVGRenderBase/SVGRenderSupport/
+        (WebCore::RenderPath::nodeAtFloatPoint): Ditto.
+        (WebCore::RenderPath::updateCachedBoundaries): Ditto.
+        * rendering/RenderSVGBlock.h: Remove SVGRenderBase inheritance.
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::layout): layoutChildren is a static function in SVGRenderSupport now.
+        (WebCore::RenderSVGContainer::paint): prepareToRenderSVGContent/finishRenderSVGContent are now static functions in SVGRenderSupport.
+        (WebCore::RenderSVGContainer::objectBoundingBox): computeContainerBoundingBox is a static function in SVGRenderSupport now.
+        (WebCore::RenderSVGContainer::strokeBoundingBox): Ditto.
+        (WebCore::RenderSVGContainer::repaintRectInLocalCoordinates): Remove call to computeContainerBoundingBox, use strokeBoundingBox instead, for consistency.
+        (WebCore::RenderSVGContainer::nodeAtFloatPoint): pointInClippingArea is a static function in SVGRenderSupport now.
+        * rendering/RenderSVGHiddenContainer.cpp:
+        (WebCore::RenderSVGHiddenContainer::layout): layoutChildren is a static function in SVGRenderSupport now.
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint): prepareToRenderSVGContent/finishRenderSVGContent are static functions in SVGRenderSupport now.
+        (WebCore::RenderSVGImage::destroy): deregisterResource was renamed to invalidateAllResourcesOfRenderer and is a static function in SVGRenderSupport. 
+        (WebCore::RenderSVGImage::nodeAtFloatPoint): pointInClippingArea is a static function in SVGRenderSupport now.
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates): intersectRepaintRectWithResources is a static function in SVGRenderSupport now.
+        (WebCore::RenderSVGImage::clippedOverflowRectForRepaint): s/SVGRenderBase/SVGRenderSupport/
+        (WebCore::RenderSVGImage::computeRectForRepaint): Ditto.
+        (WebCore::RenderSVGImage::mapLocalToContainer): Ditto.
+        * rendering/RenderSVGImage.h: Remove SVGRenderBase inheritance.
+        * rendering/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::objectBoundingBox): findTextRootObject is a static function in SVGRenderSupport now.
+        (WebCore::RenderSVGInline::strokeBoundingBox): Ditto.
+        (WebCore::RenderSVGInline::repaintRectInLocalCoordinates): Ditto.
+        (WebCore::RenderSVGInline::clippedOverflowRectForRepaint): s/SVGRenderBase/SVGRenderSupport/
+        (WebCore::RenderSVGInline::computeRectForRepaint): Ditto,.
+        (WebCore::RenderSVGInline::mapLocalToContainer): Ditto.
+        (WebCore::RenderSVGInline::absoluteQuads): findTextRootObject is a static function in SVGRenderSupport now.
+        * rendering/RenderSVGInline.h: Remove SVGRenderBase inheritance.
+        * rendering/RenderSVGModelObject.cpp:
+        (WebCore::RenderSVGModelObject::clippedOverflowRectForRepaint): s/SVGRenderBase/SVGRenderSupport/
+        (WebCore::RenderSVGModelObject::computeRectForRepaint): Ditto.
+        (WebCore::RenderSVGModelObject::mapLocalToContainer): Ditto.
+        (WebCore::RenderSVGModelObject::destroy): deregisterResource was renamed to invalidateAllResourcesOfRenderer and is a static function in SVGRenderSupport.
+        * rendering/RenderSVGModelObject.h: Remove SVGRenderBase inheritance.
+        * rendering/RenderSVGResource.cpp:
+        (WebCore::invalidatePaintingResource): Moved here from SVGRenderSupport (static inline helper function).
+        (WebCore::RenderSVGResource::invalidateAllResourcesOfRenderer): Moved here from SVGRenderSupport and renamed from deregisterFromResources.
+        * rendering/RenderSVGResource.h: Expose invalidateAllResourcesOfRenderer function.
+        * rendering/RenderSVGResourceClipper.cpp:
+        (WebCore::RenderSVGResourceClipper::createClipData): renderSubtreeToImage is a static function in SVGRenderSupport now.
+        (WebCore::RenderSVGResourceClipper::hitTestClipContent): Ditto.
+        * rendering/RenderSVGResourceGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient): findTextRootObject is a static function in SVGRenderSupport now.
+        (WebCore::clipToTextMask): Ditto.
+        (WebCore::RenderSVGResourceGradient::applyResource): applyStrokeStyleToContext is a static function in SVGRenderSupport now.
+        (WebCore::RenderSVGResourceGradient::postApplyResource): findTextRootObject is a static function in SVGRenderSupport now.
+        * rendering/RenderSVGResourceMarker.cpp:
+        (WebCore::RenderSVGResourceMarker::applyViewportClip): s/SVGRenderBase/SVGRenderSupport/
+        * rendering/RenderSVGResourceMasker.cpp:
+        (WebCore::RenderSVGResourceMasker::createMaskImage): renderSubtreeToImage is a static function in SVGRenderSupport now.
+        * rendering/RenderSVGResourcePattern.cpp:
+        (WebCore::RenderSVGResourcePattern::applyResource): applyStrokeStyleToContext is a static function in SVGRenderSupport now.
+        (WebCore::clampImageBufferSizeToViewport): Moved here from SVGRenderSupport.
+        (WebCore::RenderSVGResourcePattern::createTileImage): renderSubtreeToImage is a static function in SVGRenderSupport now.
+        * rendering/RenderSVGResourceSolidColor.cpp:
+        (WebCore::RenderSVGResourceSolidColor::applyResource): applyStrokeStyleToContext is a static function in SVGRenderSupport now
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::layout): layoutChildren is a static function in SVGRenderSupport now.
+        (WebCore::RenderSVGRoot::paint): prepareToRenderSVGContent/finishRenderSVGContent are now static functions in SVGRenderSupport.
+        (WebCore::RenderSVGRoot::destroy): deregisterResource was renamed to invalidateAllResourcesOfRenderer and is a static function in SVGRenderSupport.
+        (WebCore::RenderSVGRoot::repaintRectInLocalCoordinates): Remove call to computeContainerBoundingBox, use strokeBoundingBox instead, for consistency.
+        * rendering/RenderSVGRoot.h: Remove localTransform() override, no longer needed. Remove SVGRenderBase inheritance.
+        (WebCore::RenderSVGRoot::objectBoundingBox): Inlined for speeed. 
+        (WebCore::RenderSVGRoot::strokeBoundingBox): computeContainerBoundingBox is a static function in SVGRenderSupport now.
+        * rendering/RenderSVGText.cpp: 
+        (WebCore::RenderSVGText::clippedOverflowRectForRepaint): s/SVGRenderBase/SVGRenderSupport/
+        (WebCore::RenderSVGText::computeRectForRepaint): Ditto.
+        (WebCore::RenderSVGText::mapLocalToContainer): Ditto.
+        (WebCore::RenderSVGText::nodeAtFloatPoint): pointInClippingArea is a static function in SVGRenderSupport now.
+        (WebCore::RenderSVGText::destroy): deregisterResource was renamed to invalidateAllResourcesOfRenderer and is a static function in SVGRenderSupport.
+        (WebCore::RenderSVGText::repaintRectInLocalCoordinates): intersectRepaintRectWithResources is a static function in SVGRenderSupport now.
+        * rendering/RenderSVGViewportContainer.cpp:
+        (WebCore::RenderSVGViewportContainer::applyViewportClip): s/SVGRenderBase/SVGRenderSupport/
+        (WebCore::RenderSVGViewportContainer::pointIsInsideViewportClip): pointInClippingArea is a static function in SVGRenderSupport now.
+        * rendering/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::paint): prepareToRenderSVGContent/finishRenderSVGContent are now static functions in SVGRenderSupport.
+        * rendering/SVGRenderSupport.cpp: Make it impossible to construct the class. Remove virtual destructor, made all methods static.
+        (WebCore::SVGRenderSupport::clippedOverflowRectForRepaint): s/SVGRenderBase/SVGRenderSupport/
+        (WebCore::SVGRenderSupport::computeRectForRepaint): Ditto.
+        (WebCore::SVGRenderSupport::mapLocalToContainer): Ditto.
+        (WebCore::SVGRenderSupport::prepareToRenderSVGContent): Ditto.
+        (WebCore::SVGRenderSupport::finishRenderSVGContent): Ditto.
+        (WebCore::SVGRenderSupport::renderSubtreeToImage): Made static.
+        (WebCore::SVGRenderSupport::computeContainerBoundingBox): Ditto.
+        (WebCore::SVGRenderSupport::layoutChildren): Ditto.
+        (WebCore::SVGRenderSupport::isOverflowHidden): s/SVGRenderBase/SVGRenderSupport/
+        (WebCore::SVGRenderSupport::intersectRepaintRectWithResources): Ditto.
+        (WebCore::SVGRenderSupport::pointInClippingArea): Made static.
+        (WebCore::SVGRenderSupport::dashArrayFromRenderingStyle): Ditto.
+        (WebCore::SVGRenderSupport::applyStrokeStyleToContext): Ditto.
+        (WebCore::SVGRenderSupport::findTextRootObject): Ditto.
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeStyle): dashArrayFromRenderingStyle is a static function in SVGRenderSupport now.
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::paint): s/SVGRenderBase/SVGRenderSupport/
+        * rendering/SVGRootInlineBox.h: Remove SVGRenderBase inheritance.
+        * svg/SVGFEImageElement.cpp: Add RenderObject.h include, otherwhise it won't build anymore.
+        (WebCore::SVGFEImageElement::build): renderSubtreeToImage is a static function in SVGRenderSupport now.
+        * svg/SVGStyledElement.cpp: 
+        (WebCore::SVGStyledElement::svgAttributeChanged): deregisterResource was renamed to invalidateAllResourcesOfRenderer and is a static function in SVGRenderSupport.
+
+2010-06-21  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [PNG decoder] direct access to jmpbuf is deprecated in libpng >= 1.4.0beta103
+        https://bugs.webkit.org/show_bug.cgi?id=40907
+
+        Define a JMPBUF macro to cope with deprecation of the jmpbuf
+        attribute in libpng >= 1.4.
+
+        * platform/image-decoders/png/PNGImageDecoder.cpp:
+        (WebCore::decodingFailed):
+        (WebCore::PNGImageReader::decode):
+        (WebCore::PNGImageDecoder::headerAvailable):
+        (WebCore::PNGImageDecoder::rowAvailable):
+
+2010-06-29  Kristian Amlie  <kristian.amlie@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt/Symbian] Fixed deployment paths for WebKit declarative plugin.
+
+        * WebCore.pro:
+
+2010-06-29  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed: Chromium Win and Mac build fix.
+
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+
+2010-06-29  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Move PaintInfo/PaintPhase into their own headers, out of RenderObject
+        https://bugs.webkit.org/show_bug.cgi?id=41342
+
+        1) Move enums PaintPhase/PaintBehaviorFlags and the PaintBehaviour typedef from RenderObject into PaintPhase.h.
+           Move PaintInfo from RenderObject into PaintInfo.h. Replace s/RenderObject::PaintInfo/PaintInfo/ throughout WebCore/.
+           Also move the OverlapTestRequestMap typedef into PaintInfo.h, and replace s/RenderObject::OverlapTestRequestMap/OverlapTestRequestMap/ everywhere.
+
+        2) Move "RenderObject* paintingRootForChildren(PaintInfo& paintInfo) const" from RenderObject to PaintInfo
+           and modify it to take a renderer: "void updatePaintingRootForChildren(const RenderObject* renderer)".
+
+        This changes a common idiom:
+        -    info.paintingRoot = paintingRootForChildren(paintInfo);
+        +    info.updatePaintingRootForChildren(this);
+
+        We save resetting the paintingRoot to 0 if it was 0 already and thus do less work.
+
+        3) Move "bool shouldPaintWithinRoot(PaintInfo& paintInfo) const" from RenderObject to PaintInfo
+           and modify it to take a renderer: "bool shouldPaintWithinRoot(const RenderObject* renderer) const".
+
+        This changes a common idiom:
+        -    if (!shouldPaintWithinRoot(paintInfo))
+        +    if (!paintInfo.shouldPaintWithinRoot(this))
+
+        4) Move "void applyTransformToPaintInfo(RenderObject::PaintInfo&, const AffineTransform& localToChildTransform)"
+           from SVGRenderSupport to PaintInfo and rename it to "applyTransform", guarded with ENABLE(SVG) blocks.
+
+        This changes a common idiom:
+        -    applyTransformToPaintInfo(childPaintInfo, localToParentTransform());
+        +    childPaintInfo.applyTransform(localToParentTransform());
+
+        Add PaintInfo.h / PaintPhase.h to all build systems that list headers.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/android/RenderThemeAndroid.cpp:
+        (WebCore::getCanvasFromInfo):
+        (WebCore::RenderThemeAndroid::paintCheckbox):
+        (WebCore::RenderThemeAndroid::paintButton):
+        (WebCore::RenderThemeAndroid::paintRadio):
+        (WebCore::RenderThemeAndroid::paintTextField):
+        (WebCore::RenderThemeAndroid::paintTextArea):
+        (WebCore::RenderThemeAndroid::paintSearchField):
+        (WebCore::RenderThemeAndroid::paintCombo):
+        (WebCore::RenderThemeAndroid::paintMenuList):
+        (WebCore::RenderThemeAndroid::paintMenuListButton):
+        * platform/android/RenderThemeAndroid.h:
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintThemePart):
+        (WebCore::RenderThemeEfl::paintCheckbox):
+        (WebCore::RenderThemeEfl::paintRadio):
+        (WebCore::RenderThemeEfl::paintButton):
+        (WebCore::RenderThemeEfl::paintMenuList):
+        (WebCore::RenderThemeEfl::paintTextField):
+        (WebCore::RenderThemeEfl::paintTextArea):
+        (WebCore::RenderThemeEfl::paintSearchFieldDecoration):
+        (WebCore::RenderThemeEfl::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeEfl::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeEfl::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeEfl::paintSearchField):
+        * platform/efl/RenderThemeEfl.h:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozillaGtkWidget):
+        (WebCore::RenderThemeGtk::paintCheckbox):
+        (WebCore::RenderThemeGtk::paintRadio):
+        (WebCore::RenderThemeGtk::paintButton):
+        (WebCore::RenderThemeGtk::paintMenuList):
+        (WebCore::RenderThemeGtk::paintTextField):
+        (WebCore::RenderThemeGtk::paintTextArea):
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeGtk::paintSearchField):
+        (WebCore::RenderThemeGtk::paintSliderTrack):
+        (WebCore::RenderThemeGtk::paintSliderThumb):
+        (WebCore::RenderThemeGtk::paintMediaFullscreenButton):
+        (WebCore::RenderThemeGtk::paintMediaMuteButton):
+        (WebCore::RenderThemeGtk::paintMediaPlayButton):
+        (WebCore::RenderThemeGtk::paintMediaSeekBackButton):
+        (WebCore::RenderThemeGtk::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeGtk::paintMediaSliderTrack):
+        (WebCore::RenderThemeGtk::paintMediaSliderThumb):
+        (WebCore::RenderThemeGtk::paintProgressBar):
+        * platform/gtk/RenderThemeGtk.h:
+        * platform/haiku/RenderThemeHaiku.cpp:
+        (WebCore::RenderThemeHaiku::paintCheckbox):
+        (WebCore::RenderThemeHaiku::paintRadio):
+        (WebCore::RenderThemeHaiku::paintMenuList):
+        * platform/haiku/RenderThemeHaiku.h:
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::StylePainter::StylePainter):
+        (WebCore::RenderThemeQt::paintCheckbox):
+        (WebCore::RenderThemeQt::paintRadio):
+        (WebCore::RenderThemeQt::paintButton):
+        (WebCore::RenderThemeQt::paintTextField):
+        (WebCore::RenderThemeQt::paintTextArea):
+        (WebCore::RenderThemeQt::paintMenuList):
+        (WebCore::RenderThemeQt::paintMenuListButton):
+        (WebCore::RenderThemeQt::paintProgressBar):
+        (WebCore::RenderThemeQt::paintSliderTrack):
+        (WebCore::RenderThemeQt::paintSliderThumb):
+        (WebCore::RenderThemeQt::paintSearchField):
+        (WebCore::RenderThemeQt::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeQt::paintSearchFieldDecoration):
+        (WebCore::RenderThemeQt::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeQt::paintMediaFullscreenButton):
+        (WebCore::RenderThemeQt::paintMediaMuteButton):
+        (WebCore::RenderThemeQt::paintMediaPlayButton):
+        (WebCore::RenderThemeQt::paintMediaSeekBackButton):
+        (WebCore::RenderThemeQt::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeQt::paintMediaCurrentTime):
+        (WebCore::RenderThemeQt::paintMediaVolumeSliderTrack):
+        (WebCore::RenderThemeQt::paintMediaVolumeSliderThumb):
+        (WebCore::RenderThemeQt::paintMediaSliderTrack):
+        (WebCore::RenderThemeQt::paintMediaSliderThumb):
+        * platform/qt/RenderThemeQt.h:
+        * platform/wx/RenderThemeWx.cpp:
+        (WebCore::RenderThemeWx::paintCheckbox):
+        (WebCore::RenderThemeWx::paintRadio):
+        (WebCore::RenderThemeWx::paintButton):
+        (WebCore::RenderThemeWx::paintTextField):
+        (WebCore::RenderThemeWx::paintMenuList):
+        (WebCore::RenderThemeWx::paintMenuListButton):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::paint):
+        * rendering/EllipsisBox.h:
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::paint):
+        * rendering/InlineBox.h:
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::paint):
+        (WebCore::InlineFlowBox::paintFillLayers):
+        (WebCore::InlineFlowBox::paintFillLayer):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineFlowBox.h:
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::paint):
+        * rendering/InlineTextBox.h:
+        * rendering/PaintInfo.h: Added.
+        (WebCore::PaintInfo::PaintInfo):
+        (WebCore::PaintInfo::updatePaintingRootForChildren):
+        (WebCore::PaintInfo::shouldPaintWithinRoot):
+        (WebCore::PaintInfo::applyTransform):
+        * rendering/PaintPhase.h: Added.
+        (WebCore::):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paint):
+        (WebCore::RenderBlock::paintChildren):
+        (WebCore::RenderBlock::paintEllipsisBoxes):
+        (WebCore::clipOutPositionedObjects):
+        (WebCore::RenderBlock::layoutColumns):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paint):
+        (WebCore::RenderBox::paintBoxDecorations):
+        (WebCore::RenderBox::paintMask):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::paint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::paint):
+        (WebCore::performOverlapTests):
+        (WebCore::RenderLayer::paintLayer):
+        (WebCore::RenderLayer::paintList):
+        (WebCore::RenderLayer::paintPaginatedChildLayer):
+        (WebCore::RenderLayer::paintChildLayerIntoColumns):
+        * rendering/RenderLayer.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintIntoLayer):
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint):
+        * rendering/RenderLineBoxList.h:
+        * rendering/RenderMediaControls.cpp:
+        (WebCore::RenderMediaControls::paintMediaControlsPart):
+        * rendering/RenderMediaControls.h:
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaMuteButton):
+        (WebCore::paintMediaPlayButton):
+        (WebCore::paintMediaSlider):
+        (WebCore::paintMediaSliderThumb):
+        (WebCore::paintMediaVolumeSlider):
+        (WebCore::paintMediaVolumeSliderThumb):
+        (WebCore::paintMediaTimelineContainer):
+        (WebCore::RenderMediaControlsChromium::paintMediaControlsPart):
+        * rendering/RenderMediaControlsChromium.h:
+        * rendering/RenderObject.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::paint):
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::paint):
+        (WebCore::RenderReplaced::shouldPaint):
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::paint):
+        * rendering/RenderSVGResourceMarker.cpp:
+        (WebCore::RenderSVGResourceMarker::draw):
+        * rendering/RenderSVGResourceMarker.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::paint):
+        * rendering/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::paint):
+        * rendering/RenderScrollbarPart.cpp:
+        (WebCore::RenderScrollbarPart::paintIntoRect):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::paintObject):
+        (WebCore::RenderTable::paintBoxDecorations):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paint):
+        (WebCore::RenderTableCell::paintBackgroundsBehindCell):
+        (WebCore::RenderTableCell::paintBoxDecorations):
+        * rendering/RenderTheme.cpp:
+        (WebCore::RenderTheme::paint):
+        (WebCore::RenderTheme::paintBorderOnly):
+        (WebCore::RenderTheme::paintDecorations):
+        (WebCore::RenderTheme::paintMeter):
+        * rendering/RenderTheme.h:
+        (WebCore::RenderTheme::paintCapsLockIndicator):
+        (WebCore::RenderTheme::paintCheckbox):
+        (WebCore::RenderTheme::paintRadio):
+        (WebCore::RenderTheme::paintButton):
+        (WebCore::RenderTheme::paintInnerSpinButton):
+        (WebCore::RenderTheme::paintOuterSpinButton):
+        (WebCore::RenderTheme::paintTextField):
+        (WebCore::RenderTheme::paintTextArea):
+        (WebCore::RenderTheme::paintMenuList):
+        (WebCore::RenderTheme::paintMenuListButton):
+        (WebCore::RenderTheme::paintProgressBar):
+        (WebCore::RenderTheme::paintSliderTrack):
+        (WebCore::RenderTheme::paintSliderThumb):
+        (WebCore::RenderTheme::paintSearchField):
+        (WebCore::RenderTheme::paintSearchFieldCancelButton):
+        (WebCore::RenderTheme::paintSearchFieldDecoration):
+        (WebCore::RenderTheme::paintSearchFieldResultsDecoration):
+        (WebCore::RenderTheme::paintSearchFieldResultsButton):
+        (WebCore::RenderTheme::paintMediaFullscreenButton):
+        (WebCore::RenderTheme::paintMediaPlayButton):
+        (WebCore::RenderTheme::paintMediaMuteButton):
+        (WebCore::RenderTheme::paintMediaSeekBackButton):
+        (WebCore::RenderTheme::paintMediaSeekForwardButton):
+        (WebCore::RenderTheme::paintMediaSliderTrack):
+        (WebCore::RenderTheme::paintMediaSliderThumb):
+        (WebCore::RenderTheme::paintMediaVolumeSliderContainer):
+        (WebCore::RenderTheme::paintMediaVolumeSliderTrack):
+        (WebCore::RenderTheme::paintMediaVolumeSliderThumb):
+        (WebCore::RenderTheme::paintMediaRewindButton):
+        (WebCore::RenderTheme::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderTheme::paintMediaToggleClosedCaptionsButton):
+        (WebCore::RenderTheme::paintMediaControlsBackground):
+        (WebCore::RenderTheme::paintMediaCurrentTime):
+        (WebCore::RenderTheme::paintMediaTimeRemaining):
+        * rendering/RenderThemeChromiumMac.h:
+        * rendering/RenderThemeChromiumMac.mm:
+        (WebCore::RenderThemeChromiumMac::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderTrack):
+        (WebCore::RenderThemeChromiumMac::paintMediaVolumeSliderThumb):
+        * rendering/RenderThemeChromiumSkia.cpp:
+        (WebCore::RenderThemeChromiumSkia::paintCheckbox):
+        (WebCore::RenderThemeChromiumSkia::paintRadio):
+        (WebCore::paintButtonLike):
+        (WebCore::RenderThemeChromiumSkia::paintButton):
+        (WebCore::RenderThemeChromiumSkia::paintTextField):
+        (WebCore::RenderThemeChromiumSkia::paintTextArea):
+        (WebCore::RenderThemeChromiumSkia::paintSearchField):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeChromiumSkia::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaControlsBackground):
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderTrack):
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderTrack):
+        (WebCore::RenderThemeChromiumSkia::paintMediaSliderThumb):
+        (WebCore::RenderThemeChromiumSkia::paintMediaVolumeSliderThumb):
+        (WebCore::RenderThemeChromiumSkia::paintMediaPlayButton):
+        (WebCore::RenderThemeChromiumSkia::paintMediaMuteButton):
+        (WebCore::RenderThemeChromiumSkia::paintMenuList):
+        (WebCore::RenderThemeChromiumSkia::paintMenuListButton):
+        (WebCore::RenderThemeChromiumSkia::paintSliderTrack):
+        (WebCore::RenderThemeChromiumSkia::paintSliderThumb):
+        (WebCore::RenderThemeChromiumSkia::paintProgressBar):
+        * rendering/RenderThemeChromiumSkia.h:
+        * rendering/RenderThemeChromiumWin.cpp:
+        (WebCore::RenderThemeChromiumWin::paintCheckbox):
+        (WebCore::RenderThemeChromiumWin::paintRadio):
+        (WebCore::RenderThemeChromiumWin::paintButton):
+        (WebCore::RenderThemeChromiumWin::paintTextField):
+        (WebCore::RenderThemeChromiumWin::paintSliderTrack):
+        (WebCore::RenderThemeChromiumWin::paintSliderThumb):
+        (WebCore::RenderThemeChromiumWin::paintMenuList):
+        (WebCore::RenderThemeChromiumWin::paintTextFieldInternal):
+        (WebCore::RenderThemeChromiumWin::paintProgressBar):
+        * rendering/RenderThemeChromiumWin.h:
+        * rendering/RenderThemeMac.h:
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintTextField):
+        (WebCore::RenderThemeMac::paintCapsLockIndicator):
+        (WebCore::RenderThemeMac::paintTextArea):
+        (WebCore::RenderThemeMac::paintMenuList):
+        (WebCore::RenderThemeMac::paintMeter):
+        (WebCore::RenderThemeMac::paintProgressBar):
+        (WebCore::RenderThemeMac::paintMenuListButtonGradients):
+        (WebCore::RenderThemeMac::paintMenuListButton):
+        (WebCore::RenderThemeMac::paintSliderTrack):
+        (WebCore::RenderThemeMac::paintSliderThumb):
+        (WebCore::RenderThemeMac::paintSearchField):
+        (WebCore::RenderThemeMac::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeMac::paintSearchFieldDecoration):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeMac::paintSearchFieldResultsButton):
+        (WebCore::getUnzoomedRectAndAdjustCurrentContext):
+        (WebCore::RenderThemeMac::paintMediaFullscreenButton):
+        (WebCore::RenderThemeMac::paintMediaMuteButton):
+        (WebCore::RenderThemeMac::paintMediaPlayButton):
+        (WebCore::RenderThemeMac::paintMediaSeekBackButton):
+        (WebCore::RenderThemeMac::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeMac::paintMediaSliderTrack):
+        (WebCore::RenderThemeMac::paintMediaSliderThumb):
+        (WebCore::RenderThemeMac::paintMediaRewindButton):
+        (WebCore::RenderThemeMac::paintMediaReturnToRealtimeButton):
+        (WebCore::RenderThemeMac::paintMediaToggleClosedCaptionsButton):
+        (WebCore::RenderThemeMac::paintMediaControlsBackground):
+        (WebCore::RenderThemeMac::paintMediaCurrentTime):
+        (WebCore::RenderThemeMac::paintMediaTimeRemaining):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintCheckbox):
+        (WebCore::RenderThemeSafari::paintRadio):
+        (WebCore::RenderThemeSafari::paintButton):
+        (WebCore::RenderThemeSafari::paintTextField):
+        (WebCore::RenderThemeSafari::paintCapsLockIndicator):
+        (WebCore::RenderThemeSafari::paintTextArea):
+        (WebCore::RenderThemeSafari::paintMenuList):
+        (WebCore::RenderThemeSafari::paintMenuListButtonGradients):
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+        (WebCore::RenderThemeSafari::paintSliderTrack):
+        (WebCore::RenderThemeSafari::paintSliderThumb):
+        (WebCore::RenderThemeSafari::paintSearchField):
+        (WebCore::RenderThemeSafari::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeSafari::paintSearchFieldDecoration):
+        (WebCore::RenderThemeSafari::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeSafari::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeSafari::paintMediaFullscreenButton):
+        (WebCore::RenderThemeSafari::paintMediaMuteButton):
+        (WebCore::RenderThemeSafari::paintMediaPlayButton):
+        (WebCore::RenderThemeSafari::paintMediaSeekBackButton):
+        (WebCore::RenderThemeSafari::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeSafari::paintMediaSliderTrack):
+        (WebCore::RenderThemeSafari::paintMediaSliderThumb):
+        * rendering/RenderThemeSafari.h:
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::paintButton):
+        (WebCore::RenderThemeWin::paintTextField):
+        (WebCore::RenderThemeWin::paintMenuList):
+        (WebCore::RenderThemeWin::paintMenuListButton):
+        (WebCore::RenderThemeWin::paintSliderTrack):
+        (WebCore::RenderThemeWin::paintSliderThumb):
+        (WebCore::RenderThemeWin::paintSearchField):
+        (WebCore::RenderThemeWin::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWin::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeWin::paintMediaFullscreenButton):
+        (WebCore::RenderThemeWin::paintMediaMuteButton):
+        (WebCore::RenderThemeWin::paintMediaPlayButton):
+        (WebCore::RenderThemeWin::paintMediaSeekBackButton):
+        (WebCore::RenderThemeWin::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeWin::paintMediaSliderTrack):
+        (WebCore::RenderThemeWin::paintMediaSliderThumb):
+        (WebCore::RenderThemeWin::paintMediaToggleClosedCaptionsButton):
+        * rendering/RenderThemeWin.h:
+        (WebCore::RenderThemeWin::paintCheckbox):
+        (WebCore::RenderThemeWin::paintRadio):
+        (WebCore::RenderThemeWin::paintTextArea):
+        (WebCore::RenderThemeWin::paintSearchFieldDecoration):
+        * rendering/RenderThemeWince.cpp:
+        (WebCore::RenderThemeWince::paintButton):
+        (WebCore::RenderThemeWince::paintTextField):
+        (WebCore::RenderThemeWince::paintMenuList):
+        (WebCore::RenderThemeWince::paintMenuListButton):
+        (WebCore::RenderThemeWince::paintSearchField):
+        (WebCore::RenderThemeWince::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWince::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeWince::paintSearchFieldResultsButton):
+        (WebCore::RenderThemeWince::paintSliderTrack):
+        (WebCore::RenderThemeWince::paintSliderThumb):
+        (WebCore::RenderThemeWince::paintMediaFullscreenButton):
+        (WebCore::RenderThemeWince::paintMediaMuteButton):
+        (WebCore::RenderThemeWince::paintMediaPlayButton):
+        (WebCore::RenderThemeWince::paintMediaSeekBackButton):
+        (WebCore::RenderThemeWince::paintMediaSeekForwardButton):
+        (WebCore::RenderThemeWince::paintMediaSliderTrack):
+        (WebCore::RenderThemeWince::paintMediaSliderThumb):
+        * rendering/RenderThemeWince.h:
+        (WebCore::RenderThemeWince::paintCheckbox):
+        (WebCore::RenderThemeWince::paintRadio):
+        (WebCore::RenderThemeWince::paintTextArea):
+        (WebCore::RenderThemeWince::paintSearchFieldDecoration):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::paintEllipsisBox):
+        (WebCore::RootInlineBox::paintCustomHighlight):
+        (WebCore::RootInlineBox::paint):
+        (WebCore::RootInlineBox::fillLineSelectionGap):
+        * rendering/RootInlineBox.h:
+        * rendering/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::paint):
+        * rendering/SVGInlineFlowBox.h:
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paint):
+        * rendering/SVGInlineTextBox.h:
+        * rendering/SVGMarkerLayoutInfo.cpp:
+        (WebCore::SVGMarkerLayoutInfo::drawMarkers):
+        * rendering/SVGMarkerLayoutInfo.h:
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderBase::prepareToRenderSVGContent):
+        (WebCore::SVGRenderBase::finishRenderSVGContent):
+        (WebCore::renderSubtreeToImage):
+        * rendering/SVGRenderSupport.h:
+        * rendering/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::paint):
+        * rendering/SVGRootInlineBox.h:
+
+2010-06-29  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed. Sort Xcode project file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-06-29  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Provide floating-point support for text selection framework
+        https://bugs.webkit.org/show_bug.cgi?id=40665
+
+        Rename 'glyphScale' to 'horizontalGlyphStretch' upon Dans' request.
+        Also guard the variables in ENABLE(SVG) blocks. Initialize variable to 1 instead of 1.0f, as that's the new style rule.
+
+        No functional changes, thus no new tests.
+
+        * platform/graphics/TextRun.h:
+        (WebCore::TextRun::TextRun):
+        (WebCore::TextRun::horizontalGlyphStretch):
+        (WebCore::TextRun::setHorizontalGlyphStretch):
+        (WebCore::TextRun::spacingDisabled):
+        * platform/graphics/WidthIterator.cpp:
+        (WebCore::WidthIterator::advance):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::offsetForPosition):
+
+2010-06-29  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        REGRESSION: text-shadow CSS applied to SVG no longer works
+        https://bugs.webkit.org/show_bug.cgi?id=40960
+
+        Readd text-shadow support, this time supporting multiple shadows.
+        It's not exactly like HTML, because SVG draws fill/stroke phases seperated - the png shows the difference.
+
+        Tests: svg/css/text-shadow-multiple.xhtml
+
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::applyShadowToGraphicsContext): Refactored from paintTextWithShadows(), so SVG can reuse.
+        (WebCore::paintTextWithShadows): Use refactored applyShadowToGraphicsContext() function.
+        * rendering/InlineTextBox.h: 
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintTextWithShadows): Added.
+        (WebCore::SVGInlineTextBox::paintText): Call paintTextWithShadows() instead of directly drawing the text.
+        * rendering/SVGInlineTextBox.h:
+
+2010-06-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: show actual breakpoint position in UI.
+        When user sets breakpoint from UI, javascript engine may actually set
+        it on a different line. If so, move breakpoint to the correct position
+        in frontend.
+        https://bugs.webkit.org/show_bug.cgi?id=40781
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::dispatchDidPause):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setBreakpoint):
+        (WebCore::ScriptDebugServer::currentCallFrame):
+        * bindings/v8/ScriptDebugServer.h:
+        * inspector/InspectorBackend.cpp:
+        (WebCore::InspectorBackend::setBreakpoint):
+        * inspector/InspectorBackend.h:
+        * inspector/InspectorBackend.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::setBreakpoint):
+        (WebCore::InspectorController::removeBreakpoint):
+        (WebCore::InspectorController::didParseSource):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontend.cpp:
+        (WebCore::InspectorFrontend::didSetBreakpoint):
+        * inspector/InspectorFrontend.h:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.setOneTimeBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeOneTimeBreakpoint):
+        (WebInspector.BreakpointManager.prototype.setBreakpoint):
+        (WebInspector.BreakpointManager.prototype.restoredBreakpoint):
+        (WebInspector.BreakpointManager.prototype.removeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._setBreakpoint):
+        (WebInspector.BreakpointManager.prototype._removeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._setBreakpointOnBackend.didSetBreakpoint):
+        (WebInspector.BreakpointManager.prototype._setBreakpointOnBackend):
+        (WebInspector.Breakpoint.prototype.set enabled):
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/InspectorBackendStub.js:
+        (.WebInspector.InspectorBackendStub.prototype.setBreakpoint):
+        * inspector/front-end/ScriptView.js:
+        (WebInspector.ScriptView.prototype._addBreakpoint):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype._addBreakpoint):
+
+2010-06-29  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Catch toString() exceptions in all DB-related code.
+        https://bugs.webkit.org/show_bug.cgi?id=41297
+
+        * bindings/v8/custom/V8BindingMacros.h:
+        * bindings/v8/custom/V8DOMWindowCustom.cpp:
+        (WebCore::V8DOMWindow::openDatabaseCallback):
+        * bindings/v8/custom/V8DatabaseCustom.cpp:
+        (WebCore::V8Database::changeVersionCallback):
+        * bindings/v8/custom/V8DatabaseSyncCustom.cpp:
+        (WebCore::V8DatabaseSync::changeVersionCallback):
+        * bindings/v8/custom/V8SQLTransactionCustom.cpp:
+        (WebCore::V8SQLTransaction::executeSqlCallback):
+        * bindings/v8/custom/V8SQLTransactionSyncCustom.cpp:
+        (WebCore::V8SQLTransactionSync::executeSqlCallback):
+        * bindings/v8/custom/V8WorkerContextCustom.cpp:
+        (WebCore::V8WorkerContext::openDatabaseCallback):
+        (WebCore::V8WorkerContext::openDatabaseSyncCallback):
+
+2010-06-29  Herczeg Zoltan  <zherczeg@webkit.org>
+
+        Rubber-stamped by Nikolas Zimmermann.
+
+        Windows build fix.
+        https://bugs.webkit.org/show_bug.cgi?id=5861
+
+        * svg/SVGFEConvolveMatrixElement.cpp:
+        (WebCore::SVGFEConvolveMatrixElement::build):
+
+2010-06-29  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Add ConvolveMatrix SVG filter effect
+        https://bugs.webkit.org/show_bug.cgi?id=5861
+
+        The patch was originally started by Dirk Schulze,
+        and the .cpp and .h files are mostly his work.
+        I updated the build systems and do some minor updates
+        to the source files as well. The patch does not contain
+        the implementation of the filter: this is intended,
+        and will be landed in a follow-up patch.
+
+        * Android.derived.jscbindings.mk:
+        * Android.derived.v8bindings.mk:
+        * Android.mk:
+        * CMakeLists.txt:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/objc/DOM.mm:
+        (WebCore::createElementClassMap):
+        * bindings/objc/DOMSVG.h:
+        * page/DOMWindow.idl:
+        * svg/SVGAllInOne.cpp:
+        * svg/SVGFEConvolveMatrixElement.cpp: Added.
+        (WebCore::SVGFEConvolveMatrixElement::SVGFEConvolveMatrixElement):
+        (WebCore::SVGFEConvolveMatrixElement::~SVGFEConvolveMatrixElement):
+        (WebCore::SVGFEConvolveMatrixElement::parseMappedAttribute):
+        (WebCore::SVGFEConvolveMatrixElement::setOrder):
+        (WebCore::SVGFEConvolveMatrixElement::setKernelUnitLength):
+        (WebCore::SVGFEConvolveMatrixElement::build):
+        * svg/SVGFEConvolveMatrixElement.h: Added.
+        * svg/SVGFEConvolveMatrixElement.idl: Added.
+        * svg/graphics/filters/SVGFEConvolveMatrix.cpp:
+        (WebCore::FEConvolveMatrix::FEConvolveMatrix):
+        (WebCore::FEConvolveMatrix::create):
+        (WebCore::FEConvolveMatrix::kernelSize):
+        (WebCore::FEConvolveMatrix::setKernelSize):
+        (WebCore::FEConvolveMatrix::targetOffset):
+        (WebCore::FEConvolveMatrix::setTargetOffset):
+        (WebCore::operator<<):
+        (WebCore::FEConvolveMatrix::externalRepresentation):
+        * svg/graphics/filters/SVGFEConvolveMatrix.h:
+        (WebCore::):
+        * svg/svgattrs.in:
+        * svg/svgtags.in:
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        HTML5 tree builder shouldn't ASSERT on HTML5lib test suite
+        https://bugs.webkit.org/show_bug.cgi?id=41335
+
+        Sketch out the EndTag handling for InBodyMode.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        * html/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::ElementStack::inScope):
+        (WebCore::HTMLTreeBuilder::clearActiveFormatingElementsUpToLastMarker):
+        (WebCore::HTMLTreeBuilder::generateImpliedEndTags):
+
+2010-06-28  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        * rendering/RenderObject.h: Add missing forward declaration.
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        I accidently gave up my ref and tried to dereference a null pointer.
+        This code is keeping an extra ref that it doesn't need, but that fact
+        was somewhat hidden before.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::addChildCommon):
+        (WebCore::ContainerNode::parserAddChild):
+        (WebCore::ContainerNode::legacyParserAddChild):
+        * dom/ContainerNode.h:
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Refactor common code into addChildCommon
+        https://bugs.webkit.org/show_bug.cgi?id=41326
+
+        Eric asked that we share the common code between these codepaths.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::addChildCommon):
+        (WebCore::ContainerNode::parserAddChild):
+        (WebCore::ContainerNode::addChild):
+        * dom/ContainerNode.h:
+
+2010-06-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Implement HTMLTreeBuilder::reconstructTheActiveFormattingElements
+        https://bugs.webkit.org/show_bug.cgi?id=41319
+
+        Restructure the code to not use in-band data, which is what
+        got us in trouble with a signed/unsigned mismatch before.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::indexOfFirstUnopenFormattingElement):
+        (WebCore::HTMLTreeBuilder::reconstructTheActiveFormattingElements):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-28  Daniel Bates  <dbates@rim.com>
+
+        Unreviewed, attempt to fix Qt bots.
+
+        Attempt to fix the build after changeset 62079 <http://trac.webkit.org/changeset/62079>
+        (https://bugs.webkit.org/show_bug.cgi?id=41324).
+
+        Rename some more call sites that were missed in the initial landing.
+
+        * dom/XMLDocumentParserQt.cpp:
+        (WebCore::XMLDocumentParser::parseStartElement):
+        (WebCore::XMLDocumentParser::parseProcessingInstruction):
+        (WebCore::XMLDocumentParser::parseCdata):
+        (WebCore::XMLDocumentParser::parseComment):
+        (WebCore::XMLDocumentParser::parseDtd):
+
+2010-06-28  Daniel Bates  <dbates@rim.com>
+
+        Unreviewed, build fix.
+
+        Change return type of method HTMLTreeBuilder::reconstructTheActiveFormattingElements()
+        from int to unsigned.
+
+        Attempt to fix the build after changeset 62077 <https://trac.webkit.org/changeset/62077>
+        (https://bugs.webkit.org/show_bug.cgi?id=41319).
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::indexOfLastOpenFormattingElementOrMarker):
+        (WebCore::HTMLTreeBuilder::reconstructTheActiveFormattingElements):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename ContainerNode::addChild to legacyParserAddChild to indicate its parser-only intended use
+        https://bugs.webkit.org/show_bug.cgi?id=41324
+
+        A bunch of places in the code were calling ContainerNode::addChild.
+        I don't think they actually want to be doing that, as it has special
+        form-related handling which is part of LegacyHTMLTreeBuilder.
+
+        No functional changes, thus no tests.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::legacyParserAddChild):
+        * dom/ContainerNode.h:
+        * dom/DOMImplementation.cpp:
+        (WebCore::DOMImplementation::createDocument):
+        * dom/Node.cpp:
+        (WebCore::Node::legacyParserAddChild):
+        * dom/Node.h:
+        * html/HTMLKeygenElement.cpp:
+        (WebCore::HTMLKeygenElement::HTMLKeygenElement):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::legacyParserAddChild):
+        * html/HTMLTableElement.h:
+        * html/HTMLTableRowElement.cpp:
+        (WebCore::HTMLTableRowElement::legacyParserAddChild):
+        * html/HTMLTableRowElement.h:
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::legacyParserAddChild):
+        * html/HTMLTableSectionElement.h:
+        * html/HTMLViewSourceDocument.cpp:
+        (WebCore::HTMLViewSourceDocument::createContainingTable):
+        (WebCore::HTMLViewSourceDocument::addSpanWithClassName):
+        (WebCore::HTMLViewSourceDocument::addLine):
+        (WebCore::HTMLViewSourceDocument::addText):
+        (WebCore::HTMLViewSourceDocument::addLink):
+
+2010-06-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Implement HTMLTreeBuilder::reconstructTheActiveFormattingElements
+        https://bugs.webkit.org/show_bug.cgi?id=41319
+
+        This is basically a direct transcription of HTML5 TreeBuilder spec:
+         http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#list-of-active-formatting-elements
+
+        This code is covered by various tests in html5lib/runner which we
+        can't run yet due to other asserts.  Adam and I are working on
+        getting rid of those ASSERTS so that this (and other code) will
+        be better tested shortly.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::insertFormatingElement):
+        (WebCore::HTMLTreeBuilder::reconstructTheActiveFormattingElements):
+        * html/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::ElementStack::contains):
+        (WebCore::HTMLTreeBuilder::FormatingElementEntry::FormatingElementEntry):
+        (WebCore::HTMLTreeBuilder::FormatingElementEntry::):
+        (WebCore::HTMLTreeBuilder::FormatingElementEntry::isMarker):
+        (WebCore::HTMLTreeBuilder::FormatingElementEntry::element):
+        (WebCore::HTMLTreeBuilder::FormatingElementEntry::replaceElement):
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix ASSERT so we can run more HTML5lib tests
+        https://bugs.webkit.org/show_bug.cgi?id=41325
+
+        We can't call Node::addChild because that function contains a bunch of
+        logic from the old parser.  Instead, this patch creates a new version
+        of addChild that's does less validating (that's the tree builder's
+        job).
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::parserAddChild):
+        * dom/ContainerNode.h:
+        * dom/Node.cpp:
+        (WebCore::Node::parserAddChild):
+        * dom/Node.h:
+        * html/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::attach):
+
+2010-06-28  David Levin  <levin@chromium.org>
+
+        Reviewed by NOBODY (chromium build fix).
+
+        * bindings/v8/ScriptEventListener.h: Changed forward declaration
+          to correspond to the code change doing in r62052.
+
+2010-06-28  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Support for https://bugs.webkit.org/show_bug.cgi?id=40484
+
+        In working on adding beforeProcess, it becomes necessary for JSLazyEventListeners to always know what their
+        original Node* was, even if it was a window event listener.
+
+        For HTMLFrameSet, HTMLBody, and SVGSVG elements, a second form of createAttributeEventListener was used that
+        took a Frame* argument and didn't set the original Node* on the JSLazyEventListener.
+
+        This patch changes that form of the function to createWindowAttributeEventListener, and passes the Node* along
+        for later use by the beforeProcess mechanism.
+
+        No new tests. (No change in behavior)
+
+        * bindings/js/ScriptEventListener.cpp:
+        (WebCore::createWindowAttributeEventListener): Renamed from createAttributeEventListener, takes a Node* instead
+          of a Frame*, and figures out the Frame* itself internally.
+        * bindings/js/ScriptEventListener.h:
+
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createWindowAttributeEventListener): Renamed from createAttributeEventListener, takes a Node* instead
+          of a Frame*, and figures out the Frame* itself internally. Note that V8LazyEventListener doesn't allow us to
+          pass the Element* argument in so this beforeprocess feature won't fully work on V8 builds until this is changed.
+        * bindings/v8/ScriptEventListener.h:
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute): Use createWindowAttributeEventListener instead.
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::parseMappedAttribute): Ditto.
+        * svg/SVGSVGElement.cpp:
+        (WebCore::SVGSVGElement::parseMappedAttribute): Ditto. Also add some missing copyright dates that `svn log` proves
+          should be there.
+
+2010-06-28  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Kent Tamura.
+
+        add ENABLE_DIRECTORY_UPLOAD build support
+        https://bugs.webkit.org/show_bug.cgi?id=41100
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * WebCore.pri:
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't use the new tree builder for fragments
+        https://bugs.webkit.org/show_bug.cgi?id=41316
+
+        We need to walk before we can run.  After this change, we can run the
+        runner.html tests (with the ASSERT caveat).
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        The new tree builder should actually finish building the tree
+        https://bugs.webkit.org/show_bug.cgi?id=41314
+
+        Again, this patch makes progress on runner.html, but I haven't removed
+        the ASSERT yet.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::finished):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-28  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Fix a race condition that can happen when using DBs in workers.
+        https://bugs.webkit.org/show_bug.cgi?id=41105
+
+        * storage/DatabaseTracker.cpp:
+        (WebCore::DatabaseTracker::addOpenDatabase):
+        * storage/DatabaseTracker.h:
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add text nodes to the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=41306
+
+        Actually add some text nodes to the DOM when parsing a document.  We're
+        going to need to do something fancier here eventually, but this gets us
+        past the error we're seeing currently in runner.html.
+
+        Unfortunately, this patch "regresses" runner.html in the sense that we
+        now hit an assert, but it's still an improvement...  I'll update the
+        HTML5 expectations once we get past the assert.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::insertTextNode):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-28  Beth Dakin  <bdakin@apple.com>
+
+        Build fix for non-PATH_BASED_BORDER_RADIUS_DRAWING platforms.
+
+        * rendering/RenderBoxModelObject.cpp:
+
+2010-06-28  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Use HTML5-conformant gradient interpolation mode
+        https://bugs.webkit.org/show_bug.cgi?id=41298
+
+        Change the Qt Gradient implementation to use ComponentInterpolation mode.
+
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#colors-and-styles
+
+        * platform/graphics/qt/GradientQt.cpp:
+        (WebCore::Gradient::platformGradient):
+
+2010-06-28  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=9197 CSS3: Borders 
+        with border-radius and double, groove, or ridge styles should look 
+        better
+
+        This patch re-works border radius painting to stroke paths instead 
+        of arcs. 
+
+        Added new function clipConvexPolygon(). Added static 
+        addConvexPolygonToContext so that code can be shared between 
+        drawConvexPolygon() and clipConvexPolygon().
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::addConvexPolygonToContext):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::clipConvexPolygon):
+
+        Shells of implementations on non-CG platforms.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::clipConvexPolygon):
+        * platform/graphics/haiku/GraphicsContextHaiku.cpp:
+        (WebCore::GraphicsContext::clipConvexPolygon):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipConvexPolygon):
+        * platform/graphics/skia/GraphicsContextSkia.cpp:
+        (WebCore::GraphicsContext::clipConvexPolygon):
+        * platform/graphics/wince/GraphicsContextWince.cpp:
+        (WebCore::GraphicsContext::clipConvexPolygon):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::clipConvexPolygon):
+
+        This new helper function determines if the inner corners of the 
+        border will arch in or meet at a right angle. 
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::borderWillArcInnerEdge):
+
+        This function is re-written so that, for each side of the border, 
+        if borderWillArcInnerEdge() is true, we go down a brand new code 
+        path of clipping to a convex polygon for the border side and then 
+        we paint the side using the new function drawBoxSideFromPath(). If 
+        borderWillArcInnerEdge() is false, then we call into the old 
+        familiar drawLineForBoxSide() which relies on the rounder clip 
+        rects we have set up to arch the outer edge of the border.
+        (WebCore::RenderBoxModelObject::paintBorder):
+
+        This new function does the math to figure out the convex polygon 
+        to clip to in the case where we need to arch the inner edge of the 
+        border. This calls into a new GraphicsContext function that is only 
+        implemented on CG at this time. This is the reason we are keeping 
+        around an old version of paintBorder() for now.
+        (WebCore::RenderBoxModelObject::clipBorderSidePolygon):
+        * rendering/RenderBoxModelObject.h:
+
+        borderInnerRect() is a new convenience function called from 
+        RenderObject and RenderBoxModelObject to determine the rect of the 
+        inside edge of the border.
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::borderInnerRect):
+
+        This new function re-works drawArcForBoxSide to draw from Paths 
+        when appropriate instead of stroking arcs. 
+        (WebCore::RenderObject::drawBoxSideFromPath):
+
+        Keep this around for that do not HAVE(PATH_BASED_BORDER_RADIUS_DRAWING) until 
+        GraphicsContext::clipConvexPolygon() is implemented.
+        (WebCore::RenderObject::drawArcForBoxSide):
+        * rendering/RenderObject.h:
+
+        New function 
+        RenderStyle::getInnerBorderRadiiForRectWithBorderWidths() gets the 
+        inner radius values for a rect. It takes border widths a parameters 
+        rather than using the style's border widths so that it can be used 
+        in inner radius calculations for double and groove/ridge 
+        calculations. The W3C corner constraining rules were moved to a 
+        static function that can be called from both getBorderRadiiForRect
+        () and getInnerBorderRadiiForRectWithBorderWidths().
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::constrainCornerRadiiForRect):
+        (WebCore::RenderStyle::getBorderRadiiForRect):
+        (WebCore::RenderStyle::getInnerBorderRadiiForRectWithBorderWidths):
+        * rendering/style/RenderStyle.h:
+
+2010-06-28  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Add support for the progress bar tag
+        https://bugs.webkit.org/show_bug.cgi?id=41014
+
+        Add support for rendering the progress tag for WebKit GTK+.
+
+        * GNUmakefile.am:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::animationRepeatIntervalForProgressBar):
+        Added. Currently progress bar animations are disabled. As it looks like
+        there may not be a good way to support this with Mozilla's theme drawing code.
+        (WebCore::RenderThemeGtk::animationDurationForProgressBar): Ditto.
+        (WebCore::RenderThemeGtk::adjustProgressBarStyle): Added.
+        (WebCore::RenderThemeGtk::paintProgressBar): Added.
+        * platform/gtk/RenderThemeGtk.h: Add declarations for new methods.
+        * platform/gtk/gtk2drawing.c: 
+        (moz_gtk_get_progress_widget): Expose the progress widget so that the chunk can be positioned properly.
+        * platform/gtk/gtkdrawing.h: Added declaration for moz_gtk_get_progress_widget.
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        HTML5 Regression: Crash in insert()
+        https://bugs.webkit.org/show_bug.cgi?id=41281
+
+        We need to call endIfDelayed() outside of the script nesting block
+        because endIfDelayed() might call end(), which deletes the
+        HTMLDocumentParser.  If we try to exit the script nesting block after
+        the HTMLDocumentParser has been deleted, we'll decrement unallocated
+        memory, which is bad times.
+
+        Moving endIfDelayed outside of the script nesting block also lets us
+        avoid ending if inWrite() is true.  If we're inWrite(), then there's
+        folks above us on the stack who will crash of the HTMLDocumentParser is
+        deallocated.  Adding this check matches the LegacyHTMLDocumentParser
+        and the logic in attemptToEnd, facilitating a small refactoring of the
+        common logic for improved readability.
+
+        I don't know of any test case that changes in behavior because of this
+        patch, but this bug exists on the same line of code that the reliablity
+        tests crashed.  I'm not sure whether this patch will fix that crash,
+        but removing bugs (even theoretical ones) seems like a good idea.
+
+        * html/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::insert):
+        (WebCore::HTMLDocumentParser::append):
+        (WebCore::HTMLDocumentParser::attemptToEnd):
+        (WebCore::HTMLDocumentParser::endIfDelayed):
+        (WebCore::HTMLDocumentParser::resumeParsingAfterScriptExecution):
+        * html/HTMLDocumentParser.h:
+        (WebCore::HTMLDocumentParser::shouldDelayEnd):
+
+2010-06-28  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        MediaPlayerPrivate::getSupportedTypes does not return "modern" MIME types
+        https://bugs.webkit.org/show_bug.cgi?id=41287
+        <rdar://problem/8137402>
+
+        No new test because getSupportedTypes is used privately by MediaPlayer.
+
+        * platform/graphics/mac/MediaPlayerPrivateQTKit.mm:
+        (WebCore::MediaPlayerPrivate::getSupportedTypes): Build hash set with both common and
+        modern types.
+
+2010-06-28  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(53790): Neopets page with mismatched elements misrenders
+        https://bugs.webkit.org/show_bug.cgi?id=41181
+
+        Misnested formatting tags require fixup in order to create a valid DOM.  Because this takes
+        O(N^2) time in some cases, http://trac.webkit.org/changeset/53790 added an iteration limit
+        of 5 to this algorithm to avoid hangs.  This limit is too low for neopets, but a limit of
+        7 is sufficient.  This raises the limit to 10 to have a bit of breathing room.  HTML5
+        defines the fixup algorithm http://www.whatwg.org/specs/web-apps/current-work/#adoptionAgency
+        but doesn't specify any particular iteration limit.
+
+        * html/LegacyHTMLTreeBuilder.cpp:
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        The new tree builder needs to call attach() on elements it attaches to
+        the DOM
+        https://bugs.webkit.org/show_bug.cgi?id=41293
+
+        Apparently Nodes expect to have their attach() method called when they
+        are attached to the DOM.  The new tree builder is happy to oblige.
+        Making this call requires some fancy footwork with RefPtr/PassRefPtr to
+        avoid extra ref churn while keeping each function small.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::insertHTMLStartTagBeforeHTML):
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::insertDoctype):
+        (WebCore::HTMLTreeBuilder::insertComment):
+        (WebCore::HTMLTreeBuilder::insertCommentOnDocument):
+        (WebCore::HTMLTreeBuilder::insertElement):
+        (WebCore::HTMLTreeBuilder::insertSelfClosingElement):
+        (WebCore::HTMLTreeBuilder::insertScriptElement):
+        * html/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::attach):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Fix distcheck.
+
+        * GNUmakefile.am:
+
+2010-06-28  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Index validation caches buffer size information too aggressively
+        https://bugs.webkit.org/show_bug.cgi?id=41092
+
+        Test: fast/canvas/webgl/index-validation-with-resized-buffer.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::validateRenderingState):
+         - Compute the number of valid elements each time based on the latched buffer.
+        (WebCore::WebGLRenderingContext::vertexAttribPointer):
+         - Do not cache the buffer size, only the attributes used to
+           compute the number of required elements.
+        * html/canvas/WebGLRenderingContext.h:
+        (WebCore::WebGLRenderingContext::VertexAttribState::VertexAttribState):
+         - Ditto.
+
+2010-06-28  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Replace single treat-as-space characters with normal space
+        https://bugs.webkit.org/show_bug.cgi?id=41278
+
+        This keeps Qt from attempting glyph substitution and loading a bunch
+        of extra fonts when encountering &nbsp; entities.
+
+        * platform/graphics/qt/FontQt.cpp:
+        (WebCore::Font::floatWidthForComplexText):
+
+2010-06-28  Robin Cao  <robin.cao@torchmobile.com.cn>
+
+        Reviewed by Dan Bernstein.
+
+        canvas fillText with @font-face crashes
+        https://bugs.webkit.org/show_bug.cgi?id=35486
+
+        The font object in CanvasRenderingContext2D may become invalid at some point.
+        Override recalcStyle() in HTMLCanvasElement, and update the font object from there if needed.
+
+        A test already exists: canvas/philip/tests/2d.text.draw.fontface.repeat.html
+
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::recalcStyle):
+        * html/HTMLCanvasElement.h:
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::updateFont):
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2010-06-28  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Unreviewed build fix.
+
+        [EFL] Build fix for latest version of Ecore library.
+        Ecore recently changed return type of callbacks from int to Eina_Bool.
+
+        No new functionality, so no new tests.
+
+        * platform/efl/SharedTimerEfl.cpp:
+        (WebCore::timerEvent): Return Eina_Bool instead of int.
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Fix build with GTK+ older than 2.18
+
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::visibleContentRect):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        [GTK] Push NULL context on every DOM bindings entry point
+        https://bugs.webkit.org/show_bug.cgi?id=39967
+
+        Update GObject DOM bindings to push the NULL context on every API
+        entry point, and update bindings test results.
+
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        * bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp:
+        * bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp:
+        * bindings/scripts/test/GObject/WebKitDOMTestObj.cpp:
+
+2010-06-28  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        [WinCairo] Text box backgrounds do not render in partially opaque layers
+        https://bugs.webkit.org/show_bug.cgi?id=41113
+
+        Tests:
+         manual-tests/partially-opaque-text-input.html
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        When restoring a context which does not support alpha blending, manually
+        set the alpha channel of the HBITMAP to fully opaque. This will effectively
+        ignore the alpha channel of the HBITMAP, which is necessary because GDI
+        drawing functions set the alpha value to be fully transparent (0).
+
+2010-06-28  Martin Robinson  <martin.james.robinson@gmail.com>
+
+        Reviewed by Adam Roben.
+
+        [WinCairo] Rendering of themed elements on a layer with opacity produces nothing
+        https://bugs.webkit.org/show_bug.cgi?id=41111
+
+        Tests:
+         manual-tests/partially-opaque-form-elements.html
+
+        * platform/graphics/win/GraphicsContextCairoWin.cpp:
+        (WebCore::GraphicsContext::releaseWindowsContext):
+        Preform a cairo_save() and a cairo_restore() around code modifying the transformation
+        matrix of the Cairo surface. Also set the destination coordinates before adjusting
+        the transformation matrix scale, so that the destination coordinates are not scaled
+        as well.
+
+2010-06-28  Sam Magnuson  <smagnuson@netflix.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] GraphicsLayerQt delay seems unnecessary.
+        https://bugs.webkit.org/show_bug.cgi?id=40846
+
+        Test: compositing/animation/busy-indicator.html
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::recache):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setContentsToImage):
+        (WebCore::GraphicsLayerQt::addAnimation):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Until now we were adding the event listeners for a given object in
+        the wrap method, since that's the first moment we have accoss to
+        the core WebCore object. The problem is that we only install the
+        listeners that the topmost class in the class hierarchy needs (eg,
+        HTMLParagrahElement for a P element), when most of the actual
+        event attributes are defined in the base classes (Node, Element,
+        ...).
+
+        To fix this set the core object as a construct/write-only property
+        on the wrapper GObject, and set the eventlisteners in the cGObject
+        'construct' method, chaining up through all the class hierarchy
+        until the end. This way we'll get all the eventlisteners defined
+        in all the superclasses of our object, which is what we want.
+
+        * bindings/gobject/WebKitDOMObject.cpp:
+        (webkit_dom_object_get_property):
+        (webkit_dom_object_set_property):
+        (webkit_dom_object_class_init):
+        * bindings/scripts/CodeGeneratorGObject.pm:
+        * dom/Node.idl:
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Fix GTK+ build.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Does not compile with -DGSEAL_ENABLE
+        https://bugs.webkit.org/show_bug.cgi?id=37851
+
+        Fix build with GSEAL enabled.
+
+        * GNUmakefile.am:
+        * platform/gtk/GtkVersioning.h:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::paintMozillaGtkWidget):
+        (WebCore::RenderThemeGtk::platformActiveSelectionBackgroundColor):
+        (WebCore::RenderThemeGtk::platformInactiveSelectionBackgroundColor):
+        (WebCore::RenderThemeGtk::platformActiveSelectionForegroundColor):
+        (WebCore::RenderThemeGtk::platformInactiveSelectionForegroundColor):
+        (WebCore::RenderThemeGtk::activeListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeGtk::inactiveListBoxSelectionBackgroundColor):
+        (WebCore::RenderThemeGtk::activeListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeGtk::inactiveListBoxSelectionForegroundColor):
+        (WebCore::RenderThemeGtk::systemColor):
+        * platform/gtk/ScrollViewGtk.cpp:
+        (WebCore::ScrollView::platformRemoveChild):
+        (WebCore::ScrollView::visibleContentRect):
+        * platform/gtk/gtk2drawing.c:
+        (ensure_toggle_button_widget):
+        (ensure_combo_box_widgets):
+        (ensure_combo_box_entry_widgets):
+        (ensure_tree_header_cell_widget):
+        (moz_gtk_button_paint):
+        (moz_gtk_toggle_paint):
+        (calculate_button_inner_rect):
+        (calculate_arrow_rect):
+        (moz_gtk_scrollbar_button_paint):
+        (moz_gtk_scrollbar_trough_paint):
+        (moz_gtk_scrollbar_thumb_paint):
+        (moz_gtk_spin_paint):
+        (moz_gtk_spin_updown_paint):
+        (moz_gtk_scale_paint):
+        (moz_gtk_scale_thumb_paint):
+        (moz_gtk_gripper_paint):
+        (moz_gtk_hpaned_paint):
+        (moz_gtk_vpaned_paint):
+        (moz_gtk_entry_paint):
+        (moz_gtk_treeview_paint):
+        (moz_gtk_tree_header_sort_arrow_paint):
+        (moz_gtk_treeview_expander_paint):
+        (moz_gtk_expander_paint):
+        (moz_gtk_combo_box_paint):
+        (moz_gtk_downarrow_paint):
+        (moz_gtk_combo_box_entry_button_paint):
+        (moz_gtk_container_paint):
+        (moz_gtk_toggle_label_paint):
+        (moz_gtk_toolbar_paint):
+        (moz_gtk_toolbar_separator_paint):
+        (moz_gtk_tooltip_paint):
+        (moz_gtk_resizer_paint):
+        (moz_gtk_frame_paint):
+        (moz_gtk_progressbar_paint):
+        (moz_gtk_progress_chunk_paint):
+        (moz_gtk_get_tab_thickness):
+        (moz_gtk_tab_paint):
+        (moz_gtk_tabpanels_paint):
+        (moz_gtk_tab_scroll_arrow_paint):
+        (moz_gtk_menu_bar_paint):
+        (moz_gtk_menu_popup_paint):
+        (moz_gtk_menu_separator_paint):
+        (moz_gtk_menu_item_paint):
+        (moz_gtk_menu_arrow_paint):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Add support for GTK+3
+        https://bugs.webkit.org/show_bug.cgi?id=41253
+
+        Adapt build system for 3.x support.
+
+        * GNUmakefile.am:
+
+2010-06-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [v8] Web Inspector: properties of scope variables are flattened while on a breakpoint.
+        https://bugs.webkit.org/show_bug.cgi?id=41214
+
+        Test: inspector/debugger-proto-property.html
+
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor): object proxy with non-empty path cannot be scope proxy.
+
+2010-06-28  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed attempt to fix windows build.
+
+        * page/DOMWindow.idl:
+
+2010-06-22  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        <progress> should be styled with -webkit-progress-bar-value
+        https://bugs.webkit.org/show_bug.cgi?id=40823
+
+        Fixed to peek styles of the shadow node pseudo class to fallback
+        to non-styled painting.
+        
+        * css/html.css: 
+        (progress): Added defaul background-color.
+        (progress::-webkit-progress-bar-value): Added defaul background-color.
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::shouldHaveParts):
+        (WebCore::RenderProgress::updatePartsState):
+
+        Test: fast/dom/HTMLProgressElement/progress-bar-value-pseudo-element.html
+        
+2010-06-28  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Kent Tamura.
+
+        GCC suggest parentheses around && within ||
+        https://bugs.webkit.org/show_bug.cgi?id=41245
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::paintChildren):
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Don't dump contents of <script> elements in LayoutTests
+        https://bugs.webkit.org/show_bug.cgi?id=41277
+
+        Apparently we need to tell each element when we start and stop parsing
+        its children.  If we don't do this, we see the contents of every script
+        and style element in dumpAsText LayoutTests.  (This patch is *well*
+        covered by LayoutTests.)
+
+        * html/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::ElementStack::pop):
+        (WebCore::HTMLTreeBuilder::ElementStack::push):
+
+2010-06-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make it possible to test the new HTML5 TreeBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=41276
+
+        Adam was concerned that someone might make their port
+        depend on this setting (I guess we had some trouble with that
+        with the HTML5Parser setting), so I littered the code with warnings.
+
+        test-html5-parser now tests this code path.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
+        (WebCore::HTMLTreeBuilder::finished):
+        * page/Settings.cpp:
+        (WebCore::Settings::Settings):
+        * page/Settings.h:
+        (WebCore::Settings::setHTML5TreeBuilderEnabled_DO_NOT_USE):
+        (WebCore::Settings::html5TreeBuilderEnabled):
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make the html5lib runner.html not assert
+        https://bugs.webkit.org/show_bug.cgi?id=41273
+
+        This patch gets us closer to being able to run the parser tests.  We
+        still don't get parsing correct, but at least we don't assert.  :)
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processComment):
+        (WebCore::HTMLTreeBuilder::insertCommentOnDocument):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-28  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed.  Attempt to fix Chromium and Qt builders.
+
+        Add a new baseclass for XML, HTML and Text DocumentParsers to clean up DocumentParser call sites
+        https://bugs.webkit.org/show_bug.cgi?id=41141
+
+        No functional changes, thus no tests.
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::eventHandlerLineNumber):
+        (WebCore::ScriptController::eventHandlerColumnNumber):
+        * dom/XMLDocumentParserQt.cpp:
+        (WebCore::XMLDocumentParser::XMLDocumentParser):
+        (WebCore::XMLDocumentParser::stopParsing):
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add support for parsing attributes
+        https://bugs.webkit.org/show_bug.cgi?id=41272
+
+        This patch lets use parse the following document:
+
+        <script src="data:text/javascript,alert('PASS')"></script>
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
+        (WebCore::HTMLTreeBuilder::insertHTMLStartTagBeforeHTML):
+        (WebCore::HTMLTreeBuilder::insertScriptElement):
+        (WebCore::HTMLTreeBuilder::createElement):
+
+2010-06-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add a new baseclass for XML, HTML and Text DocumentParsers to clean up DocumentParser call sites
+        https://bugs.webkit.org/show_bug.cgi?id=41141
+
+        By splitting ScriptableDocumentParser and DecodedDataDocumentParser
+        out from DocumentParser we've made the DocumentParser and
+        RawDataDocumentParser classes simpler.
+
+        No functional change, thus no tests.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::eventHandlerLineNumber):
+        * css/CSSStyleSheet.cpp:
+        (WebCore::CSSStyleSheet::checkLoaded):
+        * dom/Document.cpp:
+        (WebCore::Document::scriptableDocumentParser):
+        (WebCore::Document::open):
+        (WebCore::Document::implicitOpen):
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::removePendingSheet):
+        * dom/Document.h:
+        (WebCore::Document::parser):
+        * dom/DocumentParser.cpp:
+        (WebCore::DocumentParser::DocumentParser):
+        * dom/DocumentParser.h:
+        (WebCore::DocumentParser::asScriptableDocumentParser):
+        * dom/RawDataDocumentParser.h:
+        (WebCore::RawDataDocumentParser::finishWasCalled):
+        * dom/ScriptableDocumentParser.cpp: Copied from WebCore/html/HTMLEntityParser.h.
+        (WebCore::ScriptableDocumentParser::ScriptableDocumentParser):
+        * dom/ScriptableDocumentParser.h: Added.
+        (WebCore::ScriptableDocumentParser::isExecutingScript):
+        (WebCore::ScriptableDocumentParser::executeScriptsWaitingForStylesheets):
+        (WebCore::ScriptableDocumentParser::xssAuditor):
+        (WebCore::ScriptableDocumentParser::setXSSAuditor):
+        (WebCore::ScriptableDocumentParser::processingContentWrittenByScript):
+        (WebCore::ScriptableDocumentParser::asScriptableDocumentParser):
+        * dom/ViewportArguments.cpp:
+        (WebCore::parserLineNumber):
+        (WebCore::reportViewportWarning):
+        * dom/XMLDocumentParser.h:
+        * dom/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::XMLDocumentParser):
+        * html/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::HTMLDocumentParser):
+        (WebCore::HTMLDocumentParser::shouldLoadExternalScriptFromSrc):
+        * html/HTMLDocumentParser.h:
+        * html/LegacyHTMLDocumentParser.cpp:
+        (WebCore::LegacyHTMLDocumentParser::LegacyHTMLDocumentParser):
+        (WebCore::LegacyHTMLDocumentParser::parseTag):
+        * html/LegacyHTMLDocumentParser.h:
+        (WebCore::LegacyHTMLDocumentParser::processingContentWrittenByScript):
+        * html/LegacyHTMLTreeBuilder.cpp:
+        (WebCore::LegacyHTMLTreeBuilder::reportErrorToConsole):
+        * loader/DocumentLoader.cpp:
+        * loader/DocumentWriter.cpp:
+        * loader/TextDocument.cpp:
+        (WebCore::TextDocumentParser::TextDocumentParser):
+        (WebCore::TextDocumentParser::finish):
+        * svg/SVGDocumentExtensions.cpp:
+        (WebCore::parserLineNumber):
+        (WebCore::reportMessage):
+        (WebCore::SVGDocumentExtensions::reportWarning):
+        (WebCore::SVGDocumentExtensions::reportError):
+
+2010-06-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Mark Rowe.
+
+        WebKit2 build exceeds address space on 32-bit Windows builders
+        https://bugs.webkit.org/show_bug.cgi?id=41270
+
+        Add all-in-one file for render-related SVG files.
+        Clean up other all-in-one files by adding missing files, excluding matching files from the vcproj.
+        Reduces release WebCore.lib size by 10% (160MB).
+
+        * DerivedSources.cpp:
+        * WebCore.vcproj/WebCore.vcproj:
+        * bindings/js/JSBindingsAllInOne.cpp:
+        * html/HTMLElementsAllInOne.cpp:
+        * rendering/RenderSVGAllInOne.cpp: Added.
+
+2010-06-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Sketch out the InBodyMode for the tree builder
+        https://bugs.webkit.org/show_bug.cgi?id=41271
+
+        This gives us some basic behavior for the InBodyMode.  I've implemented
+        some of the easier logic.  The more complicated logic will be in
+        subsequent patches.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::insertFormatingElement):
+        (WebCore::HTMLTreeBuilder::reconstructTheActiveFormattingElements):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-25  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Shinichiro Hamaji.
+
+        Improve default value handling for page format properties.
+
+        Default page size and orientation have been hard-coded.
+        Instead, pass default page size and margins to
+        WebCore::Document::pageSizeAndMarginsInPixels to handle auto page size
+        and margins specified as percentages.
+        Return margins instead of page rect.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41150
+
+        * WebCore.base.exp:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyPageSizeProperty):
+        (WebCore::CSSStyleSelector::pageSizeFromName):
+        * css/html.css:
+        (@page):
+        * dom/Document.cpp:
+        (WebCore::Document::pageSizeAndMarginsInPixels):
+        * dom/Document.h:
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageProperty):
+        (WebCore::PrintContext::pageSizeAndMarginsInPixels):
+        * page/PrintContext.h:
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::pageSizeType):
+        (WebCore::InheritedFlags::setPageSizeType):
+        (WebCore::InheritedFlags::resetPageSizeType):
+        * rendering/style/StyleRareNonInheritedData.cpp:
+        (WebCore::StyleRareNonInheritedData::StyleRareNonInheritedData):
+        (WebCore::StyleRareNonInheritedData::operator==):
+        * rendering/style/StyleRareNonInheritedData.h:
+        (WebCore::):
+
+2010-06-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Clean up some loose ends in HTML5 tree builder
+        https://bugs.webkit.org/show_bug.cgi?id=41265
+
+        This patch cleans up a few loose ends in HTML5 tree builder.
+        Technically, we could do each of these as individual patches, but that
+        didn't seem worth while.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+            - Add missing break before default case statement.  I don't think
+              this change is observable.
+        (WebCore::HTMLTreeBuilder::processComment):
+            - Originally I thought that comments had special processing in the
+              InHeadNoscriptMode, but it turns out that when you unwind the
+              definitions, it amounts to exactly the same thing.
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+            - Add missing break before default case statement.  I don't think
+              this change is observable.
+        (WebCore::HTMLTreeBuilder::insertComment):
+            - Eliminate one unnecessary ref/deref pair.
+        (WebCore::HTMLTreeBuilder::insertSelfClosingElement):
+            - When we insert self-closing elements, there's no reason to push
+              them onto the stack of open elements just to pop them off again.
+              This change saves a malloc/free pair as well as a ref/deref pair.
+              Go team.
+        * html/HTMLTreeBuilder.h:
+            - Remove unused function.
+
+2010-06-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement remaining StartTag processing for InHeadNoscriptMode
+        https://bugs.webkit.org/show_bug.cgi?id=41264
+
+        The InHeadNoscriptMode processes some start tags "as if" the tree
+        builder were in the InHeadMode.  This is an idiom we'll see more of
+        later.  My approach is this patch is to factor all the logic for
+        processing start tags in the InHeadMode into a separate function that
+        can be called from both locations.  This seems cleaner than just
+        splitting out the parts that are actually used by both modes.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processStartTagForInHead):
+        (WebCore::HTMLTreeBuilder::insertSelfClosingElement):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add support for <title> and <style> elements
+        https://bugs.webkit.org/show_bug.cgi?id=41263
+
+        These elements use the generic RCDATA and RawText algorithms,
+        respectively.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::insertGenericRCDATAElement):
+        (WebCore::HTMLTreeBuilder::insertGenericRawTextElement):
+
+2010-06-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Actually insert Doctype elements
+        https://bugs.webkit.org/show_bug.cgi?id=41262
+
+        This code is pretty much the same as in the old tree builder.
+
+        * html/HTMLToken.h:
+        (WebCore::AtomicHTMLToken::publicIdentifier):
+        (WebCore::AtomicHTMLToken::systemIdentifier):
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::insertDoctype):
+
+2010-06-27  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        Canvas: Ignore calls to drawImage() with non-finite parameters
+        https://bugs.webkit.org/show_bug.cgi?id=38929
+
+        This also fixes a Qt assert when using the raster graphics system.
+
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#2dcontext
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawImage):
+
+2010-06-27  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        editing/execCommand/copy-without-selection.html fails on Qt after r61637
+        https://bugs.webkit.org/show_bug.cgi?id=41025
+
+        The problem was that when getting data back via Clipboard::getData(),
+        the String::String(const char*, int) constructor was called
+        with UTF-16 data.
+
+        The solution is to use QMimeData's text() and setText() for "text/plain".
+
+        setText() which makes sure Qt passes the string in proper format to the
+        system clipboard. (The previous implementation would convert it to UTF-8)
+
+        text() makes sure that the correct encoding is used (UTF-16) and that
+        we get back whatever we originally put in there.
+
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::isTextMimeType):
+        (WebCore::ClipboardQt::getData):
+        (WebCore::ClipboardQt::setData):
+
+2010-06-27  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        HTML5 tree builder should be able to execute inline scripts
+        https://bugs.webkit.org/show_bug.cgi?id=41257
+
+        This patch implements enough machinery so that we can execute inline
+        scripts in extremely simple documents such as the following:
+
+        <html>
+        <script>
+        alert(1);
+        </script>
+
+        To get this to work, I had to flesh out a surprising amount of the data
+        structures for processing the <head>.  No tests because this is
+        already covered by most LayoutTests.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::insertComment):
+        (WebCore::HTMLTreeBuilder::insertElement):
+        (WebCore::HTMLTreeBuilder::insertScriptElement):
+        * html/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::ElementRecord::ElementRecord):
+        (WebCore::HTMLTreeBuilder::ElementRecord::element):
+        (WebCore::HTMLTreeBuilder::ElementRecord::next):
+        (WebCore::HTMLTreeBuilder::ElementRecord::releaseNext):
+        (WebCore::HTMLTreeBuilder::ElementRecord::setNext):
+        (WebCore::HTMLTreeBuilder::ElementStack::pop):
+        (WebCore::HTMLTreeBuilder::ElementStack::push):
+        (WebCore::HTMLTreeBuilder::ElementStack::top):
+        (WebCore::HTMLTreeBuilder::ElementStack::remove):
+        (WebCore::HTMLTreeBuilder::currentElement):
+
+2010-06-26  Brady Eidson  <beidson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        beforeProcess event needs to fire before inline scripts/stylesheets take effect
+        <rdar://problem/8084335> and https://bugs.webkit.org/show_bug.cgi?id=40484
+
+        This patch adds the Event, the onBeforeProcess attribute, and hooks the attribute up in a few places.
+        Besides that, no change in behavior.
+
+        Layout tests will come with the actual implementations as a followup to this patch.
+
+        Project file nonsense:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+
+        Scaffolding for the event itself:
+        * dom/BeforeProcessEvent.cpp: Added.
+        (WebCore::BeforeProcessEvent::text):
+        (WebCore::BeforeProcessEvent::setText):
+        * dom/BeforeProcessEvent.h: Added.
+        (WebCore::BeforeProcessEvent::create):
+        (WebCore::BeforeProcessEvent::initBeforeProcessEvent):
+        (WebCore::BeforeProcessEvent::BeforeProcessEvent):
+        * dom/BeforeProcessEvent.idl: Added.
+
+        * dom/EventNames.h:
+
+        Respect the onBeforeProcess attribute:
+        * dom/Document.cpp:
+        (WebCore::Document::addListenerTypeIfNeeded):
+        * dom/Document.h:
+        (WebCore::Document::):
+
+        * html/HTMLAttributeNames.in:
+        * html/HTMLScriptElement.cpp:
+        (WebCore::HTMLScriptElement::parseMappedAttribute):
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::parseMappedAttribute):
+
+2010-06-26  Darin Adler  <darin@apple.com>
+
+        Try to fix Chromium build by adding back function used only by Chromium WebKit.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::defaultChecked): Added back.
+        * html/HTMLInputElement.h: Added defaultChecked function.
+
+        * html/HTMLMetaElement.cpp:
+        (WebCore::HTMLMetaElement::httpEquiv): Added back.
+        * html/HTMLMetaElement.h: Added httpEquiv function.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::defaultSelected): Added back.
+        * html/HTMLOptionElement.h: Added defaultSelected function.
+
+        * rendering/style/StyleRareNonInheritedData.h: Fixed incorrect struct vs. class
+        here as seen in warnings on Chromium Windows bot.
+
+2010-06-26  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build by adding back function used only by Windows WebKit.
+
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::label): Added back.
+        * html/HTMLOptionElement.h: Added label function.
+
+2010-06-26  Darin Adler  <darin@apple.com>
+
+        Try to fix Qt build by adding back function used only by Qt WebKit.
+
+        * html/HTMLMetaElement.cpp:
+        (WebCore::HTMLMetaElement::content): Added back.
+        * html/HTMLMetaElement.h: Added content function.
+
+2010-06-26  Darin Adler  <darin@apple.com>
+
+        * html/HTMLFormElement.h: Removed stray character that got in here before landing.
+
+2010-06-26  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add more use of reflection, remove unused functions
+        https://bugs.webkit.org/show_bug.cgi?id=41255
+
+        Also noticed that HTMLDirectoryElement was missing its create function
+        and added that so the element will get the correct class.
+
+        * html/HTMLBaseFontElement.idl: Use reflection for the size attribute
+        in the Objective-C code path too.
+
+        * html/HTMLSelectElement.idl: Use reflection for disabled and autofocus
+        attributes. Also removed spaces and indenting to match other IDL files.
+
+        * html/HTMLStyleElement.idl: Use reflection for disabled attribute.
+
+        * html/HTMLTableCellElement.idl: Use reflection for noWrap attribute.
+
+        * html/HTMLTextAreaElement.idl: Use reflection for disabled, autofocus,
+        readOnly, and required attributes.
+
+        * html/HTMLUListElement.idl: Use reflection for compact attribute.
+
+        * html/HTMLDirectoryElement.cpp:
+        (WebCore::HTMLDirectoryElement::HTMLDirectoryElement): Made inline.
+        (WebCore::HTMLDirectoryElement::create): Added.
+        * html/HTMLDirectoryElement.h:
+        Added create, made constructor private, removed unused functions.
+
+        * html/HTMLStyleElement.cpp:
+        (WebCore::HTMLStyleElement::parseMappedAttribute): Removed code to
+        set unused m_media data member.
+        * html/HTMLStyleElement.h:
+        Removed unused functions and m_media data member. Also made some
+        functions private.
+
+        * html/HTMLAppletElement.cpp:
+        * html/HTMLAppletElement.h:
+        * html/HTMLAreaElement.cpp:
+        * html/HTMLAreaElement.h:
+        * html/HTMLBaseFontElement.cpp:
+        * html/HTMLBaseFontElement.h:
+        * html/HTMLButtonElement.cpp:
+        * html/HTMLButtonElement.h:
+        * html/HTMLDListElement.cpp:
+        * html/HTMLDListElement.h:
+        * html/HTMLDivElement.cpp:
+        * html/HTMLDivElement.h:
+        * html/HTMLFontElement.cpp:
+        * html/HTMLFontElement.h:
+        * html/HTMLFormControlElement.cpp:
+        * html/HTMLFormControlElement.h:
+        * html/HTMLFormElement.cpp:
+        * html/HTMLFormElement.h:
+        * html/HTMLFrameElement.cpp: Also removed an incorrect FIXME comment
+        here after I did a little research to disprove it.
+        * html/HTMLFrameElement.h:
+        * html/HTMLFrameSetElement.cpp:
+        * html/HTMLFrameSetElement.h:
+        * html/HTMLHRElement.cpp:
+        * html/HTMLHRElement.h:
+        * html/HTMLHeadElement.cpp:
+        * html/HTMLHeadElement.h:
+        * html/HTMLHeadingElement.cpp:
+        * html/HTMLHeadingElement.h:
+        * html/HTMLHtmlElement.cpp:
+        * html/HTMLHtmlElement.h:
+        * html/HTMLImageElement.cpp:
+        * html/HTMLImageElement.h:
+        * html/HTMLInputElement.cpp:
+        * html/HTMLInputElement.h:
+        * html/HTMLIsIndexElement.cpp:
+        * html/HTMLIsIndexElement.h:
+        * html/HTMLLIElement.cpp:
+        * html/HTMLLIElement.h:
+        * html/HTMLLabelElement.cpp:
+        * html/HTMLLabelElement.h:
+        * html/HTMLLegendElement.cpp:
+        * html/HTMLLegendElement.h:
+        * html/HTMLLinkElement.cpp:
+        * html/HTMLLinkElement.h:
+        * html/HTMLMapElement.cpp:
+        * html/HTMLMapElement.h:
+        * html/HTMLMenuElement.cpp:
+        * html/HTMLMenuElement.h:
+        * html/HTMLMetaElement.cpp:
+        * html/HTMLMetaElement.h:
+        * html/HTMLModElement.cpp:
+        * html/HTMLModElement.h:
+        * html/HTMLOListElement.cpp:
+        * html/HTMLOListElement.h:
+        * html/HTMLObjectElement.cpp:
+        * html/HTMLObjectElement.h:
+        * html/HTMLOptGroupElement.cpp:
+        * html/HTMLOptGroupElement.h:
+        * html/HTMLOptionElement.cpp:
+        * html/HTMLOptionElement.h:
+        * html/HTMLParagraphElement.cpp:
+        * html/HTMLParagraphElement.h:
+        * html/HTMLParamElement.cpp:
+        * html/HTMLParamElement.h:
+        * html/HTMLPlugInElement.cpp:
+        * html/HTMLPlugInElement.h:
+        * html/HTMLPreElement.cpp:
+        * html/HTMLPreElement.h:
+        * html/HTMLQuoteElement.cpp:
+        * html/HTMLQuoteElement.h:
+        * html/HTMLScriptElement.cpp:
+        * html/HTMLScriptElement.h:
+        * html/HTMLTableCaptionElement.cpp:
+        * html/HTMLTableCaptionElement.h:
+        * html/HTMLTableCellElement.cpp:
+        * html/HTMLTableCellElement.h:
+        * html/HTMLTableColElement.cpp:
+        * html/HTMLTableColElement.h:
+        * html/HTMLTableElement.cpp:
+        * html/HTMLTableElement.h:
+        * html/HTMLTableRowElement.cpp:
+        * html/HTMLTableRowElement.h:
+        * html/HTMLTextAreaElement.cpp:
+        * html/HTMLTextAreaElement.h:
+        * html/HTMLUListElement.cpp:
+        * html/HTMLUListElement.h:
+        * html/HTMLVideoElement.cpp:
+        * html/HTMLVideoElement.h:
+        Removed unused functions.
+
+2010-06-26  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Exclude line numbers for sources which are not from the network.
+        https://bugs.webkit.org/show_bug.cgi?id=41060
+
+        * html/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::write):
+
+2010-06-25  Antonio Gomes  <tonikitoo@webkit.org>
+
+        Unreviewed complementary fix for r61818. It added StaticHashSetListNode.cpp|h to the system,
+        but did not added it to chromium build system.
+
+        * WebCore.gypi:
+
+2010-06-26  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: ScripsPanel.prototype.editScriptSource uses old addBreakpoint signature.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41247
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.removeBreakpoint):
+        (WebInspector.Breakpoint.prototype.set enabled):
+        (WebInspector.Breakpoint.prototype.set condition):
+        * inspector/front-end/Object.js:
+        (WebInspector.Object.prototype.addEventListener):
+        (WebInspector.Object.prototype.removeEventListener):
+        (WebInspector.Object.prototype.removeAllListeners):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.editScriptSource.mycallback):
+        (WebInspector.ScriptsPanel.prototype.editScriptSource):
+
+2010-06-26  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a guarded window.performance.timing binding which is disabled by default.
+        https://bugs.webkit.org/show_bug.cgi?id=38924
+
+        This is where Web Timing support will be implemented. Web Timing is a
+        draft spec for exposing load times to web pages. It will be enabled
+        once the spec and implementaiton are solidified. See:
+        http://dev.w3.org/2006/webapi/WebTiming/
+
+        No new tests because guarded behind a #DEFINE. Will add tests as
+        functionality is landed.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * Configurations/FeatureDefines.xcconfig:
+        * DerivedSources.cpp:
+        * DerivedSources.make:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pri:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::clear):
+        (WebCore::DOMWindow::performance):
+        * page/DOMWindow.h:
+        (WebCore::DOMWindow::optionalPerformance):
+        * page/DOMWindow.idl:
+        * page/NavigationTiming.cpp: Added.
+        (WebCore::NavigationTiming::NavigationTiming):
+        (WebCore::NavigationTiming::frame):
+        (WebCore::NavigationTiming::disconnectFrame):
+        (WebCore::NavigationTiming::navigationStart):
+        * page/NavigationTiming.h: Added.
+        (WebCore::NavigationTiming::create):
+        * page/NavigationTiming.idl: Added.
+        * page/Performance.cpp: Added.
+        (WebCore::Performance::Performance):
+        (WebCore::Performance::frame):
+        (WebCore::Performance::disconnectFrame):
+        (WebCore::Performance::timing):
+        * page/Performance.h: Added.
+        (WebCore::Performance::create):
+        * page/Performance.idl: Added.
+
+2010-06-25  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        activeTexture wrongly generates error with legal input.
+        https://bugs.webkit.org/show_bug.cgi?id=41227
+
+        Test: fast/canvas/webgl/texture-active-bind.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::activeTexture): Fix the upper limit test for test units.
+
+2010-06-25  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41061
+        Make sure Chromium's ScriptController::processingUserGesture follows the JSC's behavior.
+        Set right value in UserGestureIndicator when handling events in PopupMenuList in chromium.
+
+        Test: fast/events/popup-when-select-change.html
+
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::processingUserGesture):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::handleMouseDownEvent):
+        (WebCore::PopupContainer::handleMouseMoveEvent):
+        (WebCore::PopupContainer::handleMouseReleaseEvent):
+        (WebCore::PopupContainer::handleWheelEvent):
+        (WebCore::PopupContainer::handleKeyEvent):
+
+2010-06-25  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Make PendingScript hold a CachedResourceClient open for its lifetime
+        https://bugs.webkit.org/show_bug.cgi?id=40968
+
+        This replaces the mechanism introduced in r61374 with a simpler
+        appraoch for preventing unexpected purges: always keep a client open.
+        This approach will allow deferred scripts to add a client after
+        the resource may have already been loaded without having to worry about
+        the buffer being purged in the meantime.
+
+        No new tests because making a CachedResource purse itself is not
+        testable from a LayoutTest.
+
+        * html/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::watchForLoad):
+        (WebCore::HTMLDocumentParser::notifyFinished):
+        * html/HTMLScriptRunner.cpp:
+        (WebCore::HTMLScriptRunner::~HTMLScriptRunner):
+        (WebCore::HTMLScriptRunner::sourceFromPendingScript):
+        (WebCore::HTMLScriptRunner::isPendingScriptReady):
+        (WebCore::HTMLScriptRunner::executePendingScript):
+        (WebCore::HTMLScriptRunner::watchForLoad):
+        (WebCore::HTMLScriptRunner::stopWatchingForLoad):
+        (WebCore::HTMLScriptRunner::executeScriptsWaitingForLoad):
+        (WebCore::HTMLScriptRunner::requestScript):
+        (WebCore::HTMLScriptRunner::PendingScript::~PendingScript):
+        (WebCore::HTMLScriptRunner::PendingScript::releaseElementAndClear):
+        (WebCore::HTMLScriptRunner::PendingScript::setCachedScript):
+        (WebCore::HTMLScriptRunner::PendingScript::cachedScript):
+        * html/HTMLScriptRunner.h:
+        (WebCore::HTMLScriptRunner::PendingScript::PendingScript):
+        (WebCore::HTMLScriptRunner::PendingScript::watchingForLoad):
+        (WebCore::HTMLScriptRunner::PendingScript::setWatchingForLoad):
+        (WebCore::HTMLScriptRunner::PendingScript::notifyFinished):
+        * html/HTMLScriptRunnerHost.h:
+
+2010-06-25  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        getUniform will not work for fetching uniform array elements
+        https://bugs.webkit.org/show_bug.cgi?id=34508
+
+        Test: fast/canvas/webgl/gl-uniform-arrays.html
+
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::attachShader): Generate correct errors.
+        (WebCore::WebGLRenderingContext::getUniform): Dealing with array elements.
+        (WebCore::WebGLRenderingContext::useProgram): Deal with program==null.
+        (WebCore::WebGLRenderingContext::validateProgram): Generate correct errors.
+        * platform/graphics/mac/GraphicsContext3DMac.mm:
+        (WebCore::GraphicsContext3D::useProgram): Deal with program==null.
+
+2010-06-25  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Bring set/get state functions to GLES2 conformance
+        https://bugs.webkit.org/show_bug.cgi?id=41095
+
+        Tests: fast/canvas/webgl/gl-enable-enum-test.html
+               fast/canvas/webgl/gl-enum-tests.html
+
+        * html/canvas/WebGLRenderingContext.cpp: Check input parameters according to GLES2 spec.
+        (WebCore::WebGLRenderingContext::blendEquation):
+        (WebCore::WebGLRenderingContext::blendEquationSeparate):
+        (WebCore::WebGLRenderingContext::disable):
+        (WebCore::WebGLRenderingContext::enable):
+        (WebCore::WebGLRenderingContext::hint):
+        (WebCore::WebGLRenderingContext::isEnabled):
+        (WebCore::WebGLRenderingContext::pixelStorei):
+        (WebCore::WebGLRenderingContext::validateBlendEquation):
+        (WebCore::WebGLRenderingContext::validateCapability):
+        * html/canvas/WebGLRenderingContext.h: Add helper function declaration.
+
+2010-06-25  Sterling Swigart  <sswigart@google.com>
+
+        Reviewed by David Levin.
+
+        Callback code generation fixed so that now string parameters are converted to JSString
+        using the jsString method instead of the toJS method which would not compile.
+        https://bugs.webkit.org/show_bug.cgi?id=41119
+        
+        * bindings/scripts/CodeGeneratorJS.pm: Now generates jsString for String parameters in callbacks.
+        * bindings/scripts/test/JS/JSTestCallback.cpp: Fixed test for above.
+        (WebCore::JSTestCallback::callbackWithClass2Param): Ditto.
+
+2010-06-25  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        A buffer should be bound to one target in its lifetime
+        https://bugs.webkit.org/show_bug.cgi?id=41108
+
+        Test: fast/canvas/webgl/buffer-bind-test.html
+
+        * html/canvas/WebGLBuffer.cpp:
+        (WebCore::WebGLBuffer::WebGLBuffer): Init target to 0. 
+        (WebCore::WebGLBuffer::associateBufferData): Remove target parameter, use one byteLength member.
+        (WebCore::WebGLBuffer::associateBufferSubData): Ditto.
+        (WebCore::WebGLBuffer::byteLength): Ditto.
+        (WebCore::WebGLBuffer::setTarget): Set target.
+        * html/canvas/WebGLBuffer.h: Cache target in the WebGLBuffer object, use one byteLength member.
+        (WebCore::WebGLBuffer::getTarget):
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::bindBuffer): Check if a buffer is bound to another target; set buffer object internal target.
+        (WebCore::WebGLRenderingContext::bufferData): Remove target parameter and use the WebGLBuffer cached target instead.
+        (WebCore::WebGLRenderingContext::bufferSubData): Ditto.
+        (WebCore::WebGLRenderingContext::validateElementArraySize): Ditto.
+        (WebCore::WebGLRenderingContext::validateIndexArrayConservative): Ditto.
+        (WebCore::WebGLRenderingContext::vertexAttribPointer): Ditto.
+
+2010-06-25  Dean Jackson  <dino@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41188
+        Animations should not require 0% and 100% keyframes
+
+        When we are generating the animation lists in CSSStyleSelector,
+        rather than bail if we notice that "from" or "to" are missing, we
+        now generate synthetic keyframes for those cases.
+
+        Tests: animations/missing-from-to-transforms.html
+               animations/missing-from-to.html
+               WebCore/manual-tests/animation-with-transition.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForKeyframe):
+                Moved individual keyframe generation into a new function.
+        (WebCore::CSSStyleSelector::keyframeStylesForAnimation):
+                Call the new function above for regular keyframes, and
+                also check for missing keyframes and generate them if
+                necessary.
+        * css/CSSStyleSelector.h:
+
+2010-06-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        We should parse <html>
+        https://bugs.webkit.org/show_bug.cgi?id=41239
+
+        This patch is hard to test, but I think this patch lets us parse a
+        document consisting of only an <html> start tag.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
+        (WebCore::HTMLTreeBuilder::insertHTMLStartTagBeforeHTML):
+        (WebCore::HTMLTreeBuilder::insertHTMLStartTagInBody):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processDefaultForBeforeHTMLMode):
+        * html/HTMLTreeBuilder.h:
+        (WebCore::HTMLTreeBuilder::ElementStack::push):
+
+2010-06-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8000667> Certain text is repeated before and after a line break
+
+        Test: fast/text/bidi-explicit-embedding-past-end.html
+
+        * platform/text/BidiResolver.h:
+        (WebCore::::createBidiRunsForLine): Committing explicit embedding past the end of the range
+        creates BidiRuns up to the end of the range, so at that point, we can stop iterating.
+
+2010-06-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move decoding into DocumentParser to further simplify RawDataDocumentParser and DocumentWriter
+        https://bugs.webkit.org/show_bug.cgi?id=41202
+
+        Hit the Windoze with the compile bat.
+
+        * WebCore.vcproj/WebCore.vcproj:
+
+2010-06-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        HTMLTreeBuilder should branch first on token type and then on insertion mode
+        https://bugs.webkit.org/show_bug.cgi?id=41232
+
+        This is different than how the spec is written, but it lets us remove a
+        lot of redudancy in the algorithm.  We might even want to pull some of
+        the branches on token name outside the insertion mode branch, but I'll
+        leave that for a future patch.
+
+        Although this looks like a big patch, it's mostly just a mechanical
+        switch permutation.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
+        (WebCore::HTMLTreeBuilder::processToken):
+        (WebCore::HTMLTreeBuilder::processDoctypeToken):
+        (WebCore::HTMLTreeBuilder::processStartTag):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processComment):
+        (WebCore::HTMLTreeBuilder::processCharacter):
+        (WebCore::HTMLTreeBuilder::processEndOfFile):
+        (WebCore::HTMLTreeBuilder::processDefaultForInitialMode):
+        (WebCore::HTMLTreeBuilder::processDefaultForBeforeHTMLMode):
+        (WebCore::HTMLTreeBuilder::processDefaultForBeforeHeadMode):
+        (WebCore::HTMLTreeBuilder::processDefaultForInHeadMode):
+        (WebCore::HTMLTreeBuilder::processDefaultForInHeadNoscriptMode):
+        (WebCore::HTMLTreeBuilder::processDefaultForAfterHeadMode):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Tree builder doesn't need to return a Node
+        https://bugs.webkit.org/show_bug.cgi?id=41225
+
+        The old tree builder returned the newly inserted Node, but the new tree
+        builder doesn't need to do that as far as I can tell.  Removing the
+        return value cuts down on a bunch of accounting.
+
+        * html/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::passTokenToLegacyParser):
+        (WebCore::HTMLTreeBuilder::constructTreeFromToken):
+        (WebCore::HTMLTreeBuilder::processToken):
+        (WebCore::HTMLTreeBuilder::insertDoctype):
+        (WebCore::HTMLTreeBuilder::insertComment):
+        (WebCore::HTMLTreeBuilder::insertGenericRCDATAElement):
+        (WebCore::HTMLTreeBuilder::insertGenericRawTextElement):
+        (WebCore::HTMLTreeBuilder::insertScriptElement):
+        * html/HTMLTreeBuilder.h:
+
+2010-06-25  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        getParameter(COLOR_WRITEMASK) needs to return Array
+        https://bugs.webkit.org/show_bug.cgi?id=40437
+
+        * bindings/js/JSWebGLRenderingContextCustom.cpp: Handling bool array.
+        (WebCore::toJS):
+        * bindings/v8/custom/V8WebGLRenderingContextCustom.cpp: Handling bool array.
+        (WebCore::toV8Object):
+        * html/canvas/WebGLGetInfo.cpp: Handling bool array.
+        (WebCore::WebGLGetInfo::WebGLGetInfo):
+        (WebCore::WebGLGetInfo::getBoolArray):
+        * html/canvas/WebGLGetInfo.h: Handling bool array.
+        (WebCore::WebGLGetInfo::):
+        * html/canvas/WebGLRenderingContext.cpp: Handling bool array.
+        (WebCore::WebGLRenderingContext::getParameter):
+        (WebCore::WebGLRenderingContext::getBooleanArrayParameter):
+        * html/canvas/WebGLRenderingContext.h: Handling bool array.
+
+2010-06-25  Evan Stade  <estade@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium linux] Improve look of scrollbars
+        https://bugs.webkit.org/show_bug.cgi?id=35775
+
+        This will affect layout pixel tests, which will need to be rebaselined.
+
+        * platform/Scrollbar.cpp: need the buttons to be invalidated when the
+        thumb moves as they paint differently if the thumb is at the top or
+        bottom
+        (WebCore::Scrollbar::updateThumbPosition):
+        (WebCore::Scrollbar::updateThumbProportion):
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::trackRect): share code between
+        linux/windows
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::scrollbarThickness):
+        (WebCore::outlineColor): up the contrast
+        (WebCore::ScrollbarThemeChromiumLinux::paintButton): add custom button
+        drawing implementation
+        (WebCore::ScrollbarThemeChromiumLinux::buttonSize): add buttons
+        * platform/chromium/ScrollbarThemeChromiumWin.cpp: share code between
+        linux/windows
+        * rendering/RenderThemeChromiumLinux.cpp: improve stock colors to get
+        better contrast and integration with stock chrome theme
+
+2010-06-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Move decoding into DocumentParser to further simplify RawDataDocumentParser and DocumentWriter
+        https://bugs.webkit.org/show_bug.cgi?id=41202
+
+        The silly thing about this patch is that none of the
+        RawDataDocumentParser subclasses actually use any of the
+        data passed to them via appendBytes.
+
+        This makes the relationship between DocumentWriter and
+        DocumentParser slightly more confusing, however I think this
+        DocumentParser API is slightly nicer.
+
+        Next step is to split DecodedDataDocumentParser out from
+        DocumentParser, and then the base DocumentParser won't know
+        anything about decoding or SegmentedString.
+
+        No functional change, thus no tests.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * dom/DocumentParser.h:
+        * dom/RawDataDocumentParser.h:
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::replaceDocument):
+        (WebCore::DocumentWriter::createDecoderIfNeeded):
+        (WebCore::DocumentWriter::reportDataRecieved):
+        (WebCore::DocumentWriter::addData):
+        * loader/DocumentWriter.h:
+        * loader/ImageDocument.cpp:
+        (WebCore::ImageDocumentParser::appendBytes):
+        * loader/MediaDocument.cpp:
+        (WebCore::MediaDocumentParser::appendBytes):
+        * loader/PluginDocument.cpp:
+        (WebCore::PluginDocumentParser::appendBytes):
+        * loader/SinkDocument.cpp:
+        (WebCore::SinkDocumentParser::SinkDocumentParser):
+        (WebCore::SinkDocumentParser::appendBytes):
+        (WebCore::SinkDocument::createParser):
+
+2010-06-25  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Split DocumentParser::write into separate append and insert calls
+        https://bugs.webkit.org/show_bug.cgi?id=41197
+
+        Unfortunately this is still somewhat confusing as
+        "insert" means "insert this data at the current
+        insertion point and run the parser synchronously
+        unless we're in a nested write call" and "append"
+        means "append this data to the end and run the
+        parser if not in a nested call or until possibly yielding".
+
+        This at least makes clearer which document parsers implement
+        which behavior, and paves the way for moving the decoding
+        logic into DocumentParser from DocumentWriter.
+
+        No functional changes, thus no tests.
+
+        * dom/Document.cpp:
+        (WebCore::Document::write):
+        * dom/DocumentParser.h:
+        * dom/RawDataDocumentParser.h:
+        (WebCore::RawDataDocumentParser::insert):
+        (WebCore::RawDataDocumentParser::append):
+        * dom/XMLDocumentParser.cpp:
+        (WebCore::XMLDocumentParser::insert):
+        (WebCore::XMLDocumentParser::append):
+        * dom/XMLDocumentParser.h:
+        * dom/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::resumeParsing):
+        * html/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::insert):
+        (WebCore::HTMLDocumentParser::append):
+        (WebCore::HTMLDocumentParser::parseDocumentFragment):
+        * html/HTMLDocumentParser.h:
+        * html/LegacyHTMLDocumentParser.cpp:
+        (WebCore::LegacyHTMLDocumentParser::insert):
+        (WebCore::LegacyHTMLDocumentParser::append):
+        * html/LegacyHTMLDocumentParser.h:
+        * loader/DocumentWriter.cpp:
+        (WebCore::DocumentWriter::replaceDocument):
+        (WebCore::DocumentWriter::addData):
+        * loader/FTPDirectoryDocument.cpp:
+        (WebCore::FTPDirectoryDocumentParser::FTPDirectoryDocumentParser):
+        (WebCore::FTPDirectoryDocumentParser::loadDocumentTemplate):
+        (WebCore::FTPDirectoryDocumentParser::append):
+        * loader/TextDocument.cpp:
+        (WebCore::TextDocumentParser::insert):
+        (WebCore::TextDocumentParser::append):
+        (WebCore::TextDocumentParser::finish):
+
+2010-06-25  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Add new stubs for querying platform drag-and-drop and copy-and-paste data.
+
+        This change adds new stubs for querying for data in a clipboard or drag operation. This is
+        so adding support for more data types in clipboard/drag operations doesn't become
+        increasingly expensive, since we currently copy all the drag data we need every time a new
+        web drop target is entered. It also adds a new mechanism to write back to the system
+        clipboard that isn't tied to one data type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40540
+
+        No new tests since we're just adding new ChromiumBridge APIs. When we switch to it, it will
+        be covered by the existing tests.
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/PasteboardPrivate.h:
+        (WebCore::PasteboardPrivate::):
+
+2010-06-25  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Implement atk_table_get_column_header
+        https://bugs.webkit.org/show_bug.cgi?id=30896
+
+        Implemented get_column_header and modified get_row_header
+        accordingly to keep them both coherent among themselves.
+        Based on a previous patch by Joanmarie Diggs.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_table_get_column_header):
+        (webkit_accessible_table_get_row_header):
+
+2010-06-29  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Pasteboard code does not take into account the nil character when getting and setting markup/netscape-url data
+        https://bugs.webkit.org/show_bug.cgi?id=41221
+
+        Take into account null-terminator when getting and setting markup and
+        Netscape URL pasteboard types. This means that if the selection data
+        contains the null terminator, it won't be included in the final String.
+        When setting the pasteboard data the null terminator is now included to
+        match the behavior of other applications.
+
+        * platform/gtk/PasteboardHelper.cpp:
+        (WebCore::PasteboardHelper::getClipboardContents):
+        Create the markup string after using g_strndup to protect against non-null-terminated
+        strings. Use String::fromUTF8 here to ensure that the string is not longer than the
+        first null-terminator. Also fix a small indentation issue.
+        (WebCore::PasteboardHelper::fillSelectionData):
+        Always include the null-terminator when setting pasteboard data manually. This matches
+        the behavior of other browser applications.
+
+2010-06-25  Sam Magnuson  <smagnuson@netflix.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] When any geometry change happens to a node it will resize the
+        backing cache
+        https://bugs.webkit.org/show_bug.cgi?id=40378
+
+        Continue to grow the cache, but never toss it. When the pixmap
+        cache gets too big it will be lost and created at the right size
+        next time.
+
+        No new tests: this is an optimization.
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::recache):
+        (WebCore::GraphicsLayerQtImpl::paint):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+
+2010-06-25  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41019
+        Canvas: Remember verified clean origins for drawImage()
+
+        Made CanvasRenderingContext2D cache the KURLs of clean origins
+        for fast repeated lookup.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::checkOrigin):
+        * html/canvas/CanvasRenderingContext2D.h:
+
+2010-06-25  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] HTTP 307 after a 303 after a POST re-sends POST data from the original request
+
+        https://bugs.webkit.org/show_bug.cgi?id=35301
+
+        Qt needs to use ResourceRequest::request()->httpMethod()) in order to determine
+        the appropriate method for a 307 redirect request.
+
+        When deciding if it needs to override a POST method with a GET method during a
+        redirect chain, QNetworkReplyHandler needs to check the HTTP method stored
+        in ResourceRequest::request()->httpMethod(). This will always contain the
+        original request method in a redirect chain and, more importantly, is the
+        method that will be used for the request created from the redirect
+        if it is not overridden.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+
+2010-06-25  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Removed a one-line method that only had one internal caller.
+
+        * rendering/RenderBlock.h: Removed bidiReorderLine()
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren): Moved the implementation of
+        bidiReorderLine() inline here.
+
 2010-06-25  Nate Chapin  <japhet@chromium.org>
 
         Reviewed by Adam Barth.
diff --git a/WebCore/Configurations/FeatureDefines.xcconfig b/WebCore/Configurations/FeatureDefines.xcconfig
index 08d9ef9..8f86fc3 100644
--- a/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/WebCore/Configurations/FeatureDefines.xcconfig
@@ -48,6 +48,7 @@ ENABLE_DATABASE = ENABLE_DATABASE;
 ENABLE_DATAGRID = ;
 ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DEVICE_ORIENTATION = ;
+ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
 ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
 ENABLE_FILTERS = ENABLE_FILTERS;
@@ -76,10 +77,12 @@ ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
+ENABLE_WEB_TIMING = ;
 ENABLE_WML = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB_SLICE) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_READER) $(ENABLE_FILE_WRITER) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB_SLICE) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_READER) $(ENABLE_FILE_WRITER) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+
diff --git a/WebCore/Configurations/Version.xcconfig b/WebCore/Configurations/Version.xcconfig
index f775a54..2749545 100644
--- a/WebCore/Configurations/Version.xcconfig
+++ b/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 2;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebCore/DerivedSources.cpp b/WebCore/DerivedSources.cpp
index 904ea55..5f2fe58 100644
--- a/WebCore/DerivedSources.cpp
+++ b/WebCore/DerivedSources.cpp
@@ -25,6 +25,7 @@
 
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
+#include "HTMLElementFactory.cpp"
 #include "JSAbstractWorker.cpp"
 #include "JSAttr.cpp"
 #include "JSBarInfo.cpp"
@@ -81,6 +82,7 @@
 #include "JSDOMParser.cpp"
 #include "JSDOMSelection.cpp"
 #include "JSDOMStringList.cpp"
+#include "JSDOMStringMap.cpp"
 #include "JSDOMWindow.cpp"
 #include "JSElement.cpp"
 #include "JSEntity.cpp"
@@ -182,6 +184,9 @@
 #include "JSIDBSuccessEvent.cpp"
 #include "JSImageData.cpp"
 #include "JSIndexedDatabaseRequest.cpp"
+#include "JSInjectedScriptHost.cpp"
+#include "JSInspectorBackend.cpp"
+#include "JSInspectorFrontendHost.cpp"
 #include "JSJavaScriptCallFrame.cpp"
 #include "JSKeyboardEvent.cpp"
 #include "JSLocation.cpp"
@@ -196,6 +201,7 @@
 #include "JSMouseEvent.cpp"
 #include "JSMutationEvent.cpp"
 #include "JSNamedNodeMap.cpp"
+#include "JSNavigation.cpp"
 #include "JSNavigator.cpp"
 #include "JSNode.cpp"
 #include "JSNodeFilter.cpp"
@@ -206,6 +212,7 @@
 #include "JSNotification.cpp"
 #include "JSOverflowEvent.cpp"
 #include "JSPageTransitionEvent.cpp"
+#include "JSPerformance.cpp"
 #include "JSPlugin.cpp"
 #include "JSPluginArray.cpp"
 #include "JSPopStateEvent.cpp"
@@ -273,6 +280,7 @@
 #include "JSSVGFEColorMatrixElement.cpp"
 #include "JSSVGFEComponentTransferElement.cpp"
 #include "JSSVGFECompositeElement.cpp"
+#include "JSSVGFEConvolveMatrixElement.cpp"
 #include "JSSVGFEDiffuseLightingElement.cpp"
 #include "JSSVGFEDisplacementMapElement.cpp"
 #include "JSSVGFEDistantLightElement.cpp"
@@ -375,6 +383,7 @@
 #include "JSTextEvent.cpp"
 #include "JSTextMetrics.cpp"
 #include "JSTimeRanges.cpp"
+#include "JSTiming.cpp"
 #include "JSTouch.cpp"
 #include "JSTouchEvent.cpp"
 #include "JSTouchList.cpp"
@@ -405,6 +414,8 @@
 #include "JSXPathNSResolver.cpp"
 #include "JSXPathResult.cpp"
 #include "JSXSLTProcessor.cpp"
+#include "WMLElementFactory.cpp"
+#include "WMLNames.cpp"
 #include "UserAgentStyleSheetsData.cpp"
 
 // On MSVC, including StaticConstructors.h causes all global objects not to be
diff --git a/WebCore/DerivedSources.make b/WebCore/DerivedSources.make
index bf09a22..5e80f2e 100644
--- a/WebCore/DerivedSources.make
+++ b/WebCore/DerivedSources.make
@@ -53,6 +53,7 @@ DOM_CLASSES = \
     Attr \
     BarInfo \
     BeforeLoadEvent \
+    BeforeProcessEvent \
     Blob \
     BlobBuilder \
     CDATASection \
@@ -115,6 +116,7 @@ DOM_CLASSES = \
     DOMParser \
     DOMSelection \
     DOMStringList \
+    DOMStringMap \
     DOMWindow \
     Database \
     DatabaseCallback \
@@ -241,6 +243,7 @@ DOM_CLASSES = \
     MouseEvent \
     MutationEvent \
     NamedNodeMap \
+    Navigation \
     Navigator \
     Node \
     NodeFilter \
@@ -251,6 +254,7 @@ DOM_CLASSES = \
     NotificationCenter \
     OverflowEvent \
     PageTransitionEvent \
+    Performance \
     Plugin \
     PluginArray \
     PopStateEvent \
@@ -317,6 +321,7 @@ DOM_CLASSES = \
     SVGFEColorMatrixElement \
     SVGFEComponentTransferElement \
     SVGFECompositeElement \
+    SVGFEConvolveMatrixElement \
     SVGFEDiffuseLightingElement \
     SVGFEDisplacementMapElement \
     SVGFEDistantLightElement \
@@ -432,6 +437,7 @@ DOM_CLASSES = \
     TextEvent \
     TextMetrics \
     TimeRanges \
+    Timing \
     Touch \
     TouchEvent \
     TouchList \
@@ -873,6 +879,10 @@ ifeq ($(findstring ENABLE_3D_RENDERING,$(FEATURE_DEFINES)), ENABLE_3D_RENDERING)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.3DRendering.exp
 endif
 
+ifeq ($(shell gcc -arch x86_64 -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep WTF_USE_ACCELERATED_COMPOSITING | cut -d' ' -f3), 1)
+    WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.AcceleratedCompositing.exp
+endif
+
 ifeq ($(shell gcc -E -P -dM $(FRAMEWORK_FLAGS) WebCore/ForwardingHeaders/wtf/Platform.h | grep ENABLE_CONTEXT_MENUS | cut -d' ' -f3), 1)
     WEBCORE_EXPORT_DEPENDENCIES := $(WEBCORE_EXPORT_DEPENDENCIES) WebCore.ContextMenus.exp
 endif
diff --git a/WebCore/ForwardingHeaders/wtf/AVLTree.h b/WebCore/ForwardingHeaders/wtf/AVLTree.h
new file mode 100644
index 0000000..151b7f7
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/AVLTree.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_AVLTree_h
+#define WebCore_FWD_AVLTree_h
+#include <JavaScriptCore/AVLTree.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/FixedArray.h b/WebCore/ForwardingHeaders/wtf/FixedArray.h
new file mode 100644
index 0000000..fc8dd7e
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/FixedArray.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_FixedArray_h
+#define WebCore_FWD_FixedArray_h
+#include <JavaScriptCore/FixedArray.h>
+#endif
diff --git a/WebCore/GNUmakefile.am b/WebCore/GNUmakefile.am
index 8f9c245..bf197fc 100644
--- a/WebCore/GNUmakefile.am
+++ b/WebCore/GNUmakefile.am
@@ -65,7 +65,9 @@ webcore_cppflags += \
 	-I$(srcdir)/WebCore/workers \
 	-I$(srcdir)/WebCore/xml \
 	-I$(top_builddir)/WebCore/bindings/js \
+	-I$(top_builddir)/DerivedSources/WebCore \
 	-I$(top_builddir)/DerivedSources \
+	-I$(top_builddir)/DerivedSources/JavaScriptCore \
 	-DDATA_DIR=\"${datadir}\"
 
 webcoregtk_cppflags += \
@@ -81,24 +83,28 @@ webcoregtk_cppflags += \
 	-I$(srcdir)/WebCore/platform/network/soup
 
 webcore_built_nosources += \
-	DerivedSources/DocTypeStrings.cpp \
-	DerivedSources/tokenizer.cpp \
-	DerivedSources/ColorData.cpp \
+	DerivedSources/WebCore/DocTypeStrings.cpp \
+	DerivedSources/WebCore/tokenizer.cpp \
+	DerivedSources/WebCore/ColorData.cpp \
 	DerivedSources/webkit/webkitdomdummy.c
 
 webcore_built_sources += \
-	DerivedSources/CSSGrammar.cpp \
-	DerivedSources/CSSGrammar.h \
-	DerivedSources/CSSPropertyNames.h \
-	DerivedSources/CSSValueKeywords.h \
-	DerivedSources/HTMLElementFactory.cpp \
-	DerivedSources/HTMLEntityNames.cpp \
-	DerivedSources/HTMLNames.cpp \
-	DerivedSources/JSHTMLElementWrapperFactory.cpp \
-	DerivedSources/UserAgentStyleSheets.h \
-	DerivedSources/UserAgentStyleSheetsData.cpp \
-	DerivedSources/XMLNSNames.cpp \
-	DerivedSources/XMLNames.cpp
+	DerivedSources/WebCore/CSSGrammar.cpp \
+	DerivedSources/WebCore/CSSGrammar.h \
+	DerivedSources/WebCore/CSSPropertyNames.h \
+	DerivedSources/WebCore/CSSValueKeywords.h \
+	DerivedSources/WebCore/HTMLElementFactory.cpp \
+	DerivedSources/WebCore/HTMLElementFactory.h \
+	DerivedSources/WebCore/HTMLEntityNames.cpp \
+	DerivedSources/WebCore/HTMLNames.cpp \
+	DerivedSources/WebCore/HTMLNames.h \
+	DerivedSources/WebCore/JSHTMLElementWrapperFactory.cpp \
+	DerivedSources/WebCore/UserAgentStyleSheets.h \
+	DerivedSources/WebCore/UserAgentStyleSheetsData.cpp \
+	DerivedSources/WebCore/XMLNSNames.cpp \
+	DerivedSources/WebCore/XMLNSNames.h \
+	DerivedSources/WebCore/XMLNames.cpp
+	DerivedSources/WebCore/XMLNames.h
 
 IDL_BINDINGS += \
 	WebCore/css/CSSCharsetRule.idl \
@@ -129,6 +135,7 @@ IDL_BINDINGS += \
 	WebCore/css/WebKitCSSTransformValue.idl \
 	WebCore/dom/Attr.idl \
 	WebCore/dom/BeforeLoadEvent.idl \
+	WebCore/dom/BeforeProcessEvent.idl \
 	WebCore/dom/CDATASection.idl \
 	WebCore/dom/CharacterData.idl \
 	WebCore/dom/ClientRect.idl \
@@ -140,6 +147,7 @@ IDL_BINDINGS += \
 	WebCore/dom/DOMCoreException.idl \
 	WebCore/dom/DOMImplementation.idl \
 	WebCore/dom/DOMStringList.idl \
+	WebCore/dom/DOMStringMap.idl \
 	WebCore/dom/DeviceOrientationEvent.idl \
 	WebCore/dom/Document.idl \
 	WebCore/dom/DocumentFragment.idl \
@@ -298,9 +306,12 @@ IDL_BINDINGS += \
 	WebCore/page/History.idl \
 	WebCore/page/Location.idl \
 	WebCore/page/MemoryInfo.idl \
+	WebCore/page/Navigation.idl \
 	WebCore/page/Navigator.idl \
+	WebCore/page/Performance.idl \
 	WebCore/page/PositionError.idl \
 	WebCore/page/Screen.idl \
+	WebCore/page/Timing.idl \
 	WebCore/page/WebKitPoint.idl \
 	WebCore/page/WorkerNavigator.idl \
 	WebCore/plugins/MimeType.idl \
@@ -340,7 +351,7 @@ webcoregtk_sources += $(webcoregtk_dom_sources)
 
 webcore_sources += \
 	WebCore/WebCorePrefix.h \
-        WebCore/accessibility/AXObjectCache.cpp \
+	WebCore/accessibility/AXObjectCache.cpp \
 	WebCore/accessibility/AXObjectCache.h \
 	WebCore/accessibility/AccessibilityARIAGrid.cpp \
 	WebCore/accessibility/AccessibilityARIAGrid.h \
@@ -423,6 +434,8 @@ webcore_sources += \
 	WebCore/bindings/js/JSDOMFormDataCustom.cpp \
 	WebCore/bindings/js/JSDOMGlobalObject.cpp \
 	WebCore/bindings/js/JSDOMGlobalObject.h \
+	WebCore/bindings/js/JSDOMStringMapCustom.cpp \
+	WebCore/bindings/js/JSDOMStringMapCustom.h \
 	WebCore/bindings/js/JSDOMWindowBase.cpp \
 	WebCore/bindings/js/JSDOMWindowBase.h \
 	WebCore/bindings/js/JSDOMWindowCustom.cpp \
@@ -455,7 +468,6 @@ webcore_sources += \
 	WebCore/bindings/js/JSHTMLFormElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLFrameElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLFrameSetElementCustom.cpp \
-	WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLInputElementCustom.cpp \
 	WebCore/bindings/js/JSHTMLInputElementCustom.h \
 	WebCore/bindings/js/JSHTMLObjectElementCustom.cpp \
@@ -731,6 +743,8 @@ webcore_sources += \
 	WebCore/dom/Attribute.cpp \
 	WebCore/dom/Attribute.h \
 	WebCore/dom/BeforeLoadEvent.h \
+	WebCore/dom/BeforeProcessEvent.cpp \
+	WebCore/dom/BeforeProcessEvent.h \
 	WebCore/dom/BeforeTextInsertedEvent.cpp \
 	WebCore/dom/BeforeTextInsertedEvent.h \
 	WebCore/dom/BeforeUnloadEvent.cpp \
@@ -773,12 +787,19 @@ webcore_sources += \
 	WebCore/dom/DOMImplementation.h \
 	WebCore/dom/DOMStringList.cpp \
 	WebCore/dom/DOMStringList.h \
+	WebCore/dom/DOMStringMap.cpp \
+	WebCore/dom/DOMStringMap.h \
+	WebCore/dom/DatasetDOMStringMap.cpp \
+	WebCore/dom/DatasetDOMStringMap.h \
+	WebCore/dom/DecodedDataDocumentParser.cpp \
+	WebCore/dom/DecodedDataDocumentParser.h \
 	WebCore/dom/DeviceOrientation.cpp \
 	WebCore/dom/DeviceOrientation.h \
 	WebCore/dom/DeviceOrientationClient.h \
 	WebCore/dom/DeviceOrientationEvent.cpp \
 	WebCore/dom/DeviceOrientationEvent.h \
 	WebCore/dom/Document.cpp \
+	WebCore/dom/DocumentParser.cpp \
 	WebCore/dom/Document.h \
 	WebCore/dom/DocumentFragment.cpp \
 	WebCore/dom/DocumentFragment.h \
@@ -875,6 +896,8 @@ webcore_sources += \
 	WebCore/dom/RawDataDocumentParser.h \
 	WebCore/dom/RegisteredEventListener.cpp \
 	WebCore/dom/RegisteredEventListener.h \
+	WebCore/dom/ScriptableDocumentParser.cpp \
+	WebCore/dom/ScriptableDocumentParser.h \
 	WebCore/dom/ScriptElement.cpp \
 	WebCore/dom/ScriptElement.h \
 	WebCore/dom/ScriptExecutionContext.cpp \
@@ -1147,12 +1170,16 @@ webcore_sources += \
 	WebCore/html/HTMLDocument.h \
 	WebCore/html/HTMLElement.cpp \
 	WebCore/html/HTMLElement.h \
+	WebCore/html/HTMLElementStack.cpp \
+	WebCore/html/HTMLElementStack.h \
 	WebCore/html/HTMLEmbedElement.cpp \
 	WebCore/html/HTMLEmbedElement.h \
 	WebCore/html/HTMLFieldSetElement.cpp \
 	WebCore/html/HTMLFieldSetElement.h \
 	WebCore/html/HTMLFontElement.cpp \
 	WebCore/html/HTMLFontElement.h \
+	WebCore/html/HTMLFormattingElementList.cpp \
+	WebCore/html/HTMLFormattingElementList.h \
 	WebCore/html/HTMLFormCollection.cpp \
 	WebCore/html/HTMLFormCollection.h \
 	WebCore/html/HTMLFormControlElement.cpp \
@@ -1523,6 +1550,8 @@ webcore_sources += \
 	WebCore/page/MemoryInfo.h \
 	WebCore/page/MouseEventWithHitTestResults.cpp \
 	WebCore/page/MouseEventWithHitTestResults.h \
+	WebCore/page/Navigation.cpp \
+	WebCore/page/Navigation.h \
 	WebCore/page/Navigator.cpp \
 	WebCore/page/Navigator.h \
 	WebCore/page/NavigatorBase.cpp \
@@ -1533,8 +1562,10 @@ webcore_sources += \
 	WebCore/page/Page.h \
 	WebCore/page/PageGroup.cpp \
 	WebCore/page/PageGroup.h \
-  WebCore/page/PageGroupLoadDeferrer.cpp \
-  WebCore/page/PageGroupLoadDeferrer.h \
+	WebCore/page/PageGroupLoadDeferrer.cpp \
+	WebCore/page/PageGroupLoadDeferrer.h \
+	WebCore/page/Performance.cpp \
+	WebCore/page/Performance.h \
 	WebCore/page/PluginHalter.cpp \
 	WebCore/page/PluginHalter.h \
 	WebCore/page/PluginHalterClient.h \
@@ -1555,6 +1586,8 @@ webcore_sources += \
 	WebCore/page/SpatialNavigation.h \
 	WebCore/page/SuspendableTimer.cpp \
 	WebCore/page/SuspendableTimer.h \
+	WebCore/page/Timing.cpp \
+	WebCore/page/Timing.h \
 	WebCore/page/UserContentURLPattern.cpp \
 	WebCore/page/UserContentURLPattern.h \
 	WebCore/page/UserScript.h \
@@ -1806,6 +1839,7 @@ webcore_sources += \
 	WebCore/platform/network/ResourceHandle.h \
 	WebCore/platform/network/ResourceHandleClient.h \
 	WebCore/platform/network/ResourceHandleInternal.h \
+	WebCore/platform/network/ResourceLoadTiming.h \
 	WebCore/platform/network/ResourceRequestBase.cpp \
 	WebCore/platform/network/ResourceRequestBase.h \
 	WebCore/platform/network/ResourceResponseBase.cpp \
@@ -1909,6 +1943,8 @@ webcore_sources += \
 	WebCore/rendering/LayoutState.h \
 	WebCore/rendering/MediaControlElements.h \
 	WebCore/rendering/OverlapTestRequestClient.h \
+	WebCore/rendering/PaintInfo.h \
+	WebCore/rendering/PaintPhase.h \
 	WebCore/rendering/RenderApplet.cpp \
 	WebCore/rendering/RenderApplet.h \
 	WebCore/rendering/RenderArena.cpp \
@@ -2116,49 +2152,30 @@ webcore_sources += \
 	WebCore/xml/XMLSerializer.h
 
 webcoregtk_sources += \
-	WebCore/bindings/js/ScriptControllerGtk.cpp \
-	WebCore/plugins/gtk/PluginDataGtk.cpp \
-	WebCore/plugins/gtk/PluginPackageGtk.cpp \
-	WebCore/plugins/gtk/PluginViewGtk.cpp
-
-if TARGET_X11
-webcoregtk_sources += \
-	WebCore/plugins/gtk/gtk2xtbin.c \
-	WebCore/plugins/gtk/gtk2xtbin.h \
-	WebCore/plugins/gtk/xembed.h
-endif
-
-if TARGET_WIN32
-webcore_sources += \
-	WebCore/plugins/win/PluginDatabaseWin.cpp \
-	WebCore/plugins/win/PluginMessageThrottlerWin.cpp \
-	WebCore/plugins/win/PluginMessageThrottlerWin.h
-endif
-
-webcoregtk_sources += \
-	WebCore/accessibility/gtk/AXObjectCacheAtk.cpp \
 	WebCore/accessibility/gtk/AccessibilityObjectAtk.cpp \
 	WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp \
 	WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.h \
+	WebCore/accessibility/gtk/AXObjectCacheAtk.cpp \
+	WebCore/bindings/js/ScriptControllerGtk.cpp \
 	WebCore/page/gtk/DragControllerGtk.cpp \
 	WebCore/page/gtk/EventHandlerGtk.cpp \
 	WebCore/page/gtk/FrameGtk.cpp \
 	WebCore/platform/graphics/cairo/CairoPath.h \
+	WebCore/platform/graphics/cairo/FontCacheCairo.cpp \
 	WebCore/platform/graphics/cairo/FontCairo.cpp \
+	WebCore/platform/graphics/cairo/FontCustomPlatformData.h \
+	WebCore/platform/graphics/cairo/FontPlatformData.h \
+	WebCore/platform/graphics/cairo/GOwnPtrCairo.cpp \
+	WebCore/platform/graphics/cairo/GOwnPtrCairo.h \
 	WebCore/platform/graphics/cairo/GradientCairo.cpp \
 	WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp \
 	WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h \
-	WebCore/platform/graphics/cairo/GOwnPtrCairo.cpp \
-	WebCore/platform/graphics/cairo/GOwnPtrCairo.h \
 	WebCore/platform/graphics/cairo/ImageBufferCairo.cpp \
 	WebCore/platform/graphics/cairo/ImageBufferData.h \
 	WebCore/platform/graphics/cairo/ImageCairo.cpp \
 	WebCore/platform/graphics/cairo/PathCairo.cpp \
 	WebCore/platform/graphics/cairo/PatternCairo.cpp \
 	WebCore/platform/graphics/cairo/TransformationMatrixCairo.cpp \
-	WebCore/platform/graphics/cairo/FontCacheCairo.cpp \
-	WebCore/platform/graphics/cairo/FontCustomPlatformData.h \
-	WebCore/platform/graphics/cairo/FontPlatformData.h \
 	WebCore/platform/graphics/gtk/ColorGtk.cpp \
 	WebCore/platform/graphics/gtk/FontGtk.cpp \
 	WebCore/platform/graphics/gtk/IconGtk.cpp \
@@ -2184,11 +2201,13 @@ webcoregtk_sources += \
 	WebCore/platform/gtk/GOwnPtrGtk.h \
 	WebCore/platform/gtk/GRefPtrGtk.cpp \
 	WebCore/platform/gtk/GRefPtrGtk.h \
+	WebCore/platform/gtk/gtk2drawing.c \
+	WebCore/platform/gtk/gtkdrawing.h \
 	WebCore/platform/gtk/GtkPluginWidget.cpp \
 	WebCore/platform/gtk/GtkPluginWidget.h \
 	WebCore/platform/gtk/GtkVersioning.h \
-	WebCore/platform/gtk/KURLGtk.cpp \
 	WebCore/platform/gtk/KeyEventGtk.cpp \
+	WebCore/platform/gtk/KURLGtk.cpp \
 	WebCore/platform/gtk/Language.cpp \
 	WebCore/platform/gtk/LocalizedStringsGtk.cpp \
 	WebCore/platform/gtk/LoggingGtk.cpp \
@@ -2201,11 +2220,11 @@ webcoregtk_sources += \
 	WebCore/platform/gtk/PopupMenuGtk.cpp \
 	WebCore/platform/gtk/RenderThemeGtk.cpp \
 	WebCore/platform/gtk/RenderThemeGtk.h \
-	WebCore/platform/gtk/ScrollViewGtk.cpp \
 	WebCore/platform/gtk/ScrollbarGtk.cpp \
 	WebCore/platform/gtk/ScrollbarGtk.h \
 	WebCore/platform/gtk/ScrollbarThemeGtk.cpp \
 	WebCore/platform/gtk/ScrollbarThemeGtk.h \
+	WebCore/platform/gtk/ScrollViewGtk.cpp \
 	WebCore/platform/gtk/SearchPopupMenuGtk.cpp \
 	WebCore/platform/gtk/SharedBufferGtk.cpp \
 	WebCore/platform/gtk/SharedTimerGtk.cpp \
@@ -2213,10 +2232,6 @@ webcoregtk_sources += \
 	WebCore/platform/gtk/TemporaryLinkStubs.cpp \
 	WebCore/platform/gtk/WheelEventGtk.cpp \
 	WebCore/platform/gtk/WidgetGtk.cpp \
-	WebCore/platform/gtk/gtk2drawing.c \
-	WebCore/platform/gtk/gtkdrawing.h \
-	WebCore/platform/image-decoders/ImageDecoder.h \
-	WebCore/platform/image-decoders/ImageDecoder.cpp \
 	WebCore/platform/image-decoders/bmp/BMPImageDecoder.cpp \
 	WebCore/platform/image-decoders/bmp/BMPImageDecoder.h \
 	WebCore/platform/image-decoders/bmp/BMPImageReader.cpp \
@@ -2228,6 +2243,8 @@ webcoregtk_sources += \
 	WebCore/platform/image-decoders/gif/GIFImageReader.h \
 	WebCore/platform/image-decoders/ico/ICOImageDecoder.cpp \
 	WebCore/platform/image-decoders/ico/ICOImageDecoder.h \
+	WebCore/platform/image-decoders/ImageDecoder.cpp \
+	WebCore/platform/image-decoders/ImageDecoder.h \
 	WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp \
 	WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h \
 	WebCore/platform/image-decoders/png/PNGImageDecoder.cpp \
@@ -2235,16 +2252,42 @@ webcoregtk_sources += \
 	WebCore/platform/network/soup/AuthenticationChallenge.h \
 	WebCore/platform/network/soup/CookieJarSoup.cpp \
 	WebCore/platform/network/soup/CookieJarSoup.h \
+	WebCore/platform/network/soup/GOwnPtrSoup.cpp \
+	WebCore/platform/network/soup/GOwnPtrSoup.h \
 	WebCore/platform/network/soup/ResourceError.h \
 	WebCore/platform/network/soup/ResourceHandleSoup.cpp \
-	WebCore/platform/network/soup/ResourceRequestSoup.cpp \
-	WebCore/platform/network/soup/ResourceResponseSoup.cpp \
 	WebCore/platform/network/soup/ResourceRequest.h \
+	WebCore/platform/network/soup/ResourceRequestSoup.cpp \
 	WebCore/platform/network/soup/ResourceResponse.h \
-	WebCore/platform/network/soup/GOwnPtrSoup.h \
-	WebCore/platform/network/soup/GOwnPtrSoup.cpp \
+	WebCore/platform/network/soup/ResourceResponseSoup.cpp \
+	WebCore/plugins/gtk/PluginDataGtk.cpp \
+	WebCore/plugins/gtk/PluginPackageGtk.cpp \
+	WebCore/plugins/gtk/PluginViewGtk.cpp \
 	WebCore/workers/SharedWorkerRepository.h
 
+if TARGET_X11
+webcoregtk_sources += \
+	WebCore/plugins/gtk/gtk2xtbin.c \
+	WebCore/plugins/gtk/gtk2xtbin.h \
+	WebCore/plugins/gtk/xembed.h
+endif
+
+if TARGET_WIN32
+webcore_sources += \
+	WebCore/plugins/win/PluginDatabaseWin.cpp \
+	WebCore/plugins/win/PluginMessageThrottlerWin.cpp \
+	WebCore/plugins/win/PluginMessageThrottlerWin.h
+endif
+
+# ----
+# GTK+ 2.x/3.x support
+# ----
+
+if GTK_API_VERSION_2
+webcore_cppflags += \
+	-DGTK_API_VERSION_2=1
+endif
+
 # ----
 # icu unicode backend
 # ----
@@ -2335,12 +2378,12 @@ webcore_cppflags += \
     -DENABLE_METER_TAG=0
 
 # ----
-# HTML Progress Element - disable for now, since painting code is missing.
+# HTML Progress Element
 # ----
-FEATURE_DEFINES += ENABLE_PROGRESS_TAG=0
+FEATURE_DEFINES += ENABLE_PROGRESS_TAG=1
 
 webcore_cppflags += \
-	-DENABLE_PROGRESS_TAG=0
+	-DENABLE_PROGRESS_TAG=1
 
 # ----
 # JavaScript Debugger/Profiler
@@ -2569,6 +2612,19 @@ webcore_sources += \
 endif # END ENABLE_INDEXED_DATABASE
 
 # ----
+# Support for <input type="file" directory>
+# ----
+if ENABLE_DIRECTORY_UPLOAD
+FEATURE_DEFINES += ENABLE_DIRECTORY_UPLOAD=1
+webcore_cppflags += -DENABLE_DIRECTORY_UPLOAD=1
+
+else
+
+webcore_cppflags += -DENABLE_DIRECTORY_UPLOAD=0
+
+endif # END ENABLE_DIRECTORY_UPLOAD
+
+# ----
 # HTML5 client-side session and persistent storage
 # ----
 if ENABLE_DOM_STORAGE
@@ -2772,8 +2828,8 @@ FEATURE_DEFINES += ENABLE_XPATH=1
 webcore_cppflags += -DENABLE_XPATH=1
 
 webcore_built_sources += \
-	DerivedSources/XPathGrammar.cpp \
-	DerivedSources/XPathGrammar.h
+	DerivedSources/WebCore/XPathGrammar.cpp \
+	DerivedSources/WebCore/XPathGrammar.h
 
 IDL_BINDINGS += \
 	WebCore/xml/XPathEvaluator.idl \
@@ -2818,18 +2874,18 @@ webcore_sources += \
 	WebCore/xml/XPathVariableReference.h
 # XPath grammar
 
-$(GENSOURCES)/XPathGrammar.h: $(GENSOURCES)/XPathGrammar.cpp;
+$(GENSOURCES_WEBCORE)/XPathGrammar.h: $(GENSOURCES_WEBCORE)/XPathGrammar.cpp;
 
 # NOTE: older versions of bison do not inject an inclusion guard, so we do it
-$(GENSOURCES)/XPathGrammar.cpp: $(WebCore)/xml/XPathGrammar.y
-	rm -f $(GENSOURCES)/XPathGrammar.cpp.h $(GENSOURCES)/XPathGrammar.hpp
-	$(BISON) -d -p xpathyy $< -o $(GENSOURCES)/XPathGrammar.cpp
-	touch $(GENSOURCES)/XPathGrammar.cpp.h $(GENSOURCES)/XPathGrammar.hpp
-	echo '#ifndef XPathGrammar_h' > $(GENSOURCES)/XPathGrammar.h
-	echo '#define XPathGrammar_h' >> $(GENSOURCES)/XPathGrammar.h
-	cat $(GENSOURCES)/XPathGrammar.cpp.h $(GENSOURCES)/XPathGrammar.hpp >> $(GENSOURCES)/XPathGrammar.h
-	echo '#endif' >> $(GENSOURCES)/XPathGrammar.h
-	rm -f $(GENSOURCES)/XPathGrammar.cpp.h $(GENSOURCES)/XPathGrammar.hpp
+$(GENSOURCES_WEBCORE)/XPathGrammar.cpp: $(WebCore)/xml/XPathGrammar.y
+	rm -f $(GENSOURCES_WEBCORE)/XPathGrammar.cpp.h $(GENSOURCES_WEBCORE)/XPathGrammar.hpp
+	$(BISON) -d -p xpathyy $< -o $(GENSOURCES_WEBCORE)/XPathGrammar.cpp
+	touch $(GENSOURCES_WEBCORE)/XPathGrammar.cpp.h $(GENSOURCES_WEBCORE)/XPathGrammar.hpp
+	echo '#ifndef XPathGrammar_h' > $(GENSOURCES_WEBCORE)/XPathGrammar.h
+	echo '#define XPathGrammar_h' >> $(GENSOURCES_WEBCORE)/XPathGrammar.h
+	cat $(GENSOURCES_WEBCORE)/XPathGrammar.cpp.h $(GENSOURCES_WEBCORE)/XPathGrammar.hpp >> $(GENSOURCES_WEBCORE)/XPathGrammar.h
+	echo '#endif' >> $(GENSOURCES_WEBCORE)/XPathGrammar.h
+	rm -f $(GENSOURCES_WEBCORE)/XPathGrammar.cpp.h $(GENSOURCES_WEBCORE)/XPathGrammar.hpp
 
 endif # END ENABLE_XPATH
 
@@ -2932,8 +2988,8 @@ if ENABLE_WML
 FEATURE_DEFINES += ENABLE_WML=1
 
 webcore_built_sources += \
-	DerivedSources/WMLElementFactory.cpp \
-	DerivedSources/WMLNames.cpp
+	DerivedSources/WebCore/WMLElementFactory.cpp \
+	DerivedSources/WebCore/WMLNames.cpp
 
 webcore_cppflags += \
 	-DENABLE_WML=1
@@ -2977,10 +3033,10 @@ webcore_sources += \
 	WebCore/wml/WMLVariables.cpp
 
 # WML tag and attribute names
-DerivedSources/WMLNames.cpp: DerivedSources/WMLElementFactory.cpp;
+DerivedSources/WebCore/WMLNames.cpp: DerivedSources/WebCore/WMLElementFactory.cpp;
 
-DerivedSources/WMLElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/wml/WMLTagNames.in $(WebCore)/wml/WMLAttributeNames.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/wml/WMLTagNames.in --attrs $(WebCore)/wml/WMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+DerivedSources/WebCore/WMLElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/wml/WMLTagNames.in $(WebCore)/wml/WMLAttributeNames.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/wml/WMLTagNames.in --attrs $(WebCore)/wml/WMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES_WEBCORE)"
 endif # END ENABLE_WML
 
 # ----
@@ -3071,23 +3127,23 @@ webcore_sources += \
 	WebCore/mathml/RenderMathMLUnderOver.h
 
 webcore_built_sources += \
-	DerivedSources/MathMLElementFactory.cpp \
-	DerivedSources/MathMLElementFactory.h \
-	DerivedSources/MathMLNames.cpp \
-	DerivedSources/MathMLNames.h
+	DerivedSources/WebCore/MathMLElementFactory.cpp \
+	DerivedSources/WebCore/MathMLElementFactory.h \
+	DerivedSources/WebCore/MathMLNames.cpp \
+	DerivedSources/WebCore/MathMLNames.h
 
 # MathML tag and attribute names, and element factory 
-DerivedSources/MathMLElementFactory.h: DerivedSources/MathMLElementFactory.cpp
+DerivedSources/WebCore/MathMLElementFactory.h: DerivedSources/WebCore/MathMLElementFactory.cpp
 
-DerivedSources/MathMLNames.h: DerivedSources/MathMLNames.cpp
+DerivedSources/WebCore/MathMLNames.h: DerivedSources/WebCore/MathMLNames.cpp
 
-DerivedSources/MathMLElementFactory.cpp DerivedSources/MathMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/mathml/mathtags.in $(WebCore)/mathml/mathattrs.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/mathml/mathtags.in --attrs $(WebCore)/mathml/mathattrs.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+DerivedSources/WebCore/MathMLElementFactory.cpp DerivedSources/WebCore/MathMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/mathml/mathtags.in $(WebCore)/mathml/mathattrs.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/mathml/mathtags.in --attrs $(WebCore)/mathml/mathattrs.in --factory --wrapperFactory --outputDir "$(GENSOURCES_WEBCORE)"
 else 
-DerivedSources/MathMLElementFactory.cpp:
+DerivedSources/WebCore/MathMLElementFactory.cpp:
 	echo > $@
 
-DerivedSources/MathMLNames.cpp:
+DerivedSources/WebCore/MathMLNames.cpp:
 	echo > $@
 
 endif # END ENABLE_MATHML
@@ -3123,10 +3179,10 @@ WEBCORE_CSS_PROPERTY_NAMES += $(WebCore)/css/SVGCSSPropertyNames.in
 WEBCORE_CSS_VALUE_KEYWORDS += $(WebCore)/css/SVGCSSValueKeywords.in
 
 webcore_built_sources += \
-	DerivedSources/JSSVGElementWrapperFactory.cpp \
-	DerivedSources/SVGElementFactory.cpp \
-	DerivedSources/SVGNames.cpp \
-	DerivedSources/XLinkNames.cpp
+	DerivedSources/WebCore/JSSVGElementWrapperFactory.cpp \
+	DerivedSources/WebCore/SVGElementFactory.cpp \
+	DerivedSources/WebCore/SVGNames.cpp \
+	DerivedSources/WebCore/XLinkNames.cpp
 
 IDL_BINDINGS += \
 	WebCore/svg/ElementTimeControl.idl \
@@ -3169,6 +3225,7 @@ IDL_BINDINGS += \
 	WebCore/svg/SVGFEColorMatrixElement.idl \
 	WebCore/svg/SVGFEComponentTransferElement.idl \
 	WebCore/svg/SVGFECompositeElement.idl \
+	WebCore/svg/SVGFEConvolveMatrixElement.idl \
 	WebCore/svg/SVGFEDiffuseLightingElement.idl \
 	WebCore/svg/SVGFEDisplacementMapElement.idl \
 	WebCore/svg/SVGFEDistantLightElement.idl \
@@ -3447,6 +3504,8 @@ webcore_sources += \
 	WebCore/svg/SVGFEComponentTransferElement.h \
 	WebCore/svg/SVGFECompositeElement.cpp \
 	WebCore/svg/SVGFECompositeElement.h \
+	WebCore/svg/SVGFEConvolveMatrixElement.cpp \
+	WebCore/svg/SVGFEConvolveMatrixElement.h \
 	WebCore/svg/SVGFEDiffuseLightingElement.cpp \
 	WebCore/svg/SVGFEDiffuseLightingElement.h \
 	WebCore/svg/SVGFEDisplacementMapElement.cpp \
@@ -3732,24 +3791,24 @@ webcore_cppflags += -DENABLE_SVG_ANIMATION=1
 endif
 
 # SVG tag and attribute names (need to pass an extra flag if svg experimental features are enabled)
-DerivedSources/SVGNames.cpp: DerivedSources/SVGElementFactory.cpp;
-DerivedSources/JSSVGElementWrapperFactory.cpp: DerivedSources/SVGElementFactory.cpp
+DerivedSources/WebCore/SVGNames.cpp: DerivedSources/WebCore/SVGElementFactory.cpp;
+DerivedSources/WebCore/JSSVGElementWrapperFactory.cpp: DerivedSources/WebCore/SVGElementFactory.cpp
 
 if SVG_FLAGS
-DerivedSources/SVGElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/svg/svgtags.in $(WebCore)/svg/svgattrs.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --extraDefines "$(SVG_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+DerivedSources/WebCore/SVGElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/svg/svgtags.in $(WebCore)/svg/svgattrs.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --extraDefines "$(SVG_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES_WEBCORE)"
 else
-DerivedSources/SVGElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/svg/svgtags.in $(WebCore)/svg/svgattrs.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+DerivedSources/WebCore/SVGElementFactory.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/svg/svgtags.in $(WebCore)/svg/svgattrs.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/svg/svgtags.in --attrs $(WebCore)/svg/svgattrs.in --factory --wrapperFactory --outputDir "$(GENSOURCES_WEBCORE)"
 
 endif # SVG_FLAGS
 
 # end SVG Features
 
-DerivedSources/XLinkNames.h: DerivedSources/XLinkNames.cpp;
+DerivedSources/WebCore/XLinkNames.h: DerivedSources/WebCore/XLinkNames.cpp;
 
-DerivedSources/XLinkNames.cpp : $(WebCore)/dom/make_names.pl $(WebCore)/svg/xlinkattrs.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/svg/xlinkattrs.in --outputDir "$(GENSOURCES)"
+DerivedSources/WebCore/XLinkNames.cpp : $(WebCore)/dom/make_names.pl $(WebCore)/svg/xlinkattrs.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/svg/xlinkattrs.in --outputDir "$(GENSOURCES_WEBCORE)"
 
 endif # END ENABLE_SVG
 
@@ -3826,49 +3885,49 @@ FEATURE_DEFINES += ENABLE_FILE_WRITER=1
 webcore_cppflags += -DENABLE_FILE_WRITER=1
 endif  # END ENABLE_FILE_WRITER
 
-DerivedSources/CSSPropertyNames.h: $(WEBCORE_CSS_PROPERTY_NAMES) $(WebCore)/css/makeprop.pl
+DerivedSources/WebCore/CSSPropertyNames.h: $(WEBCORE_CSS_PROPERTY_NAMES) $(WebCore)/css/makeprop.pl
 	if sort $(WEBCORE_CSS_PROPERTY_NAMES) | uniq -d | grep -E '^[^#]'; then echo 'Duplicate value!'; exit 1; fi
 	cat $(WEBCORE_CSS_PROPERTY_NAMES) > CSSPropertyNames.in
 	$(PERL) "$(WebCore)/css/makeprop.pl"
-	mv CSSPropertyNames.* $(GENSOURCES)
+	mv CSSPropertyNames.* $(GENSOURCES_WEBCORE)
 
 # Lower case all the values, as CSS values are case-insensitive
-DerivedSources/CSSValueKeywords.h : $(WEBCORE_CSS_VALUE_KEYWORDS) $(WebCore)/css/makevalues.pl
+DerivedSources/WebCore/CSSValueKeywords.h : $(WEBCORE_CSS_VALUE_KEYWORDS) $(WebCore)/css/makevalues.pl
 	$(PERL) -ne 'print lc' $(WEBCORE_CSS_VALUE_KEYWORDS) > CSSValueKeywords.in
 	if sort CSSValueKeywords.in | uniq -d | grep -E '^[^#]'; then echo 'Duplicate value!'; exit 1; fi
 	$(PERL) "$(WebCore)/css/makevalues.pl"
-	mv CSSValueKeywords.* $(GENSOURCES)
+	mv CSSValueKeywords.* $(GENSOURCES_WEBCORE)
 
 # DOCTYPE strings
-DerivedSources/DocTypeStrings.cpp : $(WebCore)/html/DocTypeStrings.gperf $(WebCore)/make-hash-tools.pl
-	$(PERL) $(WebCore)/make-hash-tools.pl $(GENSOURCES) $(WebCore)/html/DocTypeStrings.gperf
+DerivedSources/WebCore/DocTypeStrings.cpp : $(WebCore)/html/DocTypeStrings.gperf $(WebCore)/make-hash-tools.pl
+	$(PERL) $(WebCore)/make-hash-tools.pl $(GENSOURCES_WEBCORE) $(WebCore)/html/DocTypeStrings.gperf
 
 # HTML entity names
-DerivedSources/HTMLEntityNames.cpp : $(WebCore)/html/HTMLEntityNames.gperf $(WebCore)/make-hash-tools.pl
-	$(PERL) $(WebCore)/make-hash-tools.pl $(GENSOURCES) $(WebCore)/html/HTMLEntityNames.gperf
+DerivedSources/WebCore/HTMLEntityNames.cpp : $(WebCore)/html/HTMLEntityNames.gperf $(WebCore)/make-hash-tools.pl
+	$(PERL) $(WebCore)/make-hash-tools.pl $(GENSOURCES_WEBCORE) $(WebCore)/html/HTMLEntityNames.gperf
 
 # color names
-DerivedSources/ColorData.cpp: $(WebCore)/platform/ColorData.gperf $(WebCore)/make-hash-tools.pl
-	$(PERL) $(WebCore)/make-hash-tools.pl $(GENSOURCES) $(WebCore)/platform/ColorData.gperf
+DerivedSources/WebCore/ColorData.cpp: $(WebCore)/platform/ColorData.gperf $(WebCore)/make-hash-tools.pl
+	$(PERL) $(WebCore)/make-hash-tools.pl $(GENSOURCES_WEBCORE) $(WebCore)/platform/ColorData.gperf
 
 # CSS tokenizer
-DerivedSources/tokenizer.cpp : $(WebCore)/css/tokenizer.flex $(WebCore)/css/maketokenizer
+DerivedSources/WebCore/tokenizer.cpp : $(WebCore)/css/tokenizer.flex $(WebCore)/css/maketokenizer
 	$(AM_V_GEN)$(FLEX) -t $< | $(PERL) $(WebCore)/css/maketokenizer > $@
 
 # CSS grammar
 
-DerivedSources/CSSGrammar.h: $(GENSOURCES)/CSSGrammar.cpp;
+DerivedSources/WebCore/CSSGrammar.h: $(GENSOURCES_WEBCORE)/CSSGrammar.cpp;
 
 # NOTE: older versions of bison do not inject an inclusion guard, so we do it
-DerivedSources/CSSGrammar.cpp: $(WebCore)/css/CSSGrammar.y
-	rm -f $(GENSOURCES)/CSSGrammar.cpp.h $(GENSOURCES)/CSSGrammar.hpp
-	$(BISON) -d -p cssyy $< -o $(GENSOURCES)/CSSGrammar.cpp
-	touch $(GENSOURCES)/CSSGrammar.cpp.h $(GENSOURCES)/CSSGrammar.hpp
-	echo '#ifndef CSSGrammar_h' > $(GENSOURCES)/CSSGrammar.h
-	echo '#define CSSGrammar_h' >> $(GENSOURCES)/CSSGrammar.h
-	cat $(GENSOURCES)/CSSGrammar.cpp.h $(GENSOURCES)/CSSGrammar.hpp >> $(GENSOURCES)/CSSGrammar.h
-	echo '#endif' >> $(GENSOURCES)/CSSGrammar.h
-	rm -f $(GENSOURCES)/CSSGrammar.cpp.h $(GENSOURCES)/CSSGrammar.hpp
+DerivedSources/WebCore/CSSGrammar.cpp: $(WebCore)/css/CSSGrammar.y
+	rm -f $(GENSOURCES_WEBCORE)/CSSGrammar.cpp.h $(GENSOURCES_WEBCORE)/CSSGrammar.hpp
+	$(BISON) -d -p cssyy $< -o $(GENSOURCES_WEBCORE)/CSSGrammar.cpp
+	touch $(GENSOURCES_WEBCORE)/CSSGrammar.cpp.h $(GENSOURCES_WEBCORE)/CSSGrammar.hpp
+	echo '#ifndef CSSGrammar_h' > $(GENSOURCES_WEBCORE)/CSSGrammar.h
+	echo '#define CSSGrammar_h' >> $(GENSOURCES_WEBCORE)/CSSGrammar.h
+	cat $(GENSOURCES_WEBCORE)/CSSGrammar.cpp.h $(GENSOURCES_WEBCORE)/CSSGrammar.hpp >> $(GENSOURCES_WEBCORE)/CSSGrammar.h
+	echo '#endif' >> $(GENSOURCES_WEBCORE)/CSSGrammar.h
+	rm -f $(GENSOURCES_WEBCORE)/CSSGrammar.cpp.h $(GENSOURCES_WEBCORE)/CSSGrammar.hpp
 
 # user agent style sheets
 USER_AGENT_STYLE_SHEETS = \
@@ -3889,27 +3948,27 @@ SCRIPTS_BINDINGS = \
 	$(WebCore)/bindings/scripts/InFilesParser.pm \
 	$(WebCore)/bindings/scripts/generate-bindings.pl
 
-DerivedSources/UserAgentStyleSheetsData.cpp: DerivedSources/UserAgentStyleSheets.h;
+DerivedSources/WebCore/UserAgentStyleSheetsData.cpp: DerivedSources/WebCore/UserAgentStyleSheets.h;
 
-DerivedSources/UserAgentStyleSheets.h: $(WebCore)/css/make-css-file-arrays.pl $(USER_AGENT_STYLE_SHEETS)
-	$(AM_V_GEN)$(PERL) $< $@ DerivedSources/UserAgentStyleSheetsData.cpp $(USER_AGENT_STYLE_SHEETS)
+DerivedSources/WebCore/UserAgentStyleSheets.h: $(WebCore)/css/make-css-file-arrays.pl $(USER_AGENT_STYLE_SHEETS)
+	$(AM_V_GEN)$(PERL) $< $@ DerivedSources/WebCore/UserAgentStyleSheetsData.cpp $(USER_AGENT_STYLE_SHEETS)
 
 # HTML tag and attribute names
 if HTML_FLAGS
-DerivedSources/HTMLElementFactory.cpp DerivedSources/HTMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --extraDefines "$(HTML_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+DerivedSources/WebCore/HTMLElementFactory.cpp DerivedSources/WebCore/HTMLElementFactory.h DerivedSources/WebCore/HTMLNames.cpp DerivedSources/WebCore/HTMLNames.h: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --extraDefines "$(HTML_FEATURES)" --factory --wrapperFactory --outputDir "$(GENSOURCES_WEBCORE)"
 else
-DerivedSources/HTMLElementFactory.cpp DerivedSources/HTMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES)"
+DerivedSources/WebCore/HTMLElementFactory.cpp DerivedSources/WebCore/HTMLElementFactory.h DerivedSources/WebCore/HTMLNames.cpp DerivedSources/WebCore/HTMLNames.h: $(WebCore)/dom/make_names.pl $(WebCore)/html/HTMLTagNames.in $(WebCore)/html/HTMLAttributeNames.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --tags $(WebCore)/html/HTMLTagNames.in --attrs $(WebCore)/html/HTMLAttributeNames.in --factory --wrapperFactory --outputDir "$(GENSOURCES_WEBCORE)"
 endif # HTML_FLAGS
 
-DerivedSources/JSHTMLElementWrapperFactory.cpp: DerivedSources/HTMLNames.cpp;
+DerivedSources/WebCore/JSHTMLElementWrapperFactory.cpp: DerivedSources/WebCore/HTMLNames.cpp;
 
-DerivedSources/XMLNSNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/xml/xmlnsattrs.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlnsattrs.in --outputDir "$(GENSOURCES)"
+DerivedSources/WebCore/XMLNSNames.cpp DerivedSources/WebCore/XMLNSNames.h: $(WebCore)/dom/make_names.pl $(WebCore)/xml/xmlnsattrs.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlnsattrs.in --outputDir "$(GENSOURCES_WEBCORE)"
 
-DerivedSources/XMLNames.cpp: $(WebCore)/dom/make_names.pl $(WebCore)/xml/xmlattrs.in
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlattrs.in --outputDir "$(GENSOURCES)"
+DerivedSources/WebCore/XMLNames.cpp DerivedSources/WebCore/XMLNames.h: $(WebCore)/dom/make_names.pl $(WebCore)/xml/xmlattrs.in
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $< --attrs $(WebCore)/xml/xmlattrs.in --outputDir "$(GENSOURCES_WEBCORE)"
 
 IDL_PATH := \
     $(WebCore)/bindings/js \
@@ -3930,11 +3989,11 @@ IDL_PATH := \
 
 vpath %.idl = $(IDL_PATH)
 
-DerivedSources/JS%.h: DerivedSources/JS%.cpp;
+DerivedSources/WebCore/JS%.h: DerivedSources/WebCore/JS%.cpp;
 
 .SECONDARY:
-DerivedSources/JS%.cpp: %.idl $(SCRIPTS_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorJS.pm
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES)" --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --generator JS $<
+DerivedSources/WebCore/JS%.cpp: %.idl $(SCRIPTS_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorJS.pm
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl $(IDL_PATH:%=--include "%") --outputDir "$(GENSOURCES_WEBCORE)" --defines "LANGUAGE_JAVASCRIPT=1 $(FEATURE_DEFINES)" --generator JS $<
 
 IDL_BINDINGS_JS_PURE := \
 	WebCore/svg/ElementTimeControl.idl \
@@ -3954,19 +4013,19 @@ IDL_BINDINGS_JS_PURE := \
 
 IDL_BINDINGS_JS := $(filter-out $(IDL_BINDINGS_JS_PURE),$(IDL_BINDINGS))
 
-webcore_built_nosources += $(patsubst %.idl,DerivedSources/JS%.h,$(notdir $(IDL_BINDINGS)))
+webcore_built_nosources += $(patsubst %.idl,DerivedSources/WebCore/JS%.h,$(notdir $(IDL_BINDINGS)))
 
-webcore_built_nosources += $(patsubst %.idl,DerivedSources/JS%.cpp,$(notdir $(IDL_BINDINGS_JS)))
+webcore_built_nosources += $(patsubst %.idl,DerivedSources/WebCore/JS%.cpp,$(notdir $(IDL_BINDINGS_JS)))
 
 webcore_built_objects = := $(patsubst %.cpp,%.lo,$(webcore_built_nosources))
 
 $(webcore_built_objects): AM_CPPFLAGS+=$(corekit_cppflags)
 
-$(webcore_built_objects): AM_CXXFLAGS+=$(libwebkit_1_0_la_CXXFLAGS)
+$(webcore_built_objects): AM_CXXFLAGS+=$(libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_CXXFLAGS)
 
-libWebCoreJS_objects := $(patsubst %.idl,DerivedSources/JS%.lo,$(notdir $(IDL_BINDINGS_JS)))
+libWebCoreJS_objects := $(patsubst %.idl,DerivedSources/WebCore/JS%.lo,$(notdir $(IDL_BINDINGS_JS)))
 
-libWebCoreJS_depfiles := $(patsubst %.idl,DerivedSources/$(DEPDIR)/JS%.Plo,$(notdir $(IDL_BINDINGS_JS)))
+libWebCoreJS_depfiles := $(patsubst %.idl,DerivedSources/WebCore/$(DEPDIR)/JS%.Plo,$(notdir $(IDL_BINDINGS_JS)))
 
 # Older automake versions (1.7) place Plo files in a different place:
 libWebCoreJS_depfiles += $(patsubst %.lo,$(DEPDIR)/%.Plo,$(libWebCoreJS_objects))
@@ -3975,14 +4034,14 @@ libWebCoreJS_depfiles += $(patsubst %.lo,$(DEPDIR)/%.Plo,$(libWebCoreJS_objects)
 
 $(libWebCoreJS_objects): AM_CPPFLAGS+=$(corekit_cppflags)
 
-$(libWebCoreJS_objects): AM_CXXFLAGS+=$(libwebkit_1_0_la_CXXFLAGS)
+$(libWebCoreJS_objects): AM_CXXFLAGS+=$(libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_CXXFLAGS)
 
 libWebCoreJS.la: $(libWebCoreJS_objects)
 	$(CXXLINK) $(libWebCoreJS_objects) $(LIBS)
 
 
 DerivedSources/webkit/webkitdomdummy.c:
-	echo > $@
+	mkdir -p DerivedSources/webkit || echo > $@
 
 # Because WebCore/bindings/gobject/WebKitDOMObject.h is static source but is also a distributed header
 # required by other distributed headers (both static and auto-generated), need to move this to the
@@ -4015,6 +4074,7 @@ IDL_BINDINGS_GDOM += \
 	WebCore/dom/DocumentType.idl \
 	WebCore/dom/DOMImplementation.idl \
 	WebCore/dom/DOMStringList.idl \
+	WebCore/dom/DOMStringMap.idl \
 	WebCore/dom/Element.idl \
 	WebCore/dom/EntityReference.idl \
 	WebCore/dom/Event.idl \
@@ -4097,7 +4157,6 @@ IDL_BINDINGS_GDOM += \
 	WebCore/page/Console.idl \
 	WebCore/page/DOMWindow.idl \
 	WebCore/page/DOMSelection.idl \
-	WebCore/page/Geolocation.idl \
 	WebCore/page/History.idl \
 	WebCore/page/Location.idl \
 	WebCore/page/MemoryInfo.idl \
@@ -4114,6 +4173,12 @@ IDL_BINDINGS_GDOM += \
 	WebCore/xml/XPathNSResolver.idl \
 	WebCore/xml/XPathResult.idl
 
+if ENABLE_GEOLOCATION
+IDL_BINDINGS_GDOM += \
+	WebCore/page/Geolocation.idl
+endif # END ENABLE_GEOLOCATION
+
+
 # All classes autogenerated in the GObject DOM bindings
 GDOM_AUTO_CLASSES += $(basename $(notdir $(IDL_BINDINGS_GDOM)))
 
@@ -4150,7 +4215,7 @@ DerivedSources/webkit/webkitdomdefines.h: $(WebCore)/bindings/scripts/gobject-ge
 DerivedSources/webkit/WebKitDOM%.h: DerivedSources/webkit/WebKitDOM%.cpp;
 
 DerivedSources/webkit/WebKitDOM%.cpp: %.idl $(SCRIPTS_BINDINGS) $(WebCore)/bindings/scripts/CodeGeneratorGObject.pm $(webcoregtk_dom_sources)
-	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl --include $(WebCore)/dom --include $(WebCore)/html --include $(WebCore)/css --include $(WebCore)/page --include $(WebCore)/xml --include $(WebCore)/svg --outputDir "$(GENSOURCESWEBKITDOM)" --defines "LANGUAGE_GOBJECT=1 $(FEATURE_DEFINES_GDOM)" --generator GObject $<
+	$(AM_V_GEN)$(PERL) -I$(WebCore)/bindings/scripts $(WebCore)/bindings/scripts/generate-bindings.pl --include $(WebCore)/dom --include $(WebCore)/html --include $(WebCore)/css --include $(WebCore)/page --include $(WebCore)/xml --include $(WebCore)/svg --outputDir "$(GENSOURCES_WEBKIT)" --defines "LANGUAGE_GOBJECT=1 $(FEATURE_DEFINES_GDOM)" --generator GObject $<
 
 gdom_built_nosources := $(GDOM_HEADERS_BUILT) $(GDOM_SOURCES_BUILT)
 
@@ -4160,8 +4225,8 @@ libgdom_depfiles += $(patsubst %.h,$(WebCore)/bindings/gobject/$(DEPDIR)/%.Plo,$
 
 -include $(libgdom_depfiles)
 
-$(libgdom_objects): AM_CPPFLAGS+=$(libwebkit_1_0_la_CPPFLAGS)
-$(libgdom_objects): AM_CXXFLAGS+=$(libwebkit_1_0_la_CXXFLAGS)
+$(libgdom_objects): AM_CPPFLAGS+=$(libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_CPPFLAGS)
+$(libgdom_objects): AM_CXXFLAGS+=$(libwebkitgtk_@WEBKITGTK_API_MAJOR_VERSION@_@WEBKITGTK_API_MINOR_VERSION@_la_CXXFLAGS)
 
 libgdom.la: $(libgdom_objects)
 	$(CXXLINK) $(libgdom_objects) $(LIBS)
@@ -4215,29 +4280,31 @@ webcore_dist += \
 	WebCore/html/HTMLAttributeNames.in \
 	WebCore/xml/xmlattrs.in \
 	WebCore/xml/xmlnsattrs.in \
-	WebCore/xml/XPathGrammar.y
+	WebCore/xml/XPathGrammar.y \
+	WebCore/make-hash-tools.pl
 
 # Installing web inspector files
-webinspectordir = ${datadir}/webkit-1.0/webinspector
+webinspectordir = ${datadir}/webkit-@WEBKITGTK_API_VERSION@/webinspector
 dist_webinspector_DATA = \
 	$(WebCore)/English.lproj/localizedStrings.js \
 	$(shell ls $(WebCore)/inspector/front-end/*.js) \
 	$(shell ls $(WebCore)/inspector/front-end/*.html) \
 	$(shell ls $(WebCore)/inspector/front-end/*.css)
 
-webinspectorimagesdir = ${datadir}/webkit-1.0/webinspector/Images
+webinspectorimagesdir = ${datadir}/webkit-@WEBKITGTK_API_VERSION@/webinspector/Images
 dist_webinspectorimages_DATA = \
 	$(shell ls $(WebCore)/inspector/front-end/Images/*.gif) \
 	$(shell ls $(WebCore)/inspector/front-end/Images/*.png)
 
-webresourcesdir = ${datadir}/webkit-1.0/images
+webresourcesdir = ${datadir}/webkit-@WEBKITGTK_API_VERSION@/images
 dist_webresources_DATA = \
 	$(WebCore)/Resources/textAreaResizeCorner.png \
 	$(WebCore)/Resources/nullPlugin.png \
 	$(WebCore)/Resources/urlIcon.png \
 	$(WebCore)/Resources/missingImage.png \
 	$(WebCore)/Resources/panIcon.png \
-	$(WebCore)/Resources/deleteButton.png
+	$(WebCore)/Resources/deleteButton.png \
+	$(WebCore)/Resources/inputSpeech.png
 
 # Clean rules for WebCore
 
diff --git a/WebCore/Resources/inputSpeech.png b/WebCore/Resources/inputSpeech.png
new file mode 100644
index 0000000..8a5c469
--- /dev/null
+++ b/WebCore/Resources/inputSpeech.png
diff --git a/WebCore/Resources/inputSpeech.tiff b/WebCore/Resources/inputSpeech.tiff
new file mode 100644
index 0000000..11ba129
--- /dev/null
+++ b/WebCore/Resources/inputSpeech.tiff
diff --git a/WebCore/WebCore.AcceleratedCompositing.exp b/WebCore/WebCore.AcceleratedCompositing.exp
new file mode 100644
index 0000000..40abc69
--- /dev/null
+++ b/WebCore/WebCore.AcceleratedCompositing.exp
@@ -0,0 +1,2 @@
+__ZN7WebCore13GraphicsLayer17removeAllChildrenEv
+__ZN7WebCore13GraphicsLayer6createEPNS_19GraphicsLayerClientE
diff --git a/WebCore/WebCore.base.exp b/WebCore/WebCore.base.exp
index b0b4d1b..beb5b44 100644
--- a/WebCore/WebCore.base.exp
+++ b/WebCore/WebCore.base.exp
@@ -251,9 +251,8 @@ __ZN7WebCore12PluginWidget14invalidateRectERKNS_7IntRectE
 __ZN7WebCore12PrintContext12pagePropertyEPNS_5FrameEPKci
 __ZN7WebCore12PrintContext13numberOfPagesEPNS_5FrameERKNS_9FloatSizeE
 __ZN7WebCore12PrintContext16isPageBoxVisibleEPNS_5FrameEi
-__ZN7WebCore12PrintContext20pageAreaRectInPixelsEPNS_5FrameEi
 __ZN7WebCore12PrintContext20pageNumberForElementEPNS_7ElementERKNS_9FloatSizeE
-__ZN7WebCore12PrintContext25preferredPageSizeInPixelsEPNS_5FrameEi
+__ZN7WebCore12PrintContext26pageSizeAndMarginsInPixelsEPNS_5FrameEiiiiiii
 __ZN7WebCore12PrintContext28computePageRectsWithPageSizeERKNS_9FloatSizeEb
 __ZN7WebCore12PrintContextC1EPNS_5FrameE
 __ZN7WebCore12PrintContextD1Ev
@@ -507,10 +506,10 @@ __ZN7WebCore4KURLC1ENS_18ParsedURLStringTagERKNS_6StringE
 __ZN7WebCore4KURLC1EP5NSURL
 __ZN7WebCore4KURLC1EPK7__CFURL
 __ZN7WebCore4KURLC1ERKS0_RKNS_6StringE
+__ZN7WebCore4Node10renderRectEPb
 __ZN7WebCore4Node17stopIgnoringLeaksEv
 __ZN7WebCore4Node18startIgnoringLeaksEv
 __ZN7WebCore4Node19setNeedsStyleRecalcENS_15StyleChangeTypeE
-__ZN7WebCore4Node10renderRectEPb
 __ZN7WebCore4Page12setGroupNameERKNS_6StringE
 __ZN7WebCore4Page13didStopPluginEPNS_14HaltablePluginE
 __ZN7WebCore4Page14didStartPluginEPNS_14HaltablePluginE
@@ -629,11 +628,10 @@ __ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore8Document16isPageBoxVisibleEi
 __ZN7WebCore8Document17getFocusableNodesERN3WTF6VectorINS1_6RefPtrINS_4NodeEEELm0EEE
 __ZN7WebCore8Document19accessSVGExtensionsEv
-__ZN7WebCore8Document20pageAreaRectInPixelsEi
 __ZN7WebCore8Document22createDocumentFragmentEv
 __ZN7WebCore8Document23renderedRectsForMarkersENS_14DocumentMarker10MarkerTypeE
 __ZN7WebCore8Document24setShouldCreateRenderersEb
-__ZN7WebCore8Document25preferredPageSizeInPixelsEi
+__ZN7WebCore8Document26pageSizeAndMarginsInPixelsEiRNS_7IntSizeERiS3_S3_S3_
 __ZN7WebCore8Document36updateLayoutIgnorePendingStylesheetsEv
 __ZN7WebCore8Document4headEv
 __ZN7WebCore8FormDataD1Ev
@@ -668,6 +666,7 @@ __ZN7WebCore8Settings23setNeedsTigerMailQuirksEb
 __ZN7WebCore8Settings23setPluginAllowedRunTimeEj
 __ZN7WebCore8Settings23setUsesEncodingDetectorEb
 __ZN7WebCore8Settings24setApplicationChromeModeEb
+__ZN7WebCore8Settings24setDNSPrefetchingEnabledEb
 __ZN7WebCore8Settings24setTextAreasAreResizableEb
 __ZN7WebCore8Settings25setDeveloperExtrasEnabledEb
 __ZN7WebCore8Settings25setFrameFlatteningEnabledEb
@@ -705,6 +704,7 @@ __ZN7WebCore9DOMWindow30dispatchAllPendingUnloadEventsEv
 __ZN7WebCore9DOMWindow36dispatchAllPendingBeforeUnloadEventsEv
 __ZN7WebCore9FloatRectC1ERK7_NSRect
 __ZN7WebCore9FloatRectC1ERKNS_7IntRectE
+__ZN7WebCore9FloatSizeC1ERKNS_7IntSizeE
 __ZN7WebCore9FontCache13fontDataCountEv
 __ZN7WebCore9FontCache21inactiveFontDataCountEv
 __ZN7WebCore9FontCache21purgeInactiveFontDataEi
@@ -968,6 +968,7 @@ __ZNK7WebCore6Widget25convertFromContainingViewERKNS_7IntRectE
 __ZNK7WebCore6Widget25convertFromContainingViewERKNS_8IntPointE
 __ZNK7WebCore6Widget9frameRectEv
 __ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
+__ZNK7WebCore7Element9innerTextEv
 __ZNK7WebCore7IntRectcv6CGRectEv
 __ZNK7WebCore7IntRectcv7_NSRectEv
 __ZNK7WebCore7IntSizecv7_NSSizeEv
diff --git a/WebCore/WebCore.gyp/WebCore.gyp b/WebCore/WebCore.gyp/WebCore.gyp
index 4c193cc..1821ffc 100644
--- a/WebCore/WebCore.gyp/WebCore.gyp
+++ b/WebCore/WebCore.gyp/WebCore.gyp
@@ -202,6 +202,8 @@
       # FIXME: I don't know why these are excluded, either.
       # Someone (me?) should figure it out and add appropriate comments.
       '../css/CSSUnknownRule.idl',
+
+      '../dom/DOMStringMap.idl',
     ],
 
     'conditions': [
@@ -659,6 +661,13 @@
           'dependencies': [
             '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
           ],
+          'conditions': [
+            ['inside_chromium_build==1 and OS=="win" and component=="shared_library"', {
+              'defines': [
+                'USING_V8_SHARED',
+              ],
+            }],
+          ],
         }],
         ['enable_svg!=0', {
           'sources': [
@@ -881,6 +890,13 @@
           'export_dependent_settings': [
             '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
           ],
+          'conditions': [
+            ['inside_chromium_build==1 and OS=="win" and component=="shared_library"', {
+              'defines': [
+                'USING_V8_SHARED',
+              ],
+            }],
+          ],
         }],
         ['enable_svg!=0', {
           'sources/': [
diff --git a/WebCore/WebCore.gypi b/WebCore/WebCore.gypi
index 4887033..2c221d9 100644
--- a/WebCore/WebCore.gypi
+++ b/WebCore/WebCore.gypi
@@ -30,6 +30,7 @@
             'css/WebKitCSSTransformValue.idl',
             'dom/Attr.idl',
             'dom/BeforeLoadEvent.idl',
+            'dom/BeforeProcessEvent.idl',
             'dom/CDATASection.idl',
             'dom/CharacterData.idl',
             'dom/ClientRect.idl',
@@ -41,6 +42,7 @@
             'dom/DOMCoreException.idl',
             'dom/DOMImplementation.idl',
             'dom/DOMStringList.idl',
+            'dom/DOMStringMap.idl',
             'dom/DeviceOrientationEvent.idl',
             'dom/Document.idl',
             'dom/DocumentFragment.idl',
@@ -214,9 +216,12 @@
             'page/History.idl',
             'page/Location.idl',
             'page/MemoryInfo.idl',
+            'page/Navigation.idl',
             'page/Navigator.idl',
+            'page/Performance.idl',
             'page/PositionError.idl',
             'page/Screen.idl',
+            'page/Timing.idl',
             'page/WebKitPoint.idl',
             'page/WorkerNavigator.idl',
             'plugins/MimeType.idl',
@@ -313,6 +318,7 @@
             'svg/SVGFEColorMatrixElement.idl',
             'svg/SVGFEComponentTransferElement.idl',
             'svg/SVGFECompositeElement.idl',
+            'svg/SVGFEConvolveMatrixElement.idl',
             'svg/SVGFEDiffuseLightingElement.idl',
             'svg/SVGFEDisplacementMapElement.idl',
             'svg/SVGFEDistantLightElement.idl',
@@ -485,7 +491,6 @@
             'accessibility/win/AccessibilityObjectWrapperWin.h',
             'accessibility/wx/AccessibilityObjectWx.cpp',
             'bindings/generic/BindingDOMWindow.h',
-            'bindings/generic/BindingElement.h',
             'bindings/generic/BindingSecurity.h',
             'bindings/generic/BindingSecurityBase.cpp',
             'bindings/generic/BindingSecurityBase.h',
@@ -539,6 +544,8 @@
             'bindings/js/JSDOMBinding.h',
             'bindings/js/JSDOMGlobalObject.cpp',
             'bindings/js/JSDOMGlobalObject.h',
+            'bindings/js/JSDOMStringMapCustom.cpp',
+            'bindings/js/JSDOMStringMapCustom.h',
             'bindings/js/JSDOMWindowBase.cpp',
             'bindings/js/JSDOMWindowBase.h',
             'bindings/js/JSDOMWindowCustom.cpp',
@@ -572,7 +579,6 @@
             'bindings/js/JSHTMLFormElementCustom.cpp',
             'bindings/js/JSHTMLFrameElementCustom.cpp',
             'bindings/js/JSHTMLFrameSetElementCustom.cpp',
-            'bindings/js/JSHTMLIFrameElementCustom.cpp',
             'bindings/js/JSHTMLInputElementCustom.cpp',
             'bindings/js/JSHTMLInputElementCustom.h',
             'bindings/js/JSHTMLObjectElementCustom.cpp',
@@ -744,7 +750,6 @@
             'bindings/v8/custom/V8HTMLFormElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFrameElementCustom.cpp',
             'bindings/v8/custom/V8HTMLFrameSetElementCustom.cpp',
-            'bindings/v8/custom/V8HTMLIFrameElementCustom.cpp',
             'bindings/v8/custom/V8HTMLImageElementConstructor.cpp',
             'bindings/v8/custom/V8HTMLImageElementConstructor.h',
             'bindings/v8/custom/V8HTMLInputElementCustom.cpp',
@@ -1060,6 +1065,8 @@
             'dom/BeforeTextInsertedEvent.cpp',
             'dom/BeforeTextInsertedEvent.h',
             'dom/BeforeLoadEvent.h',
+            'dom/BeforeProcessEvent.cpp',
+            'dom/BeforeProcessEvent.h',
             'dom/BeforeUnloadEvent.cpp',
             'dom/BeforeUnloadEvent.h',
             'dom/CDATASection.cpp',
@@ -1100,6 +1107,12 @@
             'dom/DOMImplementation.h',
             'dom/DOMStringList.cpp',
             'dom/DOMStringList.h',
+            'dom/DOMStringMap.cpp',
+            'dom/DOMStringMap.h',
+            'dom/DatasetDOMStringMap.cpp',
+            'dom/DatasetDOMStringMap.h',
+            'dom/DecodedDataDocumentParser.cpp',
+            'dom/DecodedDataDocumentParser.h',
             'dom/DeviceOrientation.cpp',
             'dom/DeviceOrientation.h',
             'dom/DeviceOrientationClient.h',
@@ -1110,6 +1123,8 @@
             'dom/DocumentFragment.cpp',
             'dom/DocumentFragment.h',
             'dom/DocumentMarker.h',
+            'dom/DocumentParser.cpp',
+            'dom/DocumentParser.h',
             'dom/DocumentType.cpp',
             'dom/DocumentType.h',
             'dom/DynamicNodeList.cpp',
@@ -1202,6 +1217,8 @@
             'dom/RawDataDocumentParser.h',
             'dom/RegisteredEventListener.cpp',
             'dom/RegisteredEventListener.h',
+            'dom/ScriptableDocumentParser.cpp',
+            'dom/ScriptableDocumentParser.h',
             'dom/ScriptElement.cpp',
             'dom/ScriptElement.h',
             'dom/ScriptExecutionContext.cpp',
@@ -1212,6 +1229,8 @@
             'dom/SelectorNodeList.h',
             'dom/SpaceSplitString.cpp',
             'dom/SpaceSplitString.h',
+            'dom/StaticHashSetNodeList.cpp',
+            'dom/StaticHashSetNodeList.h',
             'dom/StaticNodeList.cpp',
             'dom/StaticNodeList.h',
             'dom/StaticStringList.cpp',
@@ -1231,7 +1250,6 @@
             'dom/TouchEvent.cpp',
             'dom/TouchList.cpp',
             'dom/TouchList.h',
-            'dom/DocumentParser.h',
             'dom/TransformSourceLibxslt.cpp',
             'dom/TransformSource.h',
             'dom/Traversal.cpp',
@@ -1440,6 +1458,7 @@
             'html/canvas/Uint32Array.h',
             'html/canvas/Uint16Array.cpp',
             'html/canvas/Uint16Array.h',
+            'html/canvas/CheckedInt.h',
             'html/CollectionCache.cpp',
             'html/CollectionCache.h',
             'html/CollectionType.h',
@@ -1530,12 +1549,16 @@
             'html/HTMLDocument.h',
             'html/HTMLElement.cpp',
             'html/HTMLElement.h',
+            'html/HTMLElementStack.cpp',
+            'html/HTMLElementStack.h',
             'html/HTMLEmbedElement.cpp',
             'html/HTMLEmbedElement.h',
             'html/HTMLFieldSetElement.cpp',
             'html/HTMLFieldSetElement.h',
             'html/HTMLFontElement.cpp',
             'html/HTMLFontElement.h',
+            'html/HTMLFormattingElementList.cpp',
+            'html/HTMLFormattingElementList.h',
             'html/HTMLFormCollection.cpp',
             'html/HTMLFormCollection.h',
             'html/HTMLFormControlElement.cpp',
@@ -1962,6 +1985,8 @@
             'page/MemoryInfo.h',
             'page/MouseEventWithHitTestResults.cpp',
             'page/MouseEventWithHitTestResults.h',
+            'page/Navigation.cpp',
+            'page/Navigation.h',
             'page/Navigator.cpp',
             'page/Navigator.h',
             'page/NavigatorBase.cpp',
@@ -1974,6 +1999,8 @@
             'page/PageGroup.h',
             'page/PageGroupLoadDeferrer.cpp',
             'page/PageGroupLoadDeferrer.h',
+            'page/Performance.cpp',
+            'page/Performance.h',
             'page/PluginHalter.cpp',
             'page/PluginHalter.h',
             'page/PluginHalterClient.h',
@@ -1994,6 +2021,8 @@
             'page/SpatialNavigation.cpp',
             'page/SuspendableTimer.cpp',
             'page/SuspendableTimer.h',
+            'page/Timing.cpp',
+            'page/Timing.h',
             'page/UserContentURLPattern.cpp',
             'page/UserContentURLPattern.h',
             'page/UserScript.h',
@@ -2121,6 +2150,7 @@
             'platform/graphics/chromium/FontCustomPlatformData.h',
             'platform/graphics/chromium/FontLinux.cpp',
             'platform/graphics/chromium/FontPlatformData.h',
+            'platform/graphics/chromium/FontPlatformDataChromiumMac.mm',
             'platform/graphics/chromium/FontPlatformDataChromiumWin.cpp',
             'platform/graphics/chromium/FontPlatformDataChromiumWin.h',
             'platform/graphics/chromium/FontPlatformDataLinux.cpp',
@@ -2211,7 +2241,6 @@
             'platform/graphics/mac/FontCustomPlatformData.h',
             'platform/graphics/mac/FontMac.mm',
             'platform/graphics/mac/FontPlatformData.h',
-            'platform/graphics/mac/FontPlatformDataMac.mm',
             'platform/graphics/mac/GlyphPageTreeNodeMac.cpp',
             'platform/graphics/mac/GraphicsContextMac.mm',
             'platform/graphics/mac/GraphicsLayerCA.h',
@@ -2680,6 +2709,7 @@
             'platform/network/ResourceErrorBase.h',
             'platform/network/ResourceHandleClient.h',
             'platform/network/ResourceHandleInternal.h',
+            'platform/network/ResourceLoadTiming.h',
             'platform/network/ResourceRequestBase.cpp',
             'platform/network/ResourceRequestBase.h',
             'platform/network/ResourceResponseBase.cpp',
@@ -3131,6 +3161,8 @@
             'rendering/LayoutState.h',
             'rendering/MediaControlElements.cpp',
             'rendering/MediaControlElements.h',
+            'rendering/PaintInfo.h',
+            'rendering/PaintPhase.h',
             'rendering/PointerEventsHitRules.cpp',
             'rendering/PointerEventsHitRules.h',
             'rendering/RenderApplet.cpp',
@@ -3180,6 +3212,8 @@
             'rendering/RenderIndicator.h',
             'rendering/RenderInline.cpp',
             'rendering/RenderInline.h',
+            'rendering/RenderInputSpeech.cpp',
+            'rendering/RenderInputSpeech.h',
             'rendering/RenderLayer.cpp',
             'rendering/RenderLayer.h',
             'rendering/RenderLayerBacking.cpp',
@@ -3589,6 +3623,8 @@
             'svg/SVGFEComponentTransferElement.h',
             'svg/SVGFECompositeElement.cpp',
             'svg/SVGFECompositeElement.h',
+            'svg/SVGFEConvolveMatrixElement.cpp',
+            'svg/SVGFEConvolveMatrixElement.h',
             'svg/SVGFEDiffuseLightingElement.cpp',
             'svg/SVGFEDiffuseLightingElement.h',
             'svg/SVGFEDisplacementMapElement.cpp',
diff --git a/WebCore/WebCore.pri b/WebCore/WebCore.pri
index 66e77ca..623dbb6 100644
--- a/WebCore/WebCore.pri
+++ b/WebCore/WebCore.pri
@@ -41,6 +41,7 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 !contains(DEFINES, ENABLE_ICONDATABASE=.): DEFINES += ENABLE_ICONDATABASE=1
 !contains(DEFINES, ENABLE_CHANNEL_MESSAGING=.): DEFINES += ENABLE_CHANNEL_MESSAGING=1
 !contains(DEFINES, ENABLE_ORIENTATION_EVENTS=.): DEFINES += ENABLE_ORIENTATION_EVENTS=0
+!contains(DEFINES, ENABLE_DIRECTORY_UPLOAD=.): DEFINES += ENABLE_DIRECTORY_UPLOAD=0
 
 # turn on SQLITE support if any of the dependent features are turned on
 !contains(DEFINES, ENABLE_SQLITE=.) {
@@ -110,6 +111,9 @@ greaterThan(QT_MINOR_VERSION, 5) {
 # Web Socket support.
 !contains(DEFINES, ENABLE_WEB_SOCKETS=.): DEFINES += ENABLE_WEB_SOCKETS=1
 
+# Web Timing support.
+!contains(DEFINES, ENABLE_WEB_TIMING=.): DEFINES += ENABLE_WEB_TIMING=0
+
 # XSLT support with QtXmlPatterns
 !contains(DEFINES, ENABLE_XSLT=.) {
     contains(QT_CONFIG, xmlpatterns):DEFINES += ENABLE_XSLT=1
@@ -176,6 +180,7 @@ contains(DEFINES, ENABLE_SVG=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_SVG=1
 contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_JAVASCRIPT_DEBUGGER=1
 contains(DEFINES, ENABLE_OFFLINE_WEB_APPLICATIONS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_OFFLINE_WEB_APPLICATIONS=1
 contains(DEFINES, ENABLE_WEB_SOCKETS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_SOCKETS=1
+contains(DEFINES, ENABLE_WEB_TIMING=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_WEB_TIMING=1
 contains(DEFINES, ENABLE_TOUCH_EVENTS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_TOUCH_EVENTS=1
 contains(DEFINES, ENABLE_TILED_BACKING_STORE=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_TILED_BACKING_STORE=1
 contains(DEFINES, ENABLE_NOTIFICATIONS=1): FEATURE_DEFINES_JAVASCRIPT += ENABLE_NOTIFICATIONS=1
@@ -267,6 +272,7 @@ IDL_BINDINGS += \
     css/WebKitCSSTransformValue.idl \
     dom/Attr.idl \
     dom/BeforeLoadEvent.idl \
+    dom/BeforeProcessEvent.idl \
     dom/CharacterData.idl \
     dom/ClientRect.idl \
     dom/ClientRectList.idl \
@@ -282,6 +288,7 @@ IDL_BINDINGS += \
     dom/DOMCoreException.idl \
     dom/DOMImplementation.idl \
     dom/DOMStringList.idl \
+    dom/DOMStringMap.idl \
     dom/Element.idl \
     dom/Entity.idl \
     dom/EntityReference.idl \
@@ -449,9 +456,12 @@ IDL_BINDINGS += \
     page/History.idl \
     page/Location.idl \
     page/MemoryInfo.idl \
+    page/Navigation.idl \
     page/Navigator.idl \
+    page/Performance.idl \
     page/PositionError.idl \
     page/Screen.idl \
+    page/Timing.idl \
     page/WebKitPoint.idl \
     page/WorkerNavigator.idl \
     plugins/Plugin.idl \
@@ -523,6 +533,7 @@ IDL_BINDINGS += \
     svg/SVGFEColorMatrixElement.idl \
     svg/SVGFEComponentTransferElement.idl \
     svg/SVGFECompositeElement.idl \
+    svg/SVGFEConvolveMatrixElement.idl \
     svg/SVGFEDiffuseLightingElement.idl \
     svg/SVGFEDisplacementMapElement.idl \
     svg/SVGFEDistantLightElement.idl \
diff --git a/WebCore/WebCore.pro b/WebCore/WebCore.pro
index 68a5527..b33a100 100644
--- a/WebCore/WebCore.pro
+++ b/WebCore/WebCore.pro
@@ -26,7 +26,7 @@ symbian: {
     webkitbackup.path = /private/10202D56/import/packages/$$replace(TARGET.UID3, 0x,)
 
     contains(QT_CONFIG, declarative) {
-         declarativeImport.sources = qmlwebkitplugin$${QT_LIBINFIX}.dll
+         declarativeImport.sources = $$QT_BUILD_TREE/imports/QtWebKit/qmlwebkitplugin$${QT_LIBINFIX}.dll
          declarativeImport.sources += ../WebKit/qt/declarative/qmldir
          declarativeImport.path = c:$$QT_IMPORTS_BASE_DIR/QtWebKit
          DEPLOYMENT += declarativeImport
@@ -35,8 +35,10 @@ symbian: {
     DEPLOYMENT += webkitlibs webkitbackup
 
     # Need to guarantee that these come before system includes of /epoc32/include
-    MMP_RULES += "USERINCLUDE rendering"
+    MMP_RULES += "USERINCLUDE bridge"
+    MMP_RULES += "USERINCLUDE platform/animation"
     MMP_RULES += "USERINCLUDE platform/text"
+    MMP_RULES += "USERINCLUDE rendering"
     symbian-abld|symbian-sbsv2 {
         # RO text (code) section in qtwebkit.dll exceeds allocated space for gcce udeb target.
         # Move RW-section base address to start from 0xE00000 instead of the toolchain default 0x400000.
@@ -299,6 +301,7 @@ SOURCES += \
     bindings/js/JSDocumentCustom.cpp \
     bindings/js/JSDOMFormDataCustom.cpp \
     bindings/js/JSDOMGlobalObject.cpp \
+    bindings/js/JSDOMStringMapCustom.cpp \
     bindings/js/JSDOMWindowBase.cpp \
     bindings/js/JSDOMWindowCustom.cpp \
     bindings/js/JSDOMWindowShell.cpp \
@@ -321,7 +324,6 @@ SOURCES += \
     bindings/js/JSHTMLFormElementCustom.cpp \
     bindings/js/JSHTMLFrameElementCustom.cpp \
     bindings/js/JSHTMLFrameSetElementCustom.cpp \
-    bindings/js/JSHTMLIFrameElementCustom.cpp \
     bindings/js/JSHTMLInputElementCustom.cpp \
     bindings/js/JSHTMLObjectElementCustom.cpp \
     bindings/js/JSHTMLOptionsCollectionCustom.cpp \
@@ -454,6 +456,7 @@ SOURCES += \
     dom/ActiveDOMObject.cpp \
     dom/Attr.cpp \
     dom/Attribute.cpp \
+    dom/BeforeProcessEvent.cpp \
     dom/BeforeTextInsertedEvent.cpp \
     dom/BeforeUnloadEvent.cpp \
     dom/CDATASection.cpp \
@@ -471,13 +474,17 @@ SOURCES += \
     dom/ContainerNode.cpp \
     dom/CSSMappedAttributeDeclaration.cpp \
     dom/CustomEvent.cpp \
+    dom/DecodedDataDocumentParser.cpp \
     dom/DeviceOrientation.cpp \
     dom/DeviceOrientationEvent.cpp \
     dom/Document.cpp \
     dom/DocumentFragment.cpp \
+    dom/DocumentParser.cpp \
     dom/DocumentType.cpp \
     dom/DOMImplementation.cpp \
     dom/DOMStringList.cpp \
+    dom/DOMStringMap.cpp \
+    dom/DatasetDOMStringMap.cpp \
     dom/DynamicNodeList.cpp \
     dom/EditingText.cpp \
     dom/Element.cpp \
@@ -519,6 +526,7 @@ SOURCES += \
     dom/Range.cpp \
     dom/RawDataDocumentParser.h \
     dom/RegisteredEventListener.cpp \
+    dom/ScriptableDocumentParser.cpp \
     dom/ScriptElement.cpp \
     dom/ScriptExecutionContext.cpp \
     dom/SelectElement.cpp \
@@ -648,9 +656,11 @@ SOURCES += \
     html/HTMLDListElement.cpp \
     html/HTMLDocument.cpp \
     html/HTMLElement.cpp \
+    html/HTMLElementStack.cpp \
     html/HTMLEmbedElement.cpp \
     html/HTMLFieldSetElement.cpp \
     html/HTMLFontElement.cpp \
+    html/HTMLFormattingElementList.cpp \
     html/HTMLFormCollection.cpp \
     html/HTMLFormElement.cpp \
     html/HTMLFrameElementBase.cpp \
@@ -795,6 +805,7 @@ SOURCES += \
     page/DOMSelection.cpp \
     page/DOMTimer.cpp \
     page/DOMWindow.cpp \
+    page/Navigation.cpp \
     page/Navigator.cpp \
     page/NavigatorBase.cpp \
     page/DragController.cpp \
@@ -815,6 +826,7 @@ SOURCES += \
     page/Page.cpp \
     page/PageGroup.cpp \
     page/PageGroupLoadDeferrer.cpp \
+    page/Performance.cpp \
     page/PluginHalter.cpp \
     page/PrintContext.cpp \
     page/SecurityOrigin.cpp \
@@ -822,6 +834,7 @@ SOURCES += \
     page/Settings.cpp \
     page/SpatialNavigation.cpp \
     page/SuspendableTimer.cpp \
+    page/Timing.cpp \
     page/UserContentURLPattern.cpp \
     page/WindowFeatures.cpp \
     page/XSSAuditor.cpp \
@@ -1071,7 +1084,7 @@ HEADERS += \
     bindings/js/JSDebugWrapperSet.h \
     bindings/js/JSDOMBinding.h \
     bindings/js/JSDOMGlobalObject.h \
-    bindings/js/JSDOMWindowBase.h \
+    bindings/js/JSDOMStringMapCustom.h \
     bindings/js/JSDOMWindowBase.h \
     bindings/js/JSDOMWindowCustom.h \
     bindings/js/JSDOMWindowShell.h \
@@ -1223,6 +1236,8 @@ HEADERS += \
     dom/DocumentType.h \
     dom/DOMImplementation.h \
     dom/DOMStringList.h \
+    dom/DOMStringMap.h \
+    dom/DatasetDOMStringMap.h \
     dom/DynamicNodeList.h \
     dom/EditingText.h \
     dom/Element.h \
@@ -1666,6 +1681,7 @@ HEADERS += \
     platform/network/qt/QNetworkReplyHandler.h \
     platform/network/ResourceErrorBase.h \
     platform/network/ResourceHandle.h \
+    platform/network/ResourceLoadTiming.h \
     platform/network/ResourceRequestBase.h \
     platform/network/ResourceResponseBase.h \
     platform/PlatformTouchEvent.h \
@@ -1730,6 +1746,8 @@ HEADERS += \
     rendering/InlineTextBox.h \
     rendering/LayoutState.h \
     rendering/MediaControlElements.h \
+    rendering/PaintInfo.h \
+    rendering/PaintPhase.h \
     rendering/PointerEventsHitRules.h \
     rendering/RenderApplet.h \
     rendering/RenderArena.h \
@@ -1754,6 +1772,7 @@ HEADERS += \
     rendering/RenderImage.h \
     rendering/RenderIndicator.h \
     rendering/RenderInline.h \
+    rendering/RenderInputSpeech.h \
     rendering/RenderLayer.h \
     rendering/RenderLineBoxList.h \
     rendering/RenderListBox.h \
@@ -1916,6 +1935,7 @@ HEADERS += \
     svg/SVGFEColorMatrixElement.h \
     svg/SVGFEComponentTransferElement.h \
     svg/SVGFECompositeElement.h \
+    svg/SVGFEConvolveMatrixElement.h \
     svg/SVGFEDiffuseLightingElement.h \
     svg/SVGFEDisplacementMapElement.h \
     svg/SVGFEDistantLightElement.h \
@@ -2497,6 +2517,11 @@ contains(DEFINES, ENABLE_SHARED_WORKERS=1) {
         workers/SharedWorkerThread.cpp
 }
 
+contains(DEFINES, ENABLE_INPUT_SPEECH=1) {
+    SOURCES += \
+        rendering/RenderInputSpeech.cpp
+}
+
 contains(DEFINES, ENABLE_VIDEO=1) {
     SOURCES += \
         html/HTMLAudioElement.cpp \
@@ -2714,6 +2739,7 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/SVGFEColorMatrixElement.cpp \
         svg/SVGFEComponentTransferElement.cpp \
         svg/SVGFECompositeElement.cpp \
+        svg/SVGFEConvolveMatrixElement.cpp \
         svg/SVGFEDiffuseLightingElement.cpp \
         svg/SVGFEDisplacementMapElement.cpp \
         svg/SVGFEDistantLightElement.cpp \
@@ -3043,7 +3069,7 @@ HEADERS += $$WEBKIT_API_HEADERS
 
     win32-*|wince* {
         DLLDESTDIR = $$OUTPUT_DIR/bin
-        TARGET = $$qtLibraryTarget($$TARGET)
+        build_pass: TARGET = $$qtLibraryTarget($$TARGET)
 
         dlltarget.commands = $(COPY_FILE) $(DESTDIR_TARGET) $$[QT_INSTALL_BINS]
         dlltarget.CONFIG = no_path
diff --git a/WebCore/WebCore.qrc b/WebCore/WebCore.qrc
index 6da93c6..1208e9e 100644
--- a/WebCore/WebCore.qrc
+++ b/WebCore/WebCore.qrc
@@ -13,5 +13,6 @@
     <file alias="progressCursor.png">Resources/progressCursor.png</file>
     <file alias="aliasCursor.png">Resources/aliasCursor.png</file>
     <file alias="deleteButton.png">Resources/deleteButton.png</file>
+    <file alias="inputSpeech.png">Resources/inputSpeech.png</file>
 </qresource>
 </RCC>
diff --git a/WebCore/WebCore.vcproj/WebCore.vcproj b/WebCore/WebCore.vcproj/WebCore.vcproj
index ebd21a9..2888801 100644
--- a/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="Windows-1252"?>

+<?xml version="1.0" encoding="windows-1251"?>

 <VisualStudioProject

 	ProjectType="Visual C++"

 	Version="8.00"

@@ -483,6 +483,54 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\HTMLElementFactory.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\HTMLElementFactory.h"

@@ -721,6 +769,62 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBeforeProcessEvent.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBeforeProcessEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBlob.cpp"

 				>

 				<FileConfiguration

@@ -779,6 +883,54 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBlobBuilder.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSBlobBuilder.h"

@@ -3361,6 +3513,62 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMStringMap.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMStringMap.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMWindow.cpp"

 				>

 				<FileConfiguration

@@ -3871,6 +4079,54 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFileError.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFileError.h"

@@ -3935,6 +4191,54 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFileReader.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFileReader.h"

@@ -8199,6 +8503,54 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInjectedScriptHost.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInjectedScriptHost.h"

@@ -8207,6 +8559,54 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorBackend.h"

@@ -8215,6 +8615,54 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorFrontendHost.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSInspectorFrontendHost.h"

@@ -9005,6 +9453,62 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNavigation.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNavigation.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSNavigator.cpp"

 				>

 				<FileConfiguration

@@ -9565,6 +10069,62 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPerformance.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPerformance.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSPlugin.cpp"

 				>

 				<FileConfiguration

@@ -12877,6 +13437,62 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEConvolveMatrixElement.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEConvolveMatrixElement.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSSVGFEDiffuseLightingElement.cpp"

 				>

 				<FileConfiguration

@@ -18533,6 +19149,62 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSTiming.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSTiming.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSTreeWalker.cpp"

 				>

 				<FileConfiguration

@@ -20075,6 +20747,54 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\WMLElementFactory.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\WMLElementFactory.h"

@@ -20083,6 +20803,54 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\WMLNames.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\WMLNames.h"

@@ -21581,6 +22349,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\Navigation.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\page\Navigation.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\Navigator.cpp"

 				>

 			</File>

@@ -21617,6 +22393,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\Performance.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\page\Performance.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\PageGroupLoadDeferrer.cpp"

 				>

 			</File>

@@ -21705,6 +22489,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\page\Timing.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\page\Timing.h"

+				>

+			</File>

+			<File

 				RelativePath="..\page\UserContentURLPattern.cpp"

 				>

 			</File>

@@ -24643,6 +25435,42 @@
 						</FileConfiguration>

 					</File>

 					<File

+						RelativePath="..\platform\graphics\cairo\DrawErrorUnderline.h"

+						>

+						<FileConfiguration

+							Name="Debug|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_Internal|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

+					<File

 						RelativePath="..\platform\graphics\cairo\FontCairo.cpp"

 						>

 						<FileConfiguration

@@ -25284,6 +26112,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\network\ResourceLoadTiming.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\network\ResourceRequestBase.cpp"

 					>

 				</File>

@@ -28045,6 +28877,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\rendering\PaintInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\PaintPhase.h"

+				>

+			</File>

+			<File

 				RelativePath="..\rendering\PointerEventsHitRules.cpp"

 				>

 			</File>

@@ -28493,8 +29333,60 @@
 				>

 			</File>

 			<File

+				RelativePath="..\rendering\RenderSVGAllInOne.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\rendering\RenderSVGBlock.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGBlock.h"

@@ -28503,6 +29395,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGContainer.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGContainer.h"

@@ -28511,6 +29451,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGGradientStop.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGGradientStop.h"

@@ -28519,6 +29507,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGHiddenContainer.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGHiddenContainer.h"

@@ -28527,6 +29563,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGImage.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGImage.h"

@@ -28535,6 +29619,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGInline.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGInline.h"

@@ -28543,6 +29675,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGInlineText.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGInlineText.h"

@@ -28551,6 +29731,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGModelObject.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGModelObject.h"

@@ -28559,6 +29787,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGResource.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGResource.h"

@@ -28567,6 +29843,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGResourceClipper.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGResourceClipper.h"

@@ -28575,6 +29899,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGResourceFilter.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGResourceFilter.h"

@@ -28583,6 +29955,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGResourceGradient.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGResourceGradient.h"

@@ -28591,6 +30011,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGResourceLinearGradient.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGResourceLinearGradient.h"

@@ -28599,6 +30067,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGResourceMarker.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGResourceMarker.h"

@@ -28607,6 +30123,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGResourceMasker.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGResourceMasker.h"

@@ -28615,6 +30179,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGResourcePattern.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGResourcePattern.h"

@@ -28623,6 +30235,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGResourceRadialGradient.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGResourceRadialGradient.h"

@@ -28631,6 +30291,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGResourceSolidColor.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGResourceSolidColor.h"

@@ -28639,6 +30347,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGRoot.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGRoot.h"

@@ -28647,6 +30403,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGShadowTreeRootContainer.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGShadowTreeRootContainer.h"

@@ -28655,6 +30459,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGText.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGText.h"

@@ -28663,6 +30515,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGTextPath.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGTextPath.h"

@@ -28671,6 +30571,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGTransformableContainer.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGTransformableContainer.h"

@@ -28679,6 +30627,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGTSpan.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderSVGTSpan.h"

@@ -28687,6 +30683,54 @@
 			<File

 				RelativePath="..\rendering\RenderSVGViewportContainer.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTable.cpp"

@@ -28933,6 +30977,54 @@
 			<File

 				RelativePath="..\rendering\SVGCharacterData.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGCharacterData.h"

@@ -28941,6 +31033,54 @@
 			<File

 				RelativePath="..\rendering\SVGCharacterLayoutInfo.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGCharacterLayoutInfo.h"

@@ -28949,6 +31089,54 @@
 			<File

 				RelativePath="..\rendering\SVGInlineFlowBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGInlineFlowBox.h"

@@ -28957,6 +31145,54 @@
 			<File

 				RelativePath="..\rendering\SVGInlineTextBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGInlineTextBox.h"

@@ -28969,6 +31205,54 @@
 			<File

 				RelativePath="..\rendering\SVGMarkerLayoutInfo.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGMarkerLayoutInfo.h"

@@ -28977,6 +31261,54 @@
 			<File

 				RelativePath="..\rendering\SVGRenderSupport.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGRenderSupport.h"

@@ -28985,6 +31317,54 @@
 			<File

 				RelativePath="..\rendering\SVGRenderTreeAsText.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGRenderTreeAsText.h"

@@ -28993,6 +31373,54 @@
 			<File

 				RelativePath="..\rendering\SVGRootInlineBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGRootInlineBox.h"

@@ -29001,6 +31429,54 @@
 			<File

 				RelativePath="..\rendering\SVGShadowTreeElements.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGShadowTreeElements.h"

@@ -29009,6 +31485,54 @@
 			<File

 				RelativePath="..\rendering\SVGTextChunkLayoutInfo.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGTextChunkLayoutInfo.h"

@@ -29017,14 +31541,110 @@
 			<File

 				RelativePath="..\rendering\SVGTextLayoutUtilities.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGTextLayoutUtilities.h"

 				>

 			</File>

-		 	<File

+			<File

 				RelativePath="..\rendering\SVGTextQuery.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\SVGTextQuery.h"

@@ -29609,6 +32229,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\BeforeProcessEvent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\BeforeProcessEvent.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\BeforeTextInsertedEvent.cpp"

 				>

 			</File>

@@ -29753,6 +32381,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\DecodedDataDocumentParser.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\DecodedDataDocumentParser.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\DeviceOrientation.cpp"

 				>

 			</File>

@@ -29773,6 +32409,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\DatasetDOMStringMap.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\DatasetDOMStringMap.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\Document.cpp"

 				>

 			</File>

@@ -29793,6 +32437,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\DocumentParser.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\DocumentParser.h"

 				>

 			</File>

@@ -29825,6 +32473,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\DOMStringMap.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\DOMStringMap.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\DynamicNodeList.cpp"

 				>

 			</File>

@@ -30165,6 +32821,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\dom\ScriptableDocumentParser.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\dom\ScriptableDocumentParser.h"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\ScriptElement.cpp"

 				>

 			</File>

@@ -33284,14 +35948,14 @@
 				RelativePath="..\html\CollectionType.h"

 				>

 			</File>

- 			<File

- 				RelativePath="..\html\CSSPreloadScanner.cpp"

- 				>

- 			</File>

- 			<File

- 				RelativePath="..\html\CSSPreloadScanner.h"

- 				>

- 			</File>

+			<File

+				RelativePath="..\html\CSSPreloadScanner.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\CSSPreloadScanner.h"

+				>

+			</File>

 			<File

 				RelativePath="..\html\DataGridColumn.cpp"

 				>

@@ -33404,54 +36068,6 @@
 				RelativePath="..\html\FormDataList.h"

 				>

 			</File>

-            <File

-				RelativePath="..\html\HTMLDocumentParser.cpp"

-				>

-            </File>

-            <File

-				RelativePath="..\html\HTMLDocumentParser.h"

-				>

-            </File>

-            <File

-				RelativePath="..\html\HTMLEntityParser.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\html\HTMLEntityParser.h"

-				>

-			</File>

-			<File

-				RelativePath="..\html\HTMLTokenizer.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\html\HTMLTokenizer.h"

-				>

-			</File>

-			<File

-				RelativePath="..\html\HTMLPreloadScanner.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\html\HTMLPreloadScanner.h"

-				>

-			</File>

-			<File

-				RelativePath="..\html\HTMLScriptRunner.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\html\HTMLScriptRunner.h"

-				>

-			</File>

-			<File

-				RelativePath="..\html\HTMLTreeBuilder.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\html\HTMLTreeBuilder.h"

-				>

-			</File>

 			<File

 				RelativePath="..\html\HTMLAllCollection.cpp"

 				>

@@ -34311,6 +36927,54 @@
 			<File

 				RelativePath="..\html\HTMLDataListElement.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\html\HTMLDataListElement.h"

@@ -34493,6 +37157,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\HTMLDocumentParser.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLDocumentParser.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\HTMLElement.cpp"

 				>

 				<FileConfiguration

@@ -34549,6 +37221,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\HTMLElementStack.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLElementStack.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\HTMLElementsAllInOne.cpp"

 				>

 			</File>

@@ -34609,6 +37289,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\HTMLEntityParser.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLEntityParser.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\HTMLFieldSetElement.cpp"

 				>

 				<FileConfiguration

@@ -34721,6 +37409,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\HTMLFormattingElementList.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLFormattingElementList.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\HTMLFormCollection.cpp"

 				>

 			</File>

@@ -35464,10 +38160,10 @@
 				RelativePath="..\html\HTMLInputElement.h"

 				>

 			</File>

-            <File

+			<File

 				RelativePath="..\html\HTMLInputStream.h"

 				>

-            </File>

+			</File>

 			<File

 				RelativePath="..\html\HTMLIsIndexElement.cpp"

 				>

@@ -36208,6 +38904,54 @@
 				RelativePath="..\html\HTMLNoScriptElement.cpp"

 				>

 				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

 					Name="Release_PGO|Win32"

 					>

 					<Tool

@@ -36565,19 +39309,11 @@
 				>

 			</File>

 			<File

-				RelativePath="..\html\LegacyHTMLTreeBuilder.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\html\LegacyHTMLTreeBuilder.h"

-				>

-			</File>

-			<File

 				RelativePath="..\html\HTMLParserErrorCodes.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\html\HTMLParserScheduler.h"

+				RelativePath="..\html\HTMLParserErrorCodes.h"

 				>

 			</File>

 			<File

@@ -36585,7 +39321,7 @@
 				>

 			</File>

 			<File

-				RelativePath="..\html\HTMLParserErrorCodes.h"

+				RelativePath="..\html\HTMLParserScheduler.h"

 				>

 			</File>

 			<File

@@ -36757,6 +39493,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\HTMLPreloadScanner.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLPreloadScanner.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\HTMLProgressElement.cpp"

 				>

 				<FileConfiguration

@@ -36925,6 +39669,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\HTMLScriptRunner.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLScriptRunner.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\HTMLSelectElement.cpp"

 				>

 				<FileConfiguration

@@ -37605,11 +40357,19 @@
 				>

 			</File>

 			<File

-				RelativePath="..\html\LegacyHTMLDocumentParser.cpp"

+				RelativePath="..\html\HTMLTokenizer.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\html\LegacyHTMLDocumentParser.h"

+				RelativePath="..\html\HTMLTokenizer.h"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLTreeBuilder.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\HTMLTreeBuilder.h"

 				>

 			</File>

 			<File

@@ -37757,7 +40517,19 @@
 				>

 			</File>

 			<File

-				RelativePath="..\html\MediaError.h"

+				RelativePath="..\html\LegacyHTMLDocumentParser.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\LegacyHTMLDocumentParser.h"

+				>

+			</File>

+			<File

+				RelativePath="..\html\LegacyHTMLTreeBuilder.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\LegacyHTMLTreeBuilder.h"

 				>

 			</File>

 			<File

@@ -37769,6 +40541,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\MediaError.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\StepRange.cpp"

 				>

 			</File>

@@ -37814,6 +40590,54 @@
 				<File

 					RelativePath="..\bindings\js\DOMObjectHashTableMap.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\DOMObjectHashTableMap.h"

@@ -37826,6 +40650,54 @@
 				<File

 					RelativePath="..\bindings\js\DOMWrapperWorld.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\DOMWrapperWorld.h"

@@ -38578,10 +41450,106 @@
 				<File

 					RelativePath="..\bindings\js\JSCustomPositionCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomPositionErrorCallback.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSCustomSQLStatementErrorCallback.cpp"

@@ -38958,6 +41926,54 @@
 				<File

 					RelativePath="..\bindings\js\JSDebugWrapperSet.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDebugWrapperSet.h"

@@ -39230,6 +42246,54 @@
 				<File

 					RelativePath="..\bindings\js\JSDOMFormDataCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSDOMGlobalObject.cpp"

@@ -39288,7 +42352,7 @@
 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSDOMWindowBase.cpp"

+					RelativePath="..\bindings\js\JSDOMStringMapCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39340,11 +42404,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSDOMWindowBase.h"

+					RelativePath="..\bindings\js\JSDOMStringMapCustom.h"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSDOMWindowCustom.cpp"

+					RelativePath="..\bindings\js\JSDOMWindowBase.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39396,11 +42460,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSDOMWindowCustom.h"

+					RelativePath="..\bindings\js\JSDOMWindowBase.h"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSDOMWindowShell.cpp"

+					RelativePath="..\bindings\js\JSDOMWindowCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39452,19 +42516,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSDOMWindowShell.h"

-					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSDOMWrapper.cpp"

-					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSDOMWrapper.h"

+					RelativePath="..\bindings\js\JSDOMWindowCustom.h"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSElementCustom.cpp"

+					RelativePath="..\bindings\js\JSDOMWindowShell.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39516,7 +42572,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSEventCustom.cpp"

+					RelativePath="..\bindings\js\JSDOMWindowShell.h"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSDOMWrapper.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39568,7 +42628,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSEventListener.cpp"

+					RelativePath="..\bindings\js\JSDOMWrapper.h"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39620,11 +42684,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSEventListener.h"

-					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSEventSourceCustom.cpp"

+					RelativePath="..\bindings\js\JSEventCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39676,7 +42736,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSEventTarget.cpp"

+					RelativePath="..\bindings\js\JSEventListener.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39728,11 +42788,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSEventTarget.h"

+					RelativePath="..\bindings\js\JSEventListener.h"

 					>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSExceptionBase.cpp"

+					RelativePath="..\bindings\js\JSEventSourceCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39784,15 +42844,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSExceptionBase.h"

-					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSGeolocationCustom.cpp"

-					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSHistoryCustom.cpp"

+					RelativePath="..\bindings\js\JSEventTarget.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39844,7 +42896,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLAllCollectionCustom.cpp"

+					RelativePath="..\bindings\js\JSEventTarget.h"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSExceptionBase.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39896,7 +42952,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLAppletElementCustom.cpp"

+					RelativePath="..\bindings\js\JSExceptionBase.h"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSGeolocationCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -39948,7 +43008,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLCanvasElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHistoryCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40000,7 +43060,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLCollectionCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLAllCollectionCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40052,7 +43112,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLDataGridElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLAppletElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40104,7 +43164,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLDocumentCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLCanvasElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40156,7 +43216,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLCollectionCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40208,7 +43268,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLEmbedElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLDataGridElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40260,7 +43320,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLFormElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLDocumentCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40312,7 +43372,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLFrameElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40364,7 +43424,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLFrameSetElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLEmbedElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40416,7 +43476,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLIFrameElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLFormElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40468,7 +43528,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLInputElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLFrameElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40520,11 +43580,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLInputElementCustom.h"

-					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSHTMLObjectElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLFrameSetElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40576,7 +43632,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLOptionsCollectionCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLInputElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40628,7 +43684,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLSelectElementCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLInputElementCustom.h"

+					>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSHTMLObjectElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40680,11 +43740,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSHTMLSelectElementCustom.h"

-					>

-				</File>

-				<File

-					RelativePath="..\bindings\js\JSWebKitCSSMatrixCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLOptionsCollectionCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40736,7 +43792,7 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\bindings\js\JSWebKitPointCustom.cpp"

+					RelativePath="..\bindings\js\JSHTMLSelectElementCustom.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -40788,6 +43844,10 @@
 					</FileConfiguration>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSHTMLSelectElementCustom.h"

+					>

+				</File>

+				<File

 					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBAny.cpp"

 					>

 					<FileConfiguration

@@ -41176,7 +44236,11 @@
 					>

 				</File>

 				<File

-					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBKeyRange.cpp"

+					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBEvent.h"

+					>

+				</File>

+				<File

+					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBIndexRequest.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -41228,11 +44292,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBKeyRange.h"

+					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBIndexRequest.h"

 					>

-				</File>        

+				</File>

 				<File

-					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBObjectStoreRequest.cpp"

+					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBKeyRange.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -41284,11 +44348,11 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBEvent.h"

+					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBKeyRange.h"

 					>

 				</File>

 				<File

-					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBIndexRequest.cpp"

+					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBObjectStoreRequest.cpp"

 					>

 					<FileConfiguration

 						Name="Debug|Win32"

@@ -41340,10 +44404,6 @@
 					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBIndexRequest.h"

-					>

-				</File>

-				<File

 					RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSIDBObjectStoreRequest.cpp"

 					>

 					<FileConfiguration

@@ -42798,6 +45858,54 @@
 				<File

 					RelativePath="..\bindings\js\JSPopStateEventCustom.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\JSScriptProfileNodeCustom.cpp"

@@ -43592,6 +46700,110 @@
 					</FileConfiguration>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSWebKitCSSMatrixCustom.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\bindings\js\JSWebKitPointCustom.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSWebSocketCustom.cpp"

 					>

 					<FileConfiguration

@@ -44466,6 +47678,54 @@
 				<File

 					RelativePath="..\bindings\js\ScriptGCEvent.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\bindings\js\ScriptGCEvent.h"

@@ -44969,6 +48229,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\svg\SVGFEConvolveMatrixElement.h"

+				>

+			</File>

+			<File

 				RelativePath="..\svg\SVGFEDiffuseLightingElement.h"

 				>

 			</File>

@@ -46407,7 +49671,7 @@
 			<File

 				RelativePath="..\storage\IDBKeyRange.h"

 				>

-			</File>      

+			</File>

 			<File

 				RelativePath="..\storage\IDBObjectStore.h"

 				>

diff --git a/WebCore/WebCore.xcodeproj/project.pbxproj b/WebCore/WebCore.xcodeproj/project.pbxproj
index 4aa4577..0215ac0 100644
--- a/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -128,6 +128,8 @@
 		08820BDF0EF5D381009099A8 /* WMLTableElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08820BDD0EF5D381009099A8 /* WMLTableElement.h */; };
 		088451150F267B63007F139E /* WMLInputElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 088451130F267B62007F139E /* WMLInputElement.cpp */; };
 		088451160F267B63007F139E /* WMLInputElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 088451140F267B63007F139E /* WMLInputElement.h */; };
+		0885067F11DA045B00182B98 /* PaintInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0885067D11DA045B00182B98 /* PaintInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		0885068011DA045B00182B98 /* PaintPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0885067E11DA045B00182B98 /* PaintPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		088C97120ECB6D92000534BA /* WMLNames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4CA3AB490E556F2400E9C0C0 /* WMLNames.cpp */; };
 		088C97130ECB6D9D000534BA /* WMLNames.h in Headers */ = {isa = PBXBuildFile; fileRef = 4CA3AB480E556F2400E9C0C0 /* WMLNames.h */; };
 		088C97510ECB6E28000534BA /* WMLAElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4C6B99180E52E37300487BB7 /* WMLAElement.cpp */; };
@@ -296,6 +298,15 @@
 		188604B30F2E654A000B6443 /* DOMTimer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 188604B10F2E654A000B6443 /* DOMTimer.cpp */; };
 		188604B40F2E654A000B6443 /* DOMTimer.h in Headers */ = {isa = PBXBuildFile; fileRef = 188604B20F2E654A000B6443 /* DOMTimer.h */; };
 		18F831B80FD48C7800D8C56B /* WorkerLoaderProxy.h in Headers */ = {isa = PBXBuildFile; fileRef = 18F831B70FD48C7800D8C56B /* WorkerLoaderProxy.h */; };
+		1921327411C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1921327111C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp */; };
+		1921327511C0E6BB00456238 /* SVGFEConvolveMatrixElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 1921327211C0E6BB00456238 /* SVGFEConvolveMatrixElement.h */; };
+		19BFF64B11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 19BFF64611C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h */; };
+		19BFF64C11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = 19BFF64711C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm */; };
+		19BFF64D11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 19BFF64811C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h */; };
+		19BFF64E11C0F2AC00B8C04D /* JSSVGFEConvolveMatrixElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 19BFF64911C0F2AC00B8C04D /* JSSVGFEConvolveMatrixElement.cpp */; };
+		19BFF64F11C0F2AC00B8C04D /* JSSVGFEConvolveMatrixElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 19BFF64A11C0F2AC00B8C04D /* JSSVGFEConvolveMatrixElement.h */; };
+		19BFF6A311C10FDF00B8C04D /* DOMSVGFEConvolveMatrixElement.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 19BFF64611C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h */; };
+		19BFF6A411C1102D00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 19BFF64811C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h */; };
 		1A0D57360A5C77FE007EDD4C /* OverflowEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A0D57340A5C77FE007EDD4C /* OverflowEvent.cpp */; };
 		1A0D57370A5C77FE007EDD4C /* OverflowEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A0D57350A5C77FE007EDD4C /* OverflowEvent.h */; };
 		1A0D57400A5C7867007EDD4C /* JSOverflowEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A0D573E0A5C7867007EDD4C /* JSOverflowEvent.cpp */; };
@@ -1085,6 +1096,10 @@
 		5160306C0CC4362300C8AC25 /* FileSystemCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5160306B0CC4362300C8AC25 /* FileSystemCF.cpp */; };
 		5160F4980B0AA75F00C1D2AF /* HistoryItemMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5160F4970B0AA75F00C1D2AF /* HistoryItemMac.mm */; };
 		516BB7940CE91E6800512F79 /* JSTreeWalkerCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 516BB7920CE91E6800512F79 /* JSTreeWalkerCustom.cpp */; };
+		51721FBB11D2790700638B42 /* BeforeProcessEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 51721FB911D2790700638B42 /* BeforeProcessEvent.h */; };
+		51721FD211D27EF200638B42 /* JSBeforeProcessEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51721FD011D27EF200638B42 /* JSBeforeProcessEvent.cpp */; };
+		51721FD311D27EF200638B42 /* JSBeforeProcessEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 51721FD111D27EF200638B42 /* JSBeforeProcessEvent.h */; };
+		5172204B11D2960500638B42 /* BeforeProcessEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5172204A11D2960500638B42 /* BeforeProcessEvent.cpp */; };
 		51741D0F0B07259A00ED442C /* BackForwardList.h in Headers */ = {isa = PBXBuildFile; fileRef = 51741D0B0B07259A00ED442C /* BackForwardList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		51741D100B07259A00ED442C /* BackForwardList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 51741D0C0B07259A00ED442C /* BackForwardList.cpp */; };
 		51741D110B07259A00ED442C /* HistoryItem.h in Headers */ = {isa = PBXBuildFile; fileRef = 51741D0D0B07259A00ED442C /* HistoryItem.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1308,6 +1323,9 @@
 		6EE8A77210F803F3005A4A24 /* JSWebGLContextAttributes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 6EE8A77010F803F3005A4A24 /* JSWebGLContextAttributes.cpp */; };
 		6EE8A77310F803F3005A4A24 /* JSWebGLContextAttributes.h in Headers */ = {isa = PBXBuildFile; fileRef = 6EE8A77110F803F3005A4A24 /* JSWebGLContextAttributes.h */; };
 		72626E020EF022FE00A07E20 /* FontFastPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 72626E010EF022FE00A07E20 /* FontFastPath.cpp */; };
+		750D029311D0E7F300BD1B27 /* RenderInputSpeech.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 750D029111D0E7F300BD1B27 /* RenderInputSpeech.cpp */; };
+		750D029411D0E7F300BD1B27 /* RenderInputSpeech.h in Headers */ = {isa = PBXBuildFile; fileRef = 750D029211D0E7F300BD1B27 /* RenderInputSpeech.h */; };
+		750D02C111D0EE7D00BD1B27 /* inputSpeech.tiff in Resources */ = {isa = PBXBuildFile; fileRef = 750D02C011D0EE7D00BD1B27 /* inputSpeech.tiff */; };
 		754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 754133A7102E00E800075D00 /* InspectorTimelineAgent.h */; };
 		754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */; };
 		7553CFE8108F473F00EA281E /* TimelineRecordFactory.h in Headers */ = {isa = PBXBuildFile; fileRef = 7553CFE6108F473F00EA281E /* TimelineRecordFactory.h */; };
@@ -2281,6 +2299,13 @@
 		89BED5EC11BE11CE00448492 /* BlobBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 89BED5EA11BE11CE00448492 /* BlobBuilder.h */; };
 		89CD029311C85B870070B791 /* JSBlobBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 89CD029111C85B870070B791 /* JSBlobBuilder.cpp */; };
 		89CD029411C85B870070B791 /* JSBlobBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 89CD029211C85B870070B791 /* JSBlobBuilder.h */; };
+		8A81BF8511DCFD9000DA2B98 /* ResourceLoadTiming.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A81BF8411DCFD9000DA2B98 /* ResourceLoadTiming.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		8A844D0411D3C18E0014065C /* Performance.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8A844D0111D3C18E0014065C /* Performance.cpp */; };
+		8A844D0511D3C18E0014065C /* Performance.h in Headers */ = {isa = PBXBuildFile; fileRef = 8A844D0211D3C18E0014065C /* Performance.h */; };
+		8AF4E55511DC5A36000ED3DE /* Navigation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8AF4E55211DC5A36000ED3DE /* Navigation.cpp */; };
+		8AF4E55611DC5A36000ED3DE /* Navigation.h in Headers */ = {isa = PBXBuildFile; fileRef = 8AF4E55311DC5A36000ED3DE /* Navigation.h */; };
+		8AF4E55B11DC5A63000ED3DE /* Timing.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8AF4E55811DC5A63000ED3DE /* Timing.cpp */; };
+		8AF4E55C11DC5A63000ED3DE /* Timing.h in Headers */ = {isa = PBXBuildFile; fileRef = 8AF4E55911DC5A63000ED3DE /* Timing.h */; };
 		8FAC774D119872CB0015AE94 /* JSMainThreadExecState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8F934D841189F1EE00508D5D /* JSMainThreadExecState.cpp */; };
 		9302B0BD0D79F82900C7EE83 /* PageGroup.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */; };
 		9302B0BF0D79F82C00C7EE83 /* PageGroup.h in Headers */ = {isa = PBXBuildFile; fileRef = 9302B0BE0D79F82C00C7EE83 /* PageGroup.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2586,6 +2611,7 @@
 		9FFE3E7B11B59C5D0037874E /* MemoryInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 9FFE3E7911B59C5D0037874E /* MemoryInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9FFE3EA511B5A4390037874E /* JSMemoryInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9FFE3EA311B5A4390037874E /* JSMemoryInfo.cpp */; };
 		9FFE3EA611B5A4390037874E /* JSMemoryInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 9FFE3EA411B5A4390037874E /* JSMemoryInfo.h */; };
+		A00B721A11DE6428008AB9FF /* CheckedInt.h in Headers */ = {isa = PBXBuildFile; fileRef = A00B721911DE6427008AB9FF /* CheckedInt.h */; };
 		A136A00C1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A136A00A1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.cpp */; };
 		A136A00D1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.h in Headers */ = {isa = PBXBuildFile; fileRef = A136A00B1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.h */; };
 		A17C81220F2A5CF7005DAAEB /* HTMLElementFactory.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */; };
@@ -2967,6 +2993,8 @@
 		A83B79570CCB0125000B0825 /* DOMSVGFontFaceElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A83B79480CCB0125000B0825 /* DOMSVGFontFaceElement.h */; };
 		A83E1C740E49042C00140B9C /* ScriptControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = A83E1C720E49042B00140B9C /* ScriptControllerMac.mm */; };
 		A84D827C11D333ED00972990 /* RawDataDocumentParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A84D827B11D333ED00972990 /* RawDataDocumentParser.h */; };
+		A84D82C111D3474800972990 /* ScriptableDocumentParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A84D82BF11D3474800972990 /* ScriptableDocumentParser.h */; };
+		A84D82C211D3474800972990 /* ScriptableDocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A84D82C011D3474800972990 /* ScriptableDocumentParser.cpp */; };
 		A84EBD780CB8C89200079609 /* JSStyleSheetListCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A84EBD770CB8C89200079609 /* JSStyleSheetListCustom.cpp */; };
 		A84EBD830CB8C97700079609 /* JSStyleSheetList.h in Headers */ = {isa = PBXBuildFile; fileRef = A84EBD810CB8C97700079609 /* JSStyleSheetList.h */; };
 		A84EBD840CB8C97700079609 /* JSStyleSheetList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A84EBD820CB8C97700079609 /* JSStyleSheetList.cpp */; };
@@ -3050,8 +3078,15 @@
 		A89943290B42338800D7C802 /* BitmapImage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A89943270B42338700D7C802 /* BitmapImage.cpp */; };
 		A89CCC520F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A89CCC500F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp */; };
 		A89CCC530F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = A89CCC510F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h */; };
+		A8A563B411DB3D10003AC2F0 /* HTMLElementStack.h in Headers */ = {isa = PBXBuildFile; fileRef = A8A563B211DB3D10003AC2F0 /* HTMLElementStack.h */; };
+		A8A563B511DB3D10003AC2F0 /* HTMLElementStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8A563B311DB3D10003AC2F0 /* HTMLElementStack.cpp */; };
+		A8A564A511DC0E59003AC2F0 /* HTMLFormattingElementList.h in Headers */ = {isa = PBXBuildFile; fileRef = A8A564A311DC0E59003AC2F0 /* HTMLFormattingElementList.h */; };
+		A8A564A611DC0E59003AC2F0 /* HTMLFormattingElementList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8A564A411DC0E59003AC2F0 /* HTMLFormattingElementList.cpp */; };
 		A8A909AC0CBCD6B50029B807 /* RenderSVGTransformableContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = A8A909AA0CBCD6B50029B807 /* RenderSVGTransformableContainer.h */; };
 		A8A909AD0CBCD6B50029B807 /* RenderSVGTransformableContainer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8A909AB0CBCD6B50029B807 /* RenderSVGTransformableContainer.cpp */; };
+		A8C2280E11D4A59700D5A7D3 /* DocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8C2280D11D4A59700D5A7D3 /* DocumentParser.cpp */; };
+		A8C228A111D5722E00D5A7D3 /* DecodedDataDocumentParser.h in Headers */ = {isa = PBXBuildFile; fileRef = A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */; };
+		A8C228A211D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8C228A011D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp */; };
 		A8C4A7FD09D563270003AC8D /* StyledElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A8C4A7EB09D563270003AC8D /* StyledElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A8C4A7FE09D563270003AC8D /* StyledElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8C4A7EC09D563270003AC8D /* StyledElement.cpp */; };
 		A8C4A80009D563270003AC8D /* Node.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A8C4A7EE09D563270003AC8D /* Node.cpp */; };
@@ -4362,7 +4397,6 @@
 		BC275CB311C5E85C00C9206C /* JSArrayBufferCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC275CB211C5E85C00C9206C /* JSArrayBufferCustom.cpp */; };
 		BC2CC8DF0F32881000A9DF26 /* RenderObjectChildList.h in Headers */ = {isa = PBXBuildFile; fileRef = BC2CC8DE0F32881000A9DF26 /* RenderObjectChildList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC2ED5550C6B9BD300920BFF /* JSElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2ED5540C6B9BD300920BFF /* JSElementCustom.cpp */; };
-		BC2ED6500C6BC48C00920BFF /* JSHTMLIFrameElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2ED64F0C6BC48C00920BFF /* JSHTMLIFrameElementCustom.cpp */; };
 		BC2ED6BC0C6BD2F000920BFF /* JSAttrCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2ED6BB0C6BD2F000920BFF /* JSAttrCustom.cpp */; };
 		BC2ED7A50C6C0F3600920BFF /* JSHTMLFrameElementCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC2ED7A40C6C0F3600920BFF /* JSHTMLFrameElementCustom.cpp */; };
 		BC305C790C076BB300CD20F0 /* JSHTMLObjectElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC305C770C076BB300CD20F0 /* JSHTMLObjectElement.cpp */; };
@@ -4491,6 +4525,13 @@
 		BC60DB490D2A3D1E00B9918F /* JSXPathException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC60DB470D2A3D1E00B9918F /* JSXPathException.cpp */; };
 		BC60DB4A0D2A3D1E00B9918F /* JSXPathException.h in Headers */ = {isa = PBXBuildFile; fileRef = BC60DB480D2A3D1E00B9918F /* JSXPathException.h */; };
 		BC60EFB70F33A0E700812A93 /* RenderObjectChildList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC60EFB60F33A0E700812A93 /* RenderObjectChildList.cpp */; };
+		BC64640911D7F304006455B0 /* DOMStringMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC64640711D7F304006455B0 /* DOMStringMap.cpp */; };
+		BC64640A11D7F304006455B0 /* DOMStringMap.h in Headers */ = {isa = PBXBuildFile; fileRef = BC64640811D7F304006455B0 /* DOMStringMap.h */; };
+		BC64641C11D7F416006455B0 /* DatasetDOMStringMap.h in Headers */ = {isa = PBXBuildFile; fileRef = BC64641A11D7F416006455B0 /* DatasetDOMStringMap.h */; };
+		BC64641D11D7F416006455B0 /* DatasetDOMStringMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC64641B11D7F416006455B0 /* DatasetDOMStringMap.cpp */; };
+		BC64649711D82349006455B0 /* JSDOMStringMap.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC64649511D82349006455B0 /* JSDOMStringMap.cpp */; };
+		BC64649811D82349006455B0 /* JSDOMStringMap.h in Headers */ = {isa = PBXBuildFile; fileRef = BC64649611D82349006455B0 /* JSDOMStringMap.h */; };
+		BC64649C11D8238C006455B0 /* JSDOMStringMapCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC64649B11D8238C006455B0 /* JSDOMStringMapCustom.cpp */; };
 		BC64B4CB0CB4295D005F2B62 /* CachedFont.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC64B4C90CB4295D005F2B62 /* CachedFont.cpp */; };
 		BC64B4CC0CB4295D005F2B62 /* CachedFont.h in Headers */ = {isa = PBXBuildFile; fileRef = BC64B4CA0CB4295D005F2B62 /* CachedFont.h */; };
 		BC64B4D50CB4298A005F2B62 /* CSSFontFace.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC64B4CD0CB4298A005F2B62 /* CSSFontFace.cpp */; };
@@ -5359,6 +5400,8 @@
 				A80F3B680CCDCE24002DD990 /* DOMSVGFEComponentTransferElementInternal.h in Copy Generated Headers */,
 				A8F46AC30CB20A9D003A9670 /* DOMSVGFECompositeElement.h in Copy Generated Headers */,
 				A80F3B310CCDCE24002DD990 /* DOMSVGFECompositeElementInternal.h in Copy Generated Headers */,
+				19BFF6A311C10FDF00B8C04D /* DOMSVGFEConvolveMatrixElement.h in Copy Generated Headers */,
+				19BFF6A411C1102D00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h in Copy Generated Headers */,
 				A80F3B430CCDCE24002DD990 /* DOMSVGFEDiffuseLightingElement.h in Copy Generated Headers */,
 				A80F3B440CCDCE24002DD990 /* DOMSVGFEDiffuseLightingElementInternal.h in Copy Generated Headers */,
 				A8F46AAA0CB20A9D003A9670 /* DOMSVGFEDisplacementMapElement.h in Copy Generated Headers */,
@@ -5676,6 +5719,8 @@
 		08820BDD0EF5D381009099A8 /* WMLTableElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLTableElement.h; sourceTree = "<group>"; };
 		088451130F267B62007F139E /* WMLInputElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLInputElement.cpp; sourceTree = "<group>"; };
 		088451140F267B63007F139E /* WMLInputElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLInputElement.h; sourceTree = "<group>"; };
+		0885067D11DA045B00182B98 /* PaintInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PaintInfo.h; sourceTree = "<group>"; };
+		0885067E11DA045B00182B98 /* PaintPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PaintPhase.h; sourceTree = "<group>"; };
 		0893E4650ECB68F400A28563 /* WMLPageState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLPageState.cpp; sourceTree = "<group>"; };
 		0893E4660ECB68F400A28563 /* WMLPageState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLPageState.h; sourceTree = "<group>"; };
 		089582530E857A7E00F82C83 /* ImageLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageLoader.cpp; sourceTree = "<group>"; };
@@ -5739,6 +5784,7 @@
 		0F15DA890F3AAEE70000CE47 /* AnimationControllerPrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = AnimationControllerPrivate.h; path = animation/AnimationControllerPrivate.h; sourceTree = "<group>"; };
 		0F500AAE0F54DB1B00EEF928 /* TransformState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TransformState.h; sourceTree = "<group>"; };
 		0F500AB00F54DB3100EEF928 /* TransformState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TransformState.cpp; sourceTree = "<group>"; };
+		0F5263E511DC136E0006D33C /* WebCore.AcceleratedCompositing.exp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.exports; path = WebCore.AcceleratedCompositing.exp; sourceTree = "<group>"; };
 		0F56028D0E4B76580065B038 /* RenderMarquee.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderMarquee.h; sourceTree = "<group>"; };
 		0F56028E0E4B76580065B038 /* RenderMarquee.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderMarquee.cpp; sourceTree = "<group>"; };
 		0F580B030F12A2540051D689 /* GraphicsLayerCA.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = GraphicsLayerCA.mm; sourceTree = "<group>"; };
@@ -5848,6 +5894,14 @@
 		188604B10F2E654A000B6443 /* DOMTimer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMTimer.cpp; sourceTree = "<group>"; };
 		188604B20F2E654A000B6443 /* DOMTimer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMTimer.h; sourceTree = "<group>"; };
 		18F831B70FD48C7800D8C56B /* WorkerLoaderProxy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WorkerLoaderProxy.h; path = workers/WorkerLoaderProxy.h; sourceTree = "<group>"; };
+		1921327111C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFEConvolveMatrixElement.cpp; sourceTree = "<group>"; };
+		1921327211C0E6BB00456238 /* SVGFEConvolveMatrixElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGFEConvolveMatrixElement.h; sourceTree = "<group>"; };
+		1921327311C0E6BB00456238 /* SVGFEConvolveMatrixElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SVGFEConvolveMatrixElement.idl; sourceTree = "<group>"; };
+		19BFF64611C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGFEConvolveMatrixElement.h; sourceTree = "<group>"; };
+		19BFF64711C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMSVGFEConvolveMatrixElement.mm; sourceTree = "<group>"; };
+		19BFF64811C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGFEConvolveMatrixElementInternal.h; sourceTree = "<group>"; };
+		19BFF64911C0F2AC00B8C04D /* JSSVGFEConvolveMatrixElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGFEConvolveMatrixElement.cpp; sourceTree = "<group>"; };
+		19BFF64A11C0F2AC00B8C04D /* JSSVGFEConvolveMatrixElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGFEConvolveMatrixElement.h; sourceTree = "<group>"; };
 		1A0D57340A5C77FE007EDD4C /* OverflowEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = OverflowEvent.cpp; sourceTree = "<group>"; };
 		1A0D57350A5C77FE007EDD4C /* OverflowEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = OverflowEvent.h; sourceTree = "<group>"; };
 		1A0D57380A5C7812007EDD4C /* OverflowEvent.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = OverflowEvent.idl; sourceTree = "<group>"; };
@@ -6739,6 +6793,11 @@
 		5160306B0CC4362300C8AC25 /* FileSystemCF.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FileSystemCF.cpp; sourceTree = "<group>"; };
 		5160F4970B0AA75F00C1D2AF /* HistoryItemMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = HistoryItemMac.mm; path = mac/HistoryItemMac.mm; sourceTree = "<group>"; };
 		516BB7920CE91E6800512F79 /* JSTreeWalkerCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTreeWalkerCustom.cpp; sourceTree = "<group>"; };
+		51721FB911D2790700638B42 /* BeforeProcessEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BeforeProcessEvent.h; sourceTree = "<group>"; };
+		51721FBA11D2790700638B42 /* BeforeProcessEvent.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = BeforeProcessEvent.idl; sourceTree = "<group>"; };
+		51721FD011D27EF200638B42 /* JSBeforeProcessEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBeforeProcessEvent.cpp; sourceTree = "<group>"; };
+		51721FD111D27EF200638B42 /* JSBeforeProcessEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBeforeProcessEvent.h; sourceTree = "<group>"; };
+		5172204A11D2960500638B42 /* BeforeProcessEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BeforeProcessEvent.cpp; sourceTree = "<group>"; };
 		51741D0B0B07259A00ED442C /* BackForwardList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BackForwardList.h; sourceTree = "<group>"; };
 		51741D0C0B07259A00ED442C /* BackForwardList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BackForwardList.cpp; sourceTree = "<group>"; };
 		51741D0D0B07259A00ED442C /* HistoryItem.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = HistoryItem.h; sourceTree = "<group>"; };
@@ -6983,6 +7042,9 @@
 		6EE8A77010F803F3005A4A24 /* JSWebGLContextAttributes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLContextAttributes.cpp; sourceTree = "<group>"; };
 		6EE8A77110F803F3005A4A24 /* JSWebGLContextAttributes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLContextAttributes.h; sourceTree = "<group>"; };
 		72626E010EF022FE00A07E20 /* FontFastPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FontFastPath.cpp; sourceTree = "<group>"; };
+		750D029111D0E7F300BD1B27 /* RenderInputSpeech.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderInputSpeech.cpp; sourceTree = "<group>"; };
+		750D029211D0E7F300BD1B27 /* RenderInputSpeech.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderInputSpeech.h; sourceTree = "<group>"; };
+		750D02C011D0EE7D00BD1B27 /* inputSpeech.tiff */ = {isa = PBXFileReference; lastKnownFileType = image.tiff; path = inputSpeech.tiff; sourceTree = "<group>"; };
 		754133A7102E00E800075D00 /* InspectorTimelineAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorTimelineAgent.h; sourceTree = "<group>"; };
 		754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorTimelineAgent.cpp; sourceTree = "<group>"; };
 		7553CFE6108F473F00EA281E /* TimelineRecordFactory.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TimelineRecordFactory.h; sourceTree = "<group>"; };
@@ -7913,6 +7975,16 @@
 		89CD027911C859A80070B791 /* BlobBuilder.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = BlobBuilder.idl; sourceTree = "<group>"; };
 		89CD029111C85B870070B791 /* JSBlobBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSBlobBuilder.cpp; sourceTree = "<group>"; };
 		89CD029211C85B870070B791 /* JSBlobBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBlobBuilder.h; sourceTree = "<group>"; };
+		8A81BF8411DCFD9000DA2B98 /* ResourceLoadTiming.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceLoadTiming.h; sourceTree = "<group>"; };
+		8A844D0111D3C18E0014065C /* Performance.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Performance.cpp; sourceTree = "<group>"; };
+		8A844D0211D3C18E0014065C /* Performance.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Performance.h; sourceTree = "<group>"; };
+		8A844D0311D3C18E0014065C /* Performance.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Performance.idl; sourceTree = "<group>"; };
+		8AF4E55211DC5A36000ED3DE /* Navigation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Navigation.cpp; sourceTree = "<group>"; };
+		8AF4E55311DC5A36000ED3DE /* Navigation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Navigation.h; sourceTree = "<group>"; };
+		8AF4E55411DC5A36000ED3DE /* Navigation.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Navigation.idl; sourceTree = "<group>"; };
+		8AF4E55811DC5A63000ED3DE /* Timing.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Timing.cpp; sourceTree = "<group>"; };
+		8AF4E55911DC5A63000ED3DE /* Timing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Timing.h; sourceTree = "<group>"; };
+		8AF4E55A11DC5A63000ED3DE /* Timing.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = Timing.idl; sourceTree = "<group>"; };
 		8F934D831189F1EE00508D5D /* JSMainThreadExecState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMainThreadExecState.h; sourceTree = "<group>"; };
 		8F934D841189F1EE00508D5D /* JSMainThreadExecState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMainThreadExecState.cpp; sourceTree = "<group>"; };
 		9302B0BC0D79F82900C7EE83 /* PageGroup.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageGroup.cpp; sourceTree = "<group>"; };
@@ -8200,6 +8272,7 @@
 		9FFE3E7C11B59C6E0037874E /* MemoryInfo.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = MemoryInfo.idl; sourceTree = "<group>"; };
 		9FFE3EA311B5A4390037874E /* JSMemoryInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMemoryInfo.cpp; sourceTree = "<group>"; };
 		9FFE3EA411B5A4390037874E /* JSMemoryInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSMemoryInfo.h; sourceTree = "<group>"; };
+		A00B721911DE6427008AB9FF /* CheckedInt.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CheckedInt.h; path = canvas/CheckedInt.h; sourceTree = "<group>"; };
 		A136A00A1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XMLHttpRequestProgressEventThrottle.cpp; sourceTree = "<group>"; };
 		A136A00B1134DBD200CC8D50 /* XMLHttpRequestProgressEventThrottle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XMLHttpRequestProgressEventThrottle.h; sourceTree = "<group>"; };
 		A17C81200F2A5CF7005DAAEB /* HTMLElementFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLElementFactory.cpp; sourceTree = "<group>"; };
@@ -8449,6 +8522,8 @@
 		A83B79480CCB0125000B0825 /* DOMSVGFontFaceElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMSVGFontFaceElement.h; sourceTree = "<group>"; };
 		A83E1C720E49042B00140B9C /* ScriptControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ScriptControllerMac.mm; sourceTree = "<group>"; };
 		A84D827B11D333ED00972990 /* RawDataDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RawDataDocumentParser.h; sourceTree = "<group>"; };
+		A84D82BF11D3474800972990 /* ScriptableDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptableDocumentParser.h; sourceTree = "<group>"; };
+		A84D82C011D3474800972990 /* ScriptableDocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptableDocumentParser.cpp; sourceTree = "<group>"; };
 		A84EBD770CB8C89200079609 /* JSStyleSheetListCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStyleSheetListCustom.cpp; sourceTree = "<group>"; };
 		A84EBD810CB8C97700079609 /* JSStyleSheetList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSStyleSheetList.h; sourceTree = "<group>"; };
 		A84EBD820CB8C97700079609 /* JSStyleSheetList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSStyleSheetList.cpp; sourceTree = "<group>"; };
@@ -8532,8 +8607,15 @@
 		A89943270B42338700D7C802 /* BitmapImage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BitmapImage.cpp; sourceTree = "<group>"; };
 		A89CCC500F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ReplaceNodeWithSpanCommand.cpp; sourceTree = "<group>"; };
 		A89CCC510F44E98100B5DA10 /* ReplaceNodeWithSpanCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ReplaceNodeWithSpanCommand.h; sourceTree = "<group>"; };
+		A8A563B211DB3D10003AC2F0 /* HTMLElementStack.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLElementStack.h; sourceTree = "<group>"; };
+		A8A563B311DB3D10003AC2F0 /* HTMLElementStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLElementStack.cpp; sourceTree = "<group>"; };
+		A8A564A311DC0E59003AC2F0 /* HTMLFormattingElementList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLFormattingElementList.h; sourceTree = "<group>"; };
+		A8A564A411DC0E59003AC2F0 /* HTMLFormattingElementList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLFormattingElementList.cpp; sourceTree = "<group>"; };
 		A8A909AA0CBCD6B50029B807 /* RenderSVGTransformableContainer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGTransformableContainer.h; sourceTree = "<group>"; };
 		A8A909AB0CBCD6B50029B807 /* RenderSVGTransformableContainer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGTransformableContainer.cpp; sourceTree = "<group>"; };
+		A8C2280D11D4A59700D5A7D3 /* DocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentParser.cpp; sourceTree = "<group>"; };
+		A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecodedDataDocumentParser.h; sourceTree = "<group>"; };
+		A8C228A011D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DecodedDataDocumentParser.cpp; sourceTree = "<group>"; };
 		A8C4A7EB09D563270003AC8D /* StyledElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = StyledElement.h; sourceTree = "<group>"; };
 		A8C4A7EC09D563270003AC8D /* StyledElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = StyledElement.cpp; sourceTree = "<group>"; };
 		A8C4A7EE09D563270003AC8D /* Node.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Node.cpp; sourceTree = "<group>"; };
@@ -9887,7 +9969,6 @@
 		BC275CB211C5E85C00C9206C /* JSArrayBufferCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSArrayBufferCustom.cpp; sourceTree = "<group>"; };
 		BC2CC8DE0F32881000A9DF26 /* RenderObjectChildList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderObjectChildList.h; sourceTree = "<group>"; };
 		BC2ED5540C6B9BD300920BFF /* JSElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSElementCustom.cpp; sourceTree = "<group>"; };
-		BC2ED64F0C6BC48C00920BFF /* JSHTMLIFrameElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLIFrameElementCustom.cpp; sourceTree = "<group>"; };
 		BC2ED6BB0C6BD2F000920BFF /* JSAttrCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAttrCustom.cpp; sourceTree = "<group>"; };
 		BC2ED7A40C6C0F3600920BFF /* JSHTMLFrameElementCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLFrameElementCustom.cpp; sourceTree = "<group>"; };
 		BC305C770C076BB300CD20F0 /* JSHTMLObjectElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSHTMLObjectElement.cpp; sourceTree = "<group>"; };
@@ -10023,6 +10104,14 @@
 		BC60DB470D2A3D1E00B9918F /* JSXPathException.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSXPathException.cpp; sourceTree = "<group>"; };
 		BC60DB480D2A3D1E00B9918F /* JSXPathException.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSXPathException.h; sourceTree = "<group>"; };
 		BC60EFB60F33A0E700812A93 /* RenderObjectChildList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderObjectChildList.cpp; sourceTree = "<group>"; };
+		BC64640711D7F304006455B0 /* DOMStringMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DOMStringMap.cpp; sourceTree = "<group>"; };
+		BC64640811D7F304006455B0 /* DOMStringMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DOMStringMap.h; sourceTree = "<group>"; };
+		BC64641A11D7F416006455B0 /* DatasetDOMStringMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DatasetDOMStringMap.h; sourceTree = "<group>"; };
+		BC64641B11D7F416006455B0 /* DatasetDOMStringMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DatasetDOMStringMap.cpp; sourceTree = "<group>"; };
+		BC64647911D800CD006455B0 /* DOMStringMap.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = DOMStringMap.idl; sourceTree = "<group>"; };
+		BC64649511D82349006455B0 /* JSDOMStringMap.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMStringMap.cpp; sourceTree = "<group>"; };
+		BC64649611D82349006455B0 /* JSDOMStringMap.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMStringMap.h; sourceTree = "<group>"; };
+		BC64649B11D8238C006455B0 /* JSDOMStringMapCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMStringMapCustom.cpp; sourceTree = "<group>"; };
 		BC64B4C90CB4295D005F2B62 /* CachedFont.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CachedFont.cpp; sourceTree = "<group>"; };
 		BC64B4CA0CB4295D005F2B62 /* CachedFont.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedFont.h; sourceTree = "<group>"; };
 		BC64B4CD0CB4298A005F2B62 /* CSSFontFace.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSFontFace.cpp; sourceTree = "<group>"; };
@@ -10867,6 +10956,7 @@
 				85136C890AED665800F90A3D /* eastResizeCursor.png */,
 				85136C8A0AED665800F90A3D /* eastWestResizeCursor.png */,
 				85136C8B0AED665800F90A3D /* helpCursor.png */,
+				750D02C011D0EE7D00BD1B27 /* inputSpeech.tiff */,
 				85136C8C0AED665800F90A3D /* linkCursor.png */,
 				AB4261D70A2F6C9700BDD17D /* missingImage.tiff */,
 				85136C8D0AED665800F90A3D /* moveCursor.png */,
@@ -11471,6 +11561,7 @@
 			isa = PBXGroup;
 			children = (
 				0F9C6F4B1073EF0400DED9BF /* WebCore.3DRendering.exp */,
+				0F5263E511DC136E0006D33C /* WebCore.AcceleratedCompositing.exp */,
 				F58EF58E02DFDFB7018635CA /* WebCore.base.exp */,
 				BC56CCDF10D72BD800A77C64 /* WebCore.ClientBasedGeolocation.exp */,
 				FEFD102C105C41470002855E /* WebCore.ContextMenus.exp */,
@@ -11523,6 +11614,7 @@
 				49484FBE102CF23C00187DD3 /* CanvasRenderingContext2D.idl */,
 				49484FBF102CF23C00187DD3 /* CanvasStyle.cpp */,
 				49484FC0102CF23C00187DD3 /* CanvasStyle.h */,
+				A00B721911DE6427008AB9FF /* CheckedInt.h */,
 				49EECDCD10503C2300099FAB /* Float32Array.cpp */,
 				49EECDCE10503C2300099FAB /* Float32Array.h */,
 				49EECDCF10503C2300099FAB /* Float32Array.idl */,
@@ -11874,8 +11966,8 @@
 				A9C6E4F20D745E48006442E9 /* PluginData.h */,
 				1ADA140E0E1AE5D900023EE5 /* PluginMainThreadScheduler.cpp */,
 				1ADA140F0E1AE5D900023EE5 /* PluginMainThreadScheduler.h */,
-				76FF17E211235673001D61B5 /* PluginViewNone.cpp */,
 				1AA8798F11CBE846003C664F /* PluginStrategy.h */,
+				76FF17E211235673001D61B5 /* PluginViewNone.cpp */,
 				0AFDAC3C10F5448C00E1F3D2 /* PluginWidget.h */,
 			);
 			path = plugins;
@@ -11964,6 +12056,7 @@
 				514C76640CE923A1007EF3CD /* ResourceHandle.h */,
 				514C76650CE923A1007EF3CD /* ResourceHandleClient.h */,
 				514C76660CE923A1007EF3CD /* ResourceHandleInternal.h */,
+				8A81BF8411DCFD9000DA2B98 /* ResourceLoadTiming.h */,
 				514C76670CE923A1007EF3CD /* ResourceRequestBase.cpp */,
 				514C76680CE923A1007EF3CD /* ResourceRequestBase.h */,
 				514C76690CE923A1007EF3CD /* ResourceResponseBase.cpp */,
@@ -12144,6 +12237,9 @@
 				9FFE3E7C11B59C6E0037874E /* MemoryInfo.idl */,
 				93EB355E09E37FD600F43799 /* MouseEventWithHitTestResults.cpp */,
 				935C476209AC4CE600A6AAB4 /* MouseEventWithHitTestResults.h */,
+				8AF4E55211DC5A36000ED3DE /* Navigation.cpp */,
+				8AF4E55311DC5A36000ED3DE /* Navigation.h */,
+				8AF4E55411DC5A36000ED3DE /* Navigation.idl */,
 				A9C6E5A30D746458006442E9 /* Navigator.cpp */,
 				A9C6E5A40D746458006442E9 /* Navigator.h */,
 				A9C6E65D0D746694006442E9 /* Navigator.idl */,
@@ -12157,6 +12253,9 @@
 				9302B0BE0D79F82C00C7EE83 /* PageGroup.h */,
 				7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */,
 				7A674BDA0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h */,
+				8A844D0111D3C18E0014065C /* Performance.cpp */,
+				8A844D0211D3C18E0014065C /* Performance.h */,
+				8A844D0311D3C18E0014065C /* Performance.idl */,
 				7693BACF106C2DCA007B0823 /* PluginHalter.cpp */,
 				7693BAD0106C2DCA007B0823 /* PluginHalter.h */,
 				7693BAD1106C2DCA007B0823 /* PluginHalterClient.h */,
@@ -12179,6 +12278,9 @@
 				626CDE0D1140424C001E5A68 /* SpatialNavigation.h */,
 				62C1217A11AB9E76003C462C /* SuspendableTimer.cpp */,
 				62C1217B11AB9E77003C462C /* SuspendableTimer.h */,
+				8AF4E55811DC5A63000ED3DE /* Timing.cpp */,
+				8AF4E55911DC5A63000ED3DE /* Timing.h */,
+				8AF4E55A11DC5A63000ED3DE /* Timing.idl */,
 				BCACF3BA1072921A00C0C8A3 /* UserContentURLPattern.cpp */,
 				BCACF3BB1072921A00C0C8A3 /* UserContentURLPattern.h */,
 				BCA2B0601050475F0043BD1C /* UserScript.h */,
@@ -12491,6 +12593,9 @@
 				8502AB1A0AD438C000378540 /* DOMSVGFECompositeElement.h */,
 				8502AB1B0AD438C000378540 /* DOMSVGFECompositeElement.mm */,
 				A8E5447F0CA9D1C20097D09B /* DOMSVGFECompositeElementInternal.h */,
+				19BFF64611C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h */,
+				19BFF64711C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm */,
+				19BFF64811C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h */,
 				8502AB1C0AD438C000378540 /* DOMSVGFEDiffuseLightingElement.h */,
 				8502AB1D0AD438C000378540 /* DOMSVGFEDiffuseLightingElement.mm */,
 				A8E5447D0CA9D1C20097D09B /* DOMSVGFEDiffuseLightingElementInternal.h */,
@@ -13183,6 +13288,7 @@
 				8502AB790AD4394E00378540 /* DOMSVGFEColorMatrixElementInternal.h */,
 				8502AB7A0AD4394E00378540 /* DOMSVGFEComponentTransferElementInternal.h */,
 				8502AB7B0AD4394E00378540 /* DOMSVGFECompositeElementInternal.h */,
+				19BFF64811C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h */,
 				8502AB7C0AD4394E00378540 /* DOMSVGFEDiffuseLightingElementInternal.h */,
 				8502AB7D0AD4394E00378540 /* DOMSVGFEDisplacementMapElementInternal.h */,
 				8502AB7E0AD4394E00378540 /* DOMSVGFEDistantLightElementInternal.h */,
@@ -13440,6 +13546,7 @@
 		93EEC1EC09C2877700C515D1 /* html */ = {
 			isa = PBXGroup;
 			children = (
+				49484FAE102CF01E00187DD3 /* canvas */,
 				B0149E7911A4B21500196A7B /* AsyncImageResizer.cpp */,
 				B0149E7A11A4B21500196A7B /* AsyncImageResizer.h */,
 				2EAFAF0B10E2AF2D007ED3D6 /* Blob.cpp */,
@@ -13448,7 +13555,6 @@
 				89BED5E911BE11CE00448492 /* BlobBuilder.cpp */,
 				89BED5EA11BE11CE00448492 /* BlobBuilder.h */,
 				89CD027911C859A80070B791 /* BlobBuilder.idl */,
-				49484FAE102CF01E00187DD3 /* canvas */,
 				93C441ED0F813A1A00C1A634 /* CollectionCache.cpp */,
 				93C441EE0F813A1A00C1A634 /* CollectionCache.h */,
 				93C441FF0F813AE100C1A634 /* CollectionType.h */,
@@ -13489,20 +13595,6 @@
 				895253DE116C4F0600CABF00 /* FileThreadTask.h */,
 				A8136D370973A8E700D74463 /* FormDataList.cpp */,
 				A8136D360973A8E700D74463 /* FormDataList.h */,
-				A871038811A2947000DBD50E /* HTMLDocumentParser.cpp */,
-				A871038911A2947000DBD50E /* HTMLDocumentParser.h */,
-				976E895E11C0CA3A00EA9CA9 /* HTMLEntityParser.cpp */,
-				976E895F11C0CA3A00EA9CA9 /* HTMLEntityParser.h */,
-				97E8B35411A23CE200169409 /* HTMLTokenizer.cpp */,
-				97E8B35511A23CE200169409 /* HTMLTokenizer.h */,
-				97E7936311C6030900E649BC /* HTMLPreloadScanner.cpp */,
-				97E7936411C6030900E649BC /* HTMLPreloadScanner.h */,
-				A83B3AEE11ADEFF500458809 /* HTMLScriptRunner.cpp */,
-				A83B3AEF11ADEFF500458809 /* HTMLScriptRunner.h */,
-				A87F163411AE841300CBB2E5 /* HTMLScriptRunnerHost.h */,
-				97E8B3C211A2890800169409 /* HTMLToken.h */,
-				A879C62311A9D1F70059237A /* HTMLTreeBuilder.cpp */,
-				A879C62411A9D1F70059237A /* HTMLTreeBuilder.h */,
 				BC97E239109144950010D361 /* HTMLAllCollection.cpp */,
 				BC97E238109144950010D361 /* HTMLAllCollection.h */,
 				BC97E23C109146F10010D361 /* HTMLAllCollection.idl */,
@@ -13570,20 +13662,26 @@
 				F523D23B02DE4396018635CA /* HTMLDocument.cpp */,
 				F523D23C02DE4396018635CA /* HTMLDocument.h */,
 				1A494E290A12354300FDAFC1 /* HTMLDocument.idl */,
-				F523D25202DE4396018635CA /* LegacyHTMLDocumentParser.cpp */,
-				F523D25302DE4396018635CA /* LegacyHTMLDocumentParser.h */,
+				A871038811A2947000DBD50E /* HTMLDocumentParser.cpp */,
+				A871038911A2947000DBD50E /* HTMLDocumentParser.h */,
 				F523D23E02DE4396018635CA /* HTMLElement.cpp */,
 				F523D23F02DE4396018635CA /* HTMLElement.h */,
 				1A494BBB0A122DCD00FDAFC1 /* HTMLElement.idl */,
+				A8A563B311DB3D10003AC2F0 /* HTMLElementStack.cpp */,
+				A8A563B211DB3D10003AC2F0 /* HTMLElementStack.h */,
 				A871D4550A127CBC00B12A68 /* HTMLEmbedElement.cpp */,
 				A871D4520A127CBC00B12A68 /* HTMLEmbedElement.h */,
 				859128790AB222EC00202265 /* HTMLEmbedElement.idl */,
+				976E895E11C0CA3A00EA9CA9 /* HTMLEntityParser.cpp */,
+				976E895F11C0CA3A00EA9CA9 /* HTMLEntityParser.h */,
 				A81369B9097374F500D74463 /* HTMLFieldSetElement.cpp */,
 				A81369B8097374F500D74463 /* HTMLFieldSetElement.h */,
 				1AE2A9F40A1CDA5700B42B25 /* HTMLFieldSetElement.idl */,
 				A8CFF7980A156978000A4234 /* HTMLFontElement.cpp */,
 				A8CFF79C0A156978000A4234 /* HTMLFontElement.h */,
 				1AE2A9F50A1CDA5700B42B25 /* HTMLFontElement.idl */,
+				A8A564A411DC0E59003AC2F0 /* HTMLFormattingElementList.cpp */,
+				A8A564A311DC0E59003AC2F0 /* HTMLFormattingElementList.h */,
 				A8DF3FC7097FA0FB0052981B /* HTMLFormCollection.cpp */,
 				A8DF3FC6097FA0FB0052981B /* HTMLFormCollection.h */,
 				A81369B3097374F500D74463 /* HTMLFormControlElement.cpp */,
@@ -13700,6 +13798,8 @@
 				A8EA7C9F0A192B9C00A8EF5F /* HTMLPreElement.cpp */,
 				A8EA7CA20A192B9C00A8EF5F /* HTMLPreElement.h */,
 				1AE2AB850A1CE85000B42B25 /* HTMLPreElement.idl */,
+				97E7936311C6030900E649BC /* HTMLPreloadScanner.cpp */,
+				97E7936411C6030900E649BC /* HTMLPreloadScanner.h */,
 				A43BF5961149290A00C643CA /* HTMLProgressElement.cpp */,
 				A43BF5971149290A00C643CA /* HTMLProgressElement.h */,
 				A4226EA51163D84D008B8397 /* HTMLProgressElement.idl */,
@@ -13709,6 +13809,9 @@
 				A871DC160A15205700B12A68 /* HTMLScriptElement.cpp */,
 				A871DC190A15205700B12A68 /* HTMLScriptElement.h */,
 				1AE2AB960A1CE88D00B42B25 /* HTMLScriptElement.idl */,
+				A83B3AEE11ADEFF500458809 /* HTMLScriptRunner.cpp */,
+				A83B3AEF11ADEFF500458809 /* HTMLScriptRunner.h */,
+				A87F163411AE841300CBB2E5 /* HTMLScriptRunnerHost.h */,
 				A81369BD097374F500D74463 /* HTMLSelectElement.cpp */,
 				A81369BC097374F500D74463 /* HTMLSelectElement.h */,
 				855542990AA4938800BA89F2 /* HTMLSelectElement.idl */,
@@ -13747,6 +13850,11 @@
 				A871DC1D0A15205700B12A68 /* HTMLTitleElement.cpp */,
 				A871DC1C0A15205700B12A68 /* HTMLTitleElement.h */,
 				A80E7AAE0A19D1F1007FB8C5 /* HTMLTitleElement.idl */,
+				97E8B3C211A2890800169409 /* HTMLToken.h */,
+				97E8B35411A23CE200169409 /* HTMLTokenizer.cpp */,
+				97E8B35511A23CE200169409 /* HTMLTokenizer.h */,
+				A879C62311A9D1F70059237A /* HTMLTreeBuilder.cpp */,
+				A879C62411A9D1F70059237A /* HTMLTreeBuilder.h */,
 				A8EA79E70A1916DF00A8EF5F /* HTMLUListElement.cpp */,
 				A8EA79E60A1916DF00A8EF5F /* HTMLUListElement.h */,
 				1A85B1D50A1B236C00D8C87C /* HTMLUListElement.idl */,
@@ -13762,12 +13870,14 @@
 				B0149E7C11A4B21500196A7B /* ImageResizerThread.h */,
 				A456FA2411AD4A830020B420 /* LabelsNodeList.cpp */,
 				A456FA2511AD4A830020B420 /* LabelsNodeList.h */,
+				F523D25202DE4396018635CA /* LegacyHTMLDocumentParser.cpp */,
+				F523D25302DE4396018635CA /* LegacyHTMLDocumentParser.h */,
 				F523D25002DE4396018635CA /* LegacyHTMLTreeBuilder.cpp */,
 				F523D25102DE4396018635CA /* LegacyHTMLTreeBuilder.h */,
-				E446139B0CD6331000FADA75 /* MediaError.h */,
-				E446139C0CD6331000FADA75 /* MediaError.idl */,
 				E4D4ABE00D7542F000F96869 /* LegacyPreloadScanner.cpp */,
 				E4D4ABE10D7542F100F96869 /* LegacyPreloadScanner.h */,
+				E446139B0CD6331000FADA75 /* MediaError.h */,
+				E446139C0CD6331000FADA75 /* MediaError.idl */,
 				A5AFB34D115151A700B045CB /* StepRange.cpp */,
 				A5AFB34E115151A700B045CB /* StepRange.h */,
 				BCEF45E80E687767001C1287 /* TextMetrics.h */,
@@ -14128,6 +14238,8 @@
 				B2FA3C870AB75A6E000E5AC4 /* JSSVGFEComponentTransferElement.h */,
 				B2FA3C880AB75A6E000E5AC4 /* JSSVGFECompositeElement.cpp */,
 				B2FA3C890AB75A6E000E5AC4 /* JSSVGFECompositeElement.h */,
+				19BFF64911C0F2AC00B8C04D /* JSSVGFEConvolveMatrixElement.cpp */,
+				19BFF64A11C0F2AC00B8C04D /* JSSVGFEConvolveMatrixElement.h */,
 				B2FA3C8A0AB75A6E000E5AC4 /* JSSVGFEDiffuseLightingElement.cpp */,
 				B2FA3C8B0AB75A6E000E5AC4 /* JSSVGFEDiffuseLightingElement.h */,
 				B2FA3C8C0AB75A6E000E5AC4 /* JSSVGFEDisplacementMapElement.cpp */,
@@ -14437,6 +14549,8 @@
 				65DF31E409D1CC60000BE325 /* JSDOMImplementation.h */,
 				C5137CF011A58378004ADB99 /* JSDOMStringList.cpp */,
 				C5137CF111A58378004ADB99 /* JSDOMStringList.h */,
+				BC64649511D82349006455B0 /* JSDOMStringMap.cpp */,
+				BC64649611D82349006455B0 /* JSDOMStringMap.h */,
 				65DF31E509D1CC60000BE325 /* JSElement.cpp */,
 				65DF31E609D1CC60000BE325 /* JSElement.h */,
 				65DF322D09D1DDBC000BE325 /* JSEntity.cpp */,
@@ -14472,6 +14586,8 @@
 			children = (
 				BC946345107A934B00857193 /* JSBeforeLoadEvent.cpp */,
 				BC946347107A936600857193 /* JSBeforeLoadEvent.h */,
+				51721FD011D27EF200638B42 /* JSBeforeProcessEvent.cpp */,
+				51721FD111D27EF200638B42 /* JSBeforeProcessEvent.h */,
 				79AC9216109945C80021266E /* JSCompositionEvent.cpp */,
 				79AC9217109945C80021266E /* JSCompositionEvent.h */,
 				E4778B7D115A581A00B5D372 /* JSCustomEvent.cpp */,
@@ -14549,8 +14665,8 @@
 				C5F4F40F119306C000FDFADD /* JSIndexedDatabaseRequest.h */,
 				514C76350CE9225E007EF3CD /* JSSQLError.cpp */,
 				BC8243250D0CE8A200460C8F /* JSSQLError.h */,
-				B525A96311CA2340003A23A8 /* JSSQLException.h */,
 				B525A96411CA2340003A23A8 /* JSSQLException.cpp */,
+				B525A96311CA2340003A23A8 /* JSSQLException.h */,
 				1AE82FEA0CAB07EE002237AE /* JSSQLResultSet.cpp */,
 				1AE82FEB0CAB07EE002237AE /* JSSQLResultSet.h */,
 				1AFE11970CBFFCC4003017FA /* JSSQLResultSetRowList.cpp */,
@@ -14728,6 +14844,9 @@
 				B222783A0D00BF1F0071B782 /* SVGFECompositeElement.cpp */,
 				B222783B0D00BF1F0071B782 /* SVGFECompositeElement.h */,
 				B222783C0D00BF1F0071B782 /* SVGFECompositeElement.idl */,
+				1921327111C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp */,
+				1921327211C0E6BB00456238 /* SVGFEConvolveMatrixElement.h */,
+				1921327311C0E6BB00456238 /* SVGFEConvolveMatrixElement.idl */,
 				B222783D0D00BF1F0071B782 /* SVGFEDiffuseLightingElement.cpp */,
 				B222783E0D00BF1F0071B782 /* SVGFEDiffuseLightingElement.h */,
 				B222783F0D00BF1F0071B782 /* SVGFEDiffuseLightingElement.idl */,
@@ -15559,6 +15678,7 @@
 				49C7BA8C1042F5B10009D447 /* JSDocumentCustom.cpp */,
 				1AC226160DB69F740089B669 /* JSDOMApplicationCacheCustom.cpp */,
 				2E0888E5114884E200AF4265 /* JSDOMFormDataCustom.cpp */,
+				BC64649B11D8238C006455B0 /* JSDOMStringMapCustom.cpp */,
 				BCD9C25E0C17AA67005C90A2 /* JSDOMWindowCustom.cpp */,
 				652FBBBB0DE27CB60001D386 /* JSDOMWindowCustom.h */,
 				BC2ED5540C6B9BD300920BFF /* JSElementCustom.cpp */,
@@ -15578,7 +15698,6 @@
 				A8D065AD0A2446CD005E7203 /* JSHTMLFormElementCustom.cpp */,
 				BC2ED7A40C6C0F3600920BFF /* JSHTMLFrameElementCustom.cpp */,
 				BCD41ABA0C060DE800C0E446 /* JSHTMLFrameSetElementCustom.cpp */,
-				BC2ED64F0C6BC48C00920BFF /* JSHTMLIFrameElementCustom.cpp */,
 				BCC438770E886CC700533DD5 /* JSHTMLInputElementCustom.cpp */,
 				BC305CA30C0781BB00CD20F0 /* JSHTMLObjectElementCustom.cpp */,
 				448AD27A0A4813790023D179 /* JSHTMLOptionsCollectionCustom.cpp */,
@@ -15762,11 +15881,11 @@
 		BCB16BFB0979C38700467741 /* loader */ = {
 			isa = PBXGroup;
 			children = (
-				FABE72EC1059C1EB00D999DD /* mathml */,
 				1A8F6BB00DB55CDC001DB794 /* appcache */,
 				512DD8E80D91E691000F89EE /* archive */,
 				5126E6B60A2E3AEF005C29FA /* icon */,
 				93A1EAA20A5634D8006960A0 /* mac */,
+				FABE72EC1059C1EB00D999DD /* mathml */,
 				BCB16BFE0979C3BD00467741 /* Cache.cpp */,
 				BCB16BFF0979C3BD00467741 /* Cache.h */,
 				BCB16C000979C3BD00467741 /* CachedCSSStyleSheet.cpp */,
@@ -15805,8 +15924,8 @@
 				B255990D0D00D8B900BB825C /* EmptyClients.h */,
 				656D37230ADBA5DE00A4554D /* FormState.cpp */,
 				656D37220ADBA5DE00A4554D /* FormState.h */,
-				41885B9111B6FDA6003383BB /* FormSubmission.h */,
 				41885B9211B6FDA6003383BB /* FormSubmission.cpp */,
+				41885B9111B6FDA6003383BB /* FormSubmission.h */,
 				932E16080AF578340025F408 /* FrameLoader.cpp */,
 				656D37240ADBA5DE00A4554D /* FrameLoader.h */,
 				656D37260ADBA5DE00A4554D /* FrameLoaderClient.h */,
@@ -16389,6 +16508,8 @@
 				ABFE7E100D32FAF50066F4D2 /* MediaControlElements.cpp */,
 				ABFE7E110D32FAF50066F4D2 /* MediaControlElements.h */,
 				3774ABA30FA21EB400AD7DE9 /* OverlapTestRequestClient.h */,
+				0885067D11DA045B00182B98 /* PaintInfo.h */,
+				0885067E11DA045B00182B98 /* PaintPhase.h */,
 				B2B1F7140D00CAA8004AEA64 /* PointerEventsHitRules.cpp */,
 				B2B1F7150D00CAA8004AEA64 /* PointerEventsHitRules.h */,
 				BCEA481C097D93020094C9E4 /* RenderApplet.cpp */,
@@ -16438,6 +16559,8 @@
 				A7AA66D511C5ED6A001D8C8C /* RenderIndicator.h */,
 				BCEA4838097D93020094C9E4 /* RenderInline.cpp */,
 				BCEA4839097D93020094C9E4 /* RenderInline.h */,
+				750D029111D0E7F300BD1B27 /* RenderInputSpeech.cpp */,
+				750D029211D0E7F300BD1B27 /* RenderInputSpeech.h */,
 				BCEA483A097D93020094C9E4 /* RenderLayer.cpp */,
 				BCEA483B097D93020094C9E4 /* RenderLayer.h */,
 				0F580CFC0F12DE9B0051D689 /* RenderLayerBacking.cpp */,
@@ -16623,7 +16746,6 @@
 		F523D32402DE4478018635CA /* dom */ = {
 			isa = PBXGroup;
 			children = (
-				A84D827B11D333ED00972990 /* RawDataDocumentParser.h */,
 				E1C4DE6D0EA75C650023CCD6 /* ActiveDOMObject.cpp */,
 				E1C4DE680EA75C1E0023CCD6 /* ActiveDOMObject.h */,
 				A8C4A7FC09D563270003AC8D /* Attr.cpp */,
@@ -16633,6 +16755,9 @@
 				A8C4A7F909D563270003AC8D /* Attribute.h */,
 				BC9462D7107A7B4C00857193 /* BeforeLoadEvent.h */,
 				BC9462CB107A7A3900857193 /* BeforeLoadEvent.idl */,
+				5172204A11D2960500638B42 /* BeforeProcessEvent.cpp */,
+				51721FB911D2790700638B42 /* BeforeProcessEvent.h */,
+				51721FBA11D2790700638B42 /* BeforeProcessEvent.idl */,
 				AB23A32509BBA7D00067CC53 /* BeforeTextInsertedEvent.cpp */,
 				AB23A32609BBA7D00067CC53 /* BeforeTextInsertedEvent.h */,
 				85031B260A44EFC700F992E0 /* BeforeUnloadEvent.cpp */,
@@ -16678,6 +16803,10 @@
 				62CD32561157E57C0063B0A7 /* CustomEvent.cpp */,
 				62CD32571157E57C0063B0A7 /* CustomEvent.h */,
 				62CD32581157E57C0063B0A7 /* CustomEvent.idl */,
+				BC64641B11D7F416006455B0 /* DatasetDOMStringMap.cpp */,
+				BC64641A11D7F416006455B0 /* DatasetDOMStringMap.h */,
+				A8C228A011D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp */,
+				A8C2289F11D5722E00D5A7D3 /* DecodedDataDocumentParser.h */,
 				59A8F1D311A69508001AC34A /* DeviceOrientation.cpp */,
 				59A8F1D511A69513001AC34A /* DeviceOrientation.h */,
 				59A8F1D711A69520001AC34A /* DeviceOrientationClient.h */,
@@ -16691,6 +16820,7 @@
 				A8185F3509765765005826D9 /* DocumentFragment.h */,
 				1A494ED50A123F1A00FDAFC1 /* DocumentFragment.idl */,
 				ED2BA83B09A24B91006C0AC4 /* DocumentMarker.h */,
+				A8C2280D11D4A59700D5A7D3 /* DocumentParser.cpp */,
 				BCCFBAE70B5152ED0001F1D7 /* DocumentParser.h */,
 				A8185F3209765765005826D9 /* DocumentType.cpp */,
 				A8185F3109765765005826D9 /* DocumentType.h */,
@@ -16703,6 +16833,9 @@
 				C55610F011A704EB00B82D27 /* DOMStringList.cpp */,
 				C544274911A57E7A0063A749 /* DOMStringList.h */,
 				C544274A11A57E7A0063A749 /* DOMStringList.idl */,
+				BC64640711D7F304006455B0 /* DOMStringMap.cpp */,
+				BC64640811D7F304006455B0 /* DOMStringMap.h */,
+				BC64647911D800CD006455B0 /* DOMStringMap.idl */,
 				BC7FA61E0D1F0CBD00DB22A9 /* DynamicNodeList.cpp */,
 				BC7FA61F0D1F0CBD00DB22A9 /* DynamicNodeList.h */,
 				6550B699099DF0270090D781 /* EditingText.cpp */,
@@ -16736,6 +16869,7 @@
 				BC60D8F10D2A11E000B9918F /* ExceptionBase.h */,
 				93831B560D087D6000E5C984 /* ExceptionCode.cpp */,
 				935FBCF109BA143B00E230B1 /* ExceptionCode.h */,
+				A853123C11D0471B00D4D077 /* FragmentScriptingPermission.h */,
 				08700BE60F086C5300919419 /* InputElement.cpp */,
 				08591AA40F085C4E009BACB1 /* InputElement.h */,
 				85031B2D0A44EFC700F992E0 /* KeyboardEvent.cpp */,
@@ -16818,8 +16952,11 @@
 				93D9D53B0DA27E180077216C /* RangeBoundaryPoint.h */,
 				D23CA56B0AB0EB8D005108A5 /* RangeException.h */,
 				D23CA5480AB0E983005108A5 /* RangeException.idl */,
+				A84D827B11D333ED00972990 /* RawDataDocumentParser.h */,
 				85031B350A44EFC700F992E0 /* RegisteredEventListener.cpp */,
 				85031B360A44EFC700F992E0 /* RegisteredEventListener.h */,
+				A84D82C011D3474800972990 /* ScriptableDocumentParser.cpp */,
+				A84D82BF11D3474800972990 /* ScriptableDocumentParser.h */,
 				08A484750E5272C500C3FE76 /* ScriptElement.cpp */,
 				08A484760E5272C500C3FE76 /* ScriptElement.h */,
 				E11C9DAF0EB3699500E409DB /* ScriptExecutionContext.cpp */,
@@ -16877,7 +17014,6 @@
 				54C50F7A0E801DF3009832A0 /* XMLDocumentParserLibxml2.cpp */,
 				5D15E3A90F9E6AC1009E0E3F /* XMLDocumentParserScope.cpp */,
 				5D15E3AA0F9E6AC1009E0E3F /* XMLDocumentParserScope.h */,
-				A853123C11D0471B00D4D077 /* FragmentScriptingPermission.h */,
 			);
 			path = dom;
 			sourceTree = "<group>";
@@ -16988,6 +17124,7 @@
 				BC124EE80C2641CD009E2349 /* BarInfo.h in Headers */,
 				B2C3DA220D006C1D00EF6F26 /* Base64.h in Headers */,
 				BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */,
+				51721FBB11D2790700638B42 /* BeforeProcessEvent.h in Headers */,
 				AB23A32809BBA7D00067CC53 /* BeforeTextInsertedEvent.h in Headers */,
 				85031B3D0A44EFC700F992E0 /* BeforeUnloadEvent.h in Headers */,
 				B2C3DA240D006C1D00EF6F26 /* BidiContext.h in Headers */,
@@ -17040,6 +17177,7 @@
 				6550B6A0099DF0270090D781 /* CharacterData.h in Headers */,
 				B2C3DA260D006C1D00EF6F26 /* CharacterNames.h in Headers */,
 				B2C3DA2A0D006C1D00EF6F26 /* CharsetData.h in Headers */,
+				A00B721A11DE6428008AB9FF /* CheckedInt.h in Headers */,
 				93F925430F7EF5B8007E37C9 /* CheckedRadioButtons.h in Headers */,
 				A81872200977D3C0005826D9 /* ChildNodeList.h in Headers */,
 				14D823520AF92A790004F057 /* Chrome.h in Headers */,
@@ -17164,7 +17302,9 @@
 				BC77CFAC0FF173D30070887B /* DataGridColumnList.h in Headers */,
 				BCBCAE370FF19385000762AE /* DataGridDataSource.h in Headers */,
 				BC22746F0E83664500E7F975 /* DataRef.h in Headers */,
+				BC64641C11D7F416006455B0 /* DatasetDOMStringMap.h in Headers */,
 				F5D3A57D106B83B300545297 /* DateComponents.h in Headers */,
+				A8C228A111D5722E00D5A7D3 /* DecodedDataDocumentParser.h in Headers */,
 				4162A451101145AE00DFF3ED /* DedicatedWorkerContext.h in Headers */,
 				41A3D58F101C152D00316D07 /* DedicatedWorkerThread.h in Headers */,
 				4167EBF6102962BA003D252A /* DefaultSharedWorkerRepository.h in Headers */,
@@ -17442,6 +17582,7 @@
 				BCD0FC4F0DBD720B00B2F630 /* DOMRGBColorInternal.h in Headers */,
 				BC5A86850C33676000EEA649 /* DOMSelection.h in Headers */,
 				C544274B11A57E7A0063A749 /* DOMStringList.h in Headers */,
+				BC64640A11D7F304006455B0 /* DOMStringMap.h in Headers */,
 				0FF5025B102BA9010066F39A /* DOMStyleMedia.h in Headers */,
 				0FF50263102BA92C0066F39A /* DOMStyleMediaInternal.h in Headers */,
 				850657000AAB4763002D15C0 /* DOMStyleSheet.h in Headers */,
@@ -17568,6 +17709,8 @@
 				8502AB460AD438C000378540 /* DOMSVGFECompositeElement.h in Headers */,
 				8502AB910AD4394E00378540 /* DOMSVGFECompositeElementInternal.h in Headers */,
 				A8E5457D0CA9D1C20097D09B /* DOMSVGFECompositeElementInternal.h in Headers */,
+				19BFF64B11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.h in Headers */,
+				19BFF64D11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElementInternal.h in Headers */,
 				8502AB480AD438C000378540 /* DOMSVGFEDiffuseLightingElement.h in Headers */,
 				A8D0C5E10CCB459800B2CDD4 /* DOMSVGFEDiffuseLightingElement.h in Headers */,
 				8502AB920AD4394E00378540 /* DOMSVGFEDiffuseLightingElementInternal.h in Headers */,
@@ -18018,9 +18161,11 @@
 				656D373A0ADBA5DE00A4554D /* FormState.h in Headers */,
 				41885B9311B6FDA6003383BB /* FormSubmission.h in Headers */,
 				935C476D09AC4D6300A6AAB4 /* FoundationExtras.h in Headers */,
+				A853123D11D0471B00D4D077 /* FragmentScriptingPermission.h in Headers */,
 				65BF022F0974816300C43196 /* Frame.h in Headers */,
 				656D373C0ADBA5DE00A4554D /* FrameLoader.h in Headers */,
 				656D373E0ADBA5DE00A4554D /* FrameLoaderClient.h in Headers */,
+				D000EBA311BDAFD400C47726 /* FrameLoaderStateMachine.h in Headers */,
 				93B77A380ADD792500EA4B81 /* FrameLoaderTypes.h in Headers */,
 				658436860AE01B7400E53753 /* FrameLoadRequest.h in Headers */,
 				65A21485097A3F5300B9050A /* FrameTree.h in Headers */,
@@ -18060,14 +18205,6 @@
 				930908910AF7EDE40081DF01 /* HitTestRequest.h in Headers */,
 				9307F1D80AF2D59000DBA31A /* HitTestResult.h in Headers */,
 				BC3BC29C0E91AB0F00835588 /* HostWindow.h in Headers */,
-				A871038B11A2947000DBD50E /* HTMLDocumentParser.h in Headers */,
-				976E896111C0CA3A00EA9CA9 /* HTMLEntityParser.h in Headers */,
-				97E8B35711A23CE200169409 /* HTMLTokenizer.h in Headers */,
-				97E7936611C6030900E649BC /* HTMLPreloadScanner.h in Headers */,
-				A83B3AF111ADEFF500458809 /* HTMLScriptRunner.h in Headers */,
-				A87F163511AE841300CBB2E5 /* HTMLScriptRunnerHost.h in Headers */,
-				97E8B3C311A2890800169409 /* HTMLToken.h in Headers */,
-				A879C62611A9D1F70059237A /* HTMLTreeBuilder.h in Headers */,
 				BC97E23A109144950010D361 /* HTMLAllCollection.h in Headers */,
 				A8CFF7AB0A156978000A4234 /* HTMLAnchorElement.h in Headers */,
 				A871D45D0A127CBC00B12A68 /* HTMLAppletElement.h in Headers */,
@@ -18090,13 +18227,16 @@
 				A8EA7CB70A192B9C00A8EF5F /* HTMLDivElement.h in Headers */,
 				A8EA79F70A1916DF00A8EF5F /* HTMLDListElement.h in Headers */,
 				93F198E508245E59001E9ABC /* HTMLDocument.h in Headers */,
-				93F198F008245E59001E9ABC /* LegacyHTMLDocumentParser.h in Headers */,
+				A871038B11A2947000DBD50E /* HTMLDocumentParser.h in Headers */,
 				93309DE8099E64920056E581 /* htmlediting.h in Headers */,
 				93F198E608245E59001E9ABC /* HTMLElement.h in Headers */,
 				A17C81230F2A5CF7005DAAEB /* HTMLElementFactory.h in Headers */,
+				A8A563B411DB3D10003AC2F0 /* HTMLElementStack.h in Headers */,
 				A871D45C0A127CBC00B12A68 /* HTMLEmbedElement.h in Headers */,
+				976E896111C0CA3A00EA9CA9 /* HTMLEntityParser.h in Headers */,
 				A81369D4097374F600D74463 /* HTMLFieldSetElement.h in Headers */,
 				A8CFF7A60A156978000A4234 /* HTMLFontElement.h in Headers */,
+				A8A564A511DC0E59003AC2F0 /* HTMLFormattingElementList.h in Headers */,
 				A8DF3FCE097FA0FC0052981B /* HTMLFormCollection.h in Headers */,
 				A81369CE097374F600D74463 /* HTMLFormControlElement.h in Headers */,
 				A81369D0097374F600D74463 /* HTMLFormElement.h in Headers */,
@@ -18112,6 +18252,7 @@
 				A8EA7D2D0A19385500A8EF5F /* HTMLImageElement.h in Headers */,
 				A8EA7D2B0A19385500A8EF5F /* HTMLImageLoader.h in Headers */,
 				A81369CC097374F600D74463 /* HTMLInputElement.h in Headers */,
+				9719AF0011D09F2C00D45831 /* HTMLInputStream.h in Headers */,
 				93309DE6099E64920056E581 /* HTMLInterchange.h in Headers */,
 				A81369CA097374F600D74463 /* HTMLIsIndexElement.h in Headers */,
 				A81369E4097374F600D74463 /* HTMLKeygenElement.h in Headers */,
@@ -18137,12 +18278,16 @@
 				A871D4580A127CBC00B12A68 /* HTMLParamElement.h in Headers */,
 				BC588AF00BFA6CF900EE679E /* HTMLParserErrorCodes.h in Headers */,
 				449B19F50FA72ECE0015CA4A /* HTMLParserQuirks.h in Headers */,
+				A8E6A78111D1661B00311F4A /* HTMLParserScheduler.h in Headers */,
 				A871D4560A127CBC00B12A68 /* HTMLPlugInElement.h in Headers */,
 				4415292E0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.h in Headers */,
 				A8EA7CB00A192B9C00A8EF5F /* HTMLPreElement.h in Headers */,
+				97E7936611C6030900E649BC /* HTMLPreloadScanner.h in Headers */,
 				A43BF5991149290A00C643CA /* HTMLProgressElement.h in Headers */,
 				A8CFF7A30A156978000A4234 /* HTMLQuoteElement.h in Headers */,
 				A871DC250A15205700B12A68 /* HTMLScriptElement.h in Headers */,
+				A83B3AF111ADEFF500458809 /* HTMLScriptRunner.h in Headers */,
+				A87F163511AE841300CBB2E5 /* HTMLScriptRunnerHost.h in Headers */,
 				A81369D8097374F600D74463 /* HTMLSelectElement.h in Headers */,
 				E44613A80CD6331000FADA75 /* HTMLSourceElement.h in Headers */,
 				A871DC230A15205700B12A68 /* HTMLStyleElement.h in Headers */,
@@ -18156,6 +18301,9 @@
 				A871DB250A150BD600B12A68 /* HTMLTableSectionElement.h in Headers */,
 				A81369D6097374F600D74463 /* HTMLTextAreaElement.h in Headers */,
 				A871DC280A15205700B12A68 /* HTMLTitleElement.h in Headers */,
+				97E8B3C311A2890800169409 /* HTMLToken.h in Headers */,
+				97E8B35711A23CE200169409 /* HTMLTokenizer.h in Headers */,
+				A879C62611A9D1F70059237A /* HTMLTreeBuilder.h in Headers */,
 				A8EA79F20A1916DF00A8EF5F /* HTMLUListElement.h in Headers */,
 				E44613AB0CD6331000FADA75 /* HTMLVideoElement.h in Headers */,
 				BCCD74DC0A4C8D35005FDA6D /* HTMLViewSourceDocument.h in Headers */,
@@ -18265,6 +18413,7 @@
 				E4EEFFC90D34550C00469A58 /* JSAudioConstructor.h in Headers */,
 				BC124F000C26447A009E2349 /* JSBarInfo.h in Headers */,
 				BC946348107A936600857193 /* JSBeforeLoadEvent.h in Headers */,
+				51721FD311D27EF200638B42 /* JSBeforeProcessEvent.h in Headers */,
 				2E2D99CE10E2BBDA00496337 /* JSBlob.h in Headers */,
 				89CD029411C85B870070B791 /* JSBlobBuilder.h in Headers */,
 				1449E24C107D4A8400B5793F /* JSCallbackData.h in Headers */,
@@ -18323,6 +18472,7 @@
 				1ACE53E00A8D18810022947D /* JSDOMParser.h in Headers */,
 				BC5A86B60C3367E800EEA649 /* JSDOMSelection.h in Headers */,
 				C5137CF311A58378004ADB99 /* JSDOMStringList.h in Headers */,
+				BC64649811D82349006455B0 /* JSDOMStringMap.h in Headers */,
 				BC6932740D7E293900AE44D1 /* JSDOMWindowBase.h in Headers */,
 				652FBBBC0DE27CB60001D386 /* JSDOMWindowCustom.h in Headers */,
 				BCBFB53D0DCD29CF0019B3E5 /* JSDOMWindowShell.h in Headers */,
@@ -18486,6 +18636,7 @@
 				41D07A7F0FF935CA0095EDCE /* JSSharedWorker.h in Headers */,
 				41D1690610238B66009BC827 /* JSSharedWorkerContext.h in Headers */,
 				BC8243290D0CE8A200460C8F /* JSSQLError.h in Headers */,
+				B525A96511CA2340003A23A8 /* JSSQLException.h in Headers */,
 				1AE82FED0CAB07EE002237AE /* JSSQLResultSet.h in Headers */,
 				1AFE119A0CBFFCC4003017FA /* JSSQLResultSetRowList.h in Headers */,
 				B59DD6A511902A62007E9684 /* JSSQLStatementCallback.h in Headers */,
@@ -18537,6 +18688,7 @@
 				B2FA3D6D0AB75A6F000E5AC4 /* JSSVGFEColorMatrixElement.h in Headers */,
 				B2FA3D6F0AB75A6F000E5AC4 /* JSSVGFEComponentTransferElement.h in Headers */,
 				B2FA3D710AB75A6F000E5AC4 /* JSSVGFECompositeElement.h in Headers */,
+				19BFF64F11C0F2AC00B8C04D /* JSSVGFEConvolveMatrixElement.h in Headers */,
 				B2FA3D730AB75A6F000E5AC4 /* JSSVGFEDiffuseLightingElement.h in Headers */,
 				B2FA3D750AB75A6F000E5AC4 /* JSSVGFEDisplacementMapElement.h in Headers */,
 				B2FA3D770AB75A6F000E5AC4 /* JSSVGFEDistantLightElement.h in Headers */,
@@ -18694,7 +18846,9 @@
 				A456FA2711AD4A830020B420 /* LabelsNodeList.h in Headers */,
 				85EC9AFB0A71A2C600EEEAED /* Language.h in Headers */,
 				2D9066070BE141D400956998 /* LayoutState.h in Headers */,
+				93F198F008245E59001E9ABC /* LegacyHTMLDocumentParser.h in Headers */,
 				93F198EF08245E59001E9ABC /* LegacyHTMLTreeBuilder.h in Headers */,
+				E49626C30D80D94900E3405C /* LegacyPreloadScanner.h in Headers */,
 				512DD8F50D91E6AF000F89EE /* LegacyWebArchive.h in Headers */,
 				BCE65BEB0EACDF16007E4533 /* Length.h in Headers */,
 				BCFF64910EAD15C200C1D6F7 /* LengthBox.h in Headers */,
@@ -18750,6 +18904,7 @@
 				A81872230977D3C0005826D9 /* NamedNodeMap.h in Headers */,
 				A818721E0977D3C0005826D9 /* NameNodeList.h in Headers */,
 				E10B9B6C0B747599003ED890 /* NativeXPathNSResolver.h in Headers */,
+				8AF4E55611DC5A36000ED3DE /* Navigation.h in Headers */,
 				93CCF0270AF6C52900018E89 /* NavigationAction.h in Headers */,
 				A9C6E5A60D746458006442E9 /* Navigator.h in Headers */,
 				E12719C70EEEC16800F61213 /* NavigatorBase.h in Headers */,
@@ -18799,6 +18954,8 @@
 				7A674BDC0F9EBF4E006CF099 /* PageGroupLoadDeferrer.h in Headers */,
 				E1284AE110447D4500EAEB52 /* PageTransitionEvent.h in Headers */,
 				51E1ECC30C91C90400DC255B /* PageURLRecord.h in Headers */,
+				0885067F11DA045B00182B98 /* PaintInfo.h in Headers */,
+				0885068011DA045B00182B98 /* PaintPhase.h in Headers */,
 				A80E6CFB0A1989CA007FB8C5 /* Pair.h in Headers */,
 				BC76AC130DD7AD5C00415F34 /* ParserUtilities.h in Headers */,
 				4B2708C70AF19EE40065127F /* Pasteboard.h in Headers */,
@@ -18809,6 +18966,7 @@
 				B22279710D00BF220071B782 /* PatternAttributes.h in Headers */,
 				B27535650B053814002CE64F /* PDFDocumentImage.h in Headers */,
 				B27535820B053814002CE64F /* Pen.h in Headers */,
+				8A844D0511D3C18E0014065C /* Performance.h in Headers */,
 				49D5DC2E0F423A73008F20FD /* PerspectiveTransformOperation.h in Headers */,
 				377C4CDF1014E9F600B9AE42 /* PlaceholderDocument.h in Headers */,
 				935C476809AC4D4300A6AAB4 /* PlatformKeyboardEvent.h in Headers */,
@@ -18816,6 +18974,7 @@
 				41BF70100FE86F61005E8DEC /* PlatformMessagePortChannel.h in Headers */,
 				935C476909AC4D4300A6AAB4 /* PlatformMouseEvent.h in Headers */,
 				BCEC01D70C274EB4009F4EC9 /* PlatformScreen.h in Headers */,
+				1AD8F81B11CAB9E900E93E54 /* PlatformStrategies.h in Headers */,
 				B2C3DA2B0D006C1D00EF6F26 /* PlatformString.h in Headers */,
 				935C476B09AC4D4F00A6AAB4 /* PlatformWheelEvent.h in Headers */,
 				A9C6E4EC0D745E2B006442E9 /* Plugin.h in Headers */,
@@ -18825,6 +18984,7 @@
 				7693BAD4106C2DCA007B0823 /* PluginHalter.h in Headers */,
 				7693BAD5106C2DCA007B0823 /* PluginHalterClient.h in Headers */,
 				1ADA14110E1AE5D900023EE5 /* PluginMainThreadScheduler.h in Headers */,
+				1AA8799011CBE846003C664F /* PluginStrategy.h in Headers */,
 				0AFDAC3D10F5448C00E1F3D2 /* PluginWidget.h in Headers */,
 				B2B1F7170D00CAA8004AEA64 /* PointerEventsHitRules.h in Headers */,
 				97059978107D975200A50A7C /* PolicyCallback.h in Headers */,
@@ -18839,7 +18999,6 @@
 				FE80D7CF0E9C1F25000D6F75 /* PositionErrorCallback.h in Headers */,
 				37919C240B7D188600A56998 /* PositionIterator.h in Headers */,
 				FE80D7D10E9C1F25000D6F75 /* PositionOptions.h in Headers */,
-				E49626C30D80D94900E3405C /* LegacyPreloadScanner.h in Headers */,
 				B71FE6DF11091CB300DAEF77 /* PrintContext.h in Headers */,
 				A8EA7EBC0A1945D000A8EF5F /* ProcessingInstruction.h in Headers */,
 				E44613EC0CD681B500FADA75 /* ProgressEvent.h in Headers */,
@@ -18852,6 +19011,7 @@
 				93F1991808245E59001E9ABC /* Range.h in Headers */,
 				93D9D53C0DA27E180077216C /* RangeBoundaryPoint.h in Headers */,
 				D23CA56C0AB0EB8D005108A5 /* RangeException.h in Headers */,
+				A84D827C11D333ED00972990 /* RawDataDocumentParser.h in Headers */,
 				BC4368E80C226E32005EFB5F /* Rect.h in Headers */,
 				979F43D41075E44A0000F83B /* RedirectScheduler.h in Headers */,
 				85031B4C0A44EFC700F992E0 /* RegisteredEventListener.h in Headers */,
@@ -18883,6 +19043,7 @@
 				BCB4F8900DB28DD60039139B /* RenderImageGeneratedContent.h in Headers */,
 				A7AA66D711C5ED6A001D8C8C /* RenderIndicator.h in Headers */,
 				BCEA4878097D93020094C9E4 /* RenderInline.h in Headers */,
+				750D029411D0E7F300BD1B27 /* RenderInputSpeech.h in Headers */,
 				BCEA487A097D93020094C9E4 /* RenderLayer.h in Headers */,
 				0F580CFF0F12DE9B0051D689 /* RenderLayerBacking.h in Headers */,
 				0F580CFD0F12DE9B0051D689 /* RenderLayerCompositor.h in Headers */,
@@ -18975,6 +19136,7 @@
 				514C767B0CE923A1007EF3CD /* ResourceHandleInternal.h in Headers */,
 				656D373F0ADBA5DE00A4554D /* ResourceLoader.h in Headers */,
 				973E325710883B7C005BC493 /* ResourceLoadNotifier.h in Headers */,
+				8A81BF8511DCFD9000DA2B98 /* ResourceLoadTiming.h in Headers */,
 				514C76520CE9234E007EF3CD /* ResourceRequest.h in Headers */,
 				514C767D0CE923A1007EF3CD /* ResourceRequestBase.h in Headers */,
 				514C76540CE9234E007EF3CD /* ResourceResponse.h in Headers */,
@@ -18992,6 +19154,7 @@
 				5DFE8F570D16477C0076E937 /* ScheduledAction.h in Headers */,
 				1CEFC9B90D78DC8C007D2579 /* SchedulePair.h in Headers */,
 				BCEC01BE0C274DAC009F4EC9 /* Screen.h in Headers */,
+				A84D82C111D3474800972990 /* ScriptableDocumentParser.h in Headers */,
 				7A1E88F6101CC384000C4DF5 /* ScriptArray.h in Headers */,
 				7AFD4A8B1131C2760035B883 /* ScriptBreakpoint.h in Headers */,
 				41F1D21F0EF35C2A00DA8753 /* ScriptCachedFrameData.h in Headers */,
@@ -19067,6 +19230,7 @@
 				93309E14099E64920056E581 /* SplitTextNodeCommand.h in Headers */,
 				93309E16099E64920056E581 /* SplitTextNodeContainingElementCommand.h in Headers */,
 				51EC92590CE90DB400F90308 /* SQLError.h in Headers */,
+				B56EBA8511C9FF8100B04477 /* SQLException.h in Headers */,
 				1A22464A0CC98DDB00C05240 /* SQLiteDatabase.h in Headers */,
 				B5A684220FFABE9800D24689 /* SQLiteFileSystem.h in Headers */,
 				1A22464C0CC98DDB00C05240 /* SQLiteStatement.h in Headers */,
@@ -19085,6 +19249,7 @@
 				B523CF061182675400EBB29C /* SQLTransactionSyncCallback.h in Headers */,
 				1A2E6E5A0CC55213004A2062 /* SQLValue.h in Headers */,
 				93F1996308245E59001E9ABC /* SSLKeyGenerator.h in Headers */,
+				CEA3949D11D45CDA003094CF /* StaticHashSetNodeList.h in Headers */,
 				BC7FA62D0D1F0EFF00DB22A9 /* StaticNodeList.h in Headers */,
 				A5AFB350115151A700B045CB /* StepRange.h in Headers */,
 				51BE37E00DAEE00E001085FC /* StorageArea.h in Headers */,
@@ -19126,6 +19291,7 @@
 				BC5EB5E50E81BF6D00B25965 /* StyleSurroundData.h in Headers */,
 				BC5EB8100E81F2CE00B25965 /* StyleTransformData.h in Headers */,
 				BC5EB69A0E81DA6300B25965 /* StyleVisualData.h in Headers */,
+				D000ED2811C1B9CD00C47726 /* SubframeLoader.h in Headers */,
 				656D37480ADBA5DE00A4554D /* SubresourceLoader.h in Headers */,
 				1A3178930B20A81600316987 /* SubresourceLoaderClient.h in Headers */,
 				659A7D130B6DB4D9001155B3 /* SubstituteData.h in Headers */,
@@ -19172,6 +19338,7 @@
 				B22279CE0D00BF220071B782 /* SVGFEComponentTransferElement.h in Headers */,
 				B22279D10D00BF220071B782 /* SVGFECompositeElement.h in Headers */,
 				B255997B0D00D8BA00BB825C /* SVGFEConvolveMatrix.h in Headers */,
+				1921327511C0E6BB00456238 /* SVGFEConvolveMatrixElement.h in Headers */,
 				B255997D0D00D8BA00BB825C /* SVGFEDiffuseLighting.h in Headers */,
 				B22279D40D00BF220071B782 /* SVGFEDiffuseLightingElement.h in Headers */,
 				B255997F0D00D8BA00BB825C /* SVGFEDisplacementMap.h in Headers */,
@@ -19352,6 +19519,7 @@
 				7553CFE8108F473F00EA281E /* TimelineRecordFactory.h in Headers */,
 				9305B24D098F1B6B00C28855 /* Timer.h in Headers */,
 				E44613B00CD6331000FADA75 /* TimeRanges.h in Headers */,
+				8AF4E55C11DC5A63000ED3DE /* Timing.h in Headers */,
 				49E912AE0EFAC906009D0CAF /* TimingFunction.h in Headers */,
 				49E911C40EF86D47009D0CAF /* TransformationMatrix.h in Headers */,
 				49E911CE0EF86D47009D0CAF /* TransformOperation.h in Headers */,
@@ -19526,17 +19694,6 @@
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				97DD4D870FDF4D6E00ECF9A4 /* XSSAuditor.h in Headers */,
 				CE172E011136E8CE0062A533 /* ZoomMode.h in Headers */,
-				D000EBA311BDAFD400C47726 /* FrameLoaderStateMachine.h in Headers */,
-				D000ED2811C1B9CD00C47726 /* SubframeLoader.h in Headers */,
-				1AD8F81B11CAB9E900E93E54 /* PlatformStrategies.h in Headers */,
-				1AA8799011CBE846003C664F /* PluginStrategy.h in Headers */,
-				B56EBA8511C9FF8100B04477 /* SQLException.h in Headers */,
-				B525A96511CA2340003A23A8 /* JSSQLException.h in Headers */,
-				9719AF0011D09F2C00D45831 /* HTMLInputStream.h in Headers */,
-				A853123D11D0471B00D4D077 /* FragmentScriptingPermission.h in Headers */,
-				A8E6A78111D1661B00311F4A /* HTMLParserScheduler.h in Headers */,
-				A84D827C11D333ED00972990 /* RawDataDocumentParser.h in Headers */,
-				CEA3949D11D45CDA003094CF /* StaticHashSetNodeList.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -19615,6 +19772,7 @@
 				85136C990AED665900F90A3D /* eastResizeCursor.png in Resources */,
 				85136C9A0AED665900F90A3D /* eastWestResizeCursor.png in Resources */,
 				85136C9B0AED665900F90A3D /* helpCursor.png in Resources */,
+				750D02C111D0EE7D00BD1B27 /* inputSpeech.tiff in Resources */,
 				85136C9C0AED665900F90A3D /* linkCursor.png in Resources */,
 				1CDC14050DD3934C006EACD3 /* localizedStrings.js in Resources */,
 				AB4261D80A2F6C9700BDD17D /* missingImage.tiff in Resources */,
@@ -19844,6 +20002,7 @@
 				51741D100B07259A00ED442C /* BackForwardList.cpp in Sources */,
 				BC124EE70C2641CD009E2349 /* BarInfo.cpp in Sources */,
 				B2C3DA210D006C1D00EF6F26 /* Base64.cpp in Sources */,
+				5172204B11D2960500638B42 /* BeforeProcessEvent.cpp in Sources */,
 				AB23A32709BBA7D00067CC53 /* BeforeTextInsertedEvent.cpp in Sources */,
 				85031B3C0A44EFC700F992E0 /* BeforeUnloadEvent.cpp in Sources */,
 				B2C3DA230D006C1D00EF6F26 /* BidiContext.cpp in Sources */,
@@ -19986,7 +20145,9 @@
 				1AD51A150CB59CD300953D11 /* DatabaseTracker.cpp in Sources */,
 				BC77D2390FF298080070887B /* DataGridColumn.cpp in Sources */,
 				BC77D1FD0FF28D9B0070887B /* DataGridColumnList.cpp in Sources */,
+				BC64641D11D7F416006455B0 /* DatasetDOMStringMap.cpp in Sources */,
 				F5D3A57C106B83B300545297 /* DateComponents.cpp in Sources */,
+				A8C228A211D5722E00D5A7D3 /* DecodedDataDocumentParser.cpp in Sources */,
 				4162A450101145AE00DFF3ED /* DedicatedWorkerContext.cpp in Sources */,
 				41A3D58E101C152D00316D07 /* DedicatedWorkerThread.cpp in Sources */,
 				4167EBF5102962BA003D252A /* DefaultSharedWorkerRepository.cpp in Sources */,
@@ -20003,6 +20164,7 @@
 				A8185F3F09765766005826D9 /* DocumentFragment.cpp in Sources */,
 				93E227E00AF589AD00D48324 /* DocumentLoader.cpp in Sources */,
 				1C26497A0D7E248A00BD10F2 /* DocumentLoaderMac.cpp in Sources */,
+				A8C2280E11D4A59700D5A7D3 /* DocumentParser.cpp in Sources */,
 				0B9056190F2578BE0095FF6A /* DocumentThreadableLoader.cpp in Sources */,
 				A8185F3A09765766005826D9 /* DocumentType.cpp in Sources */,
 				973889A0116EA9DC00ADF313 /* DocumentWriter.cpp in Sources */,
@@ -20136,6 +20298,7 @@
 				BCAEFCAE1016CE4A0040D34E /* DOMRGBColor.mm in Sources */,
 				BC5A86840C33676000EEA649 /* DOMSelection.cpp in Sources */,
 				C55610F111A704EB00B82D27 /* DOMStringList.cpp in Sources */,
+				BC64640911D7F304006455B0 /* DOMStringMap.cpp in Sources */,
 				0FF5025C102BA9010066F39A /* DOMStyleMedia.mm in Sources */,
 				850657010AAB4763002D15C0 /* DOMStyleSheet.mm in Sources */,
 				850657030AAB4763002D15C0 /* DOMStyleSheetList.mm in Sources */,
@@ -20174,6 +20337,7 @@
 				8502AB430AD438C000378540 /* DOMSVGFEColorMatrixElement.mm in Sources */,
 				8502AB450AD438C000378540 /* DOMSVGFEComponentTransferElement.mm in Sources */,
 				8502AB470AD438C000378540 /* DOMSVGFECompositeElement.mm in Sources */,
+				19BFF64C11C0F2AC00B8C04D /* DOMSVGFEConvolveMatrixElement.mm in Sources */,
 				8502AB490AD438C000378540 /* DOMSVGFEDiffuseLightingElement.mm in Sources */,
 				8502AB4B0AD438C000378540 /* DOMSVGFEDisplacementMapElement.mm in Sources */,
 				8502AB4D0AD438C000378540 /* DOMSVGFEDistantLightElement.mm in Sources */,
@@ -20375,6 +20539,7 @@
 				41885B9411B6FDA6003383BB /* FormSubmission.cpp in Sources */,
 				65BF022E0974816300C43196 /* Frame.cpp in Sources */,
 				932E16090AF578340025F408 /* FrameLoader.cpp in Sources */,
+				D000EBA211BDAFD400C47726 /* FrameLoaderStateMachine.cpp in Sources */,
 				65BF02450974819000C43196 /* FrameMac.mm in Sources */,
 				65A21484097A3F5300B9050A /* FrameTree.cpp in Sources */,
 				65CBFEF90974F607001DAC25 /* FrameView.cpp in Sources */,
@@ -20404,12 +20569,6 @@
 				5160F4980B0AA75F00C1D2AF /* HistoryItemMac.mm in Sources */,
 				9363B62C0F8E8FE000803810 /* HistoryPropertyList.cpp in Sources */,
 				9307F1D70AF2D59000DBA31A /* HitTestResult.cpp in Sources */,
-				A871038A11A2947000DBD50E /* HTMLDocumentParser.cpp in Sources */,
-				976E896011C0CA3A00EA9CA9 /* HTMLEntityParser.cpp in Sources */,
-				97E8B35611A23CE200169409 /* HTMLTokenizer.cpp in Sources */,
-				97E7936511C6030900E649BC /* HTMLPreloadScanner.cpp in Sources */,
-				A83B3AF011ADEFF500458809 /* HTMLScriptRunner.cpp in Sources */,
-				A879C62511A9D1F70059237A /* HTMLTreeBuilder.cpp in Sources */,
 				BC97E23B109144950010D361 /* HTMLAllCollection.cpp in Sources */,
 				A8CFF7A40A156978000A4234 /* HTMLAnchorElement.cpp in Sources */,
 				A871D45E0A127CBC00B12A68 /* HTMLAppletElement.cpp in Sources */,
@@ -20432,13 +20591,16 @@
 				A8EA7CB10A192B9C00A8EF5F /* HTMLDivElement.cpp in Sources */,
 				A8EA79F50A1916DF00A8EF5F /* HTMLDListElement.cpp in Sources */,
 				93F19A9108245E59001E9ABC /* HTMLDocument.cpp in Sources */,
-				93F19A9C08245E59001E9ABC /* LegacyHTMLDocumentParser.cpp in Sources */,
+				A871038A11A2947000DBD50E /* HTMLDocumentParser.cpp in Sources */,
 				93309DE7099E64920056E581 /* htmlediting.cpp in Sources */,
 				93F19A9208245E59001E9ABC /* HTMLElement.cpp in Sources */,
 				A17C81220F2A5CF7005DAAEB /* HTMLElementFactory.cpp in Sources */,
+				A8A563B511DB3D10003AC2F0 /* HTMLElementStack.cpp in Sources */,
 				A871D45F0A127CBC00B12A68 /* HTMLEmbedElement.cpp in Sources */,
+				976E896011C0CA3A00EA9CA9 /* HTMLEntityParser.cpp in Sources */,
 				A81369D5097374F600D74463 /* HTMLFieldSetElement.cpp in Sources */,
 				A8CFF7A20A156978000A4234 /* HTMLFontElement.cpp in Sources */,
+				A8A564A611DC0E59003AC2F0 /* HTMLFormattingElementList.cpp in Sources */,
 				A8DF3FCF097FA0FC0052981B /* HTMLFormCollection.cpp in Sources */,
 				A81369CF097374F600D74463 /* HTMLFormControlElement.cpp in Sources */,
 				A81369D1097374F600D74463 /* HTMLFormElement.cpp in Sources */,
@@ -20479,12 +20641,15 @@
 				A8EA7CB20A192B9C00A8EF5F /* HTMLParagraphElement.cpp in Sources */,
 				A871D4590A127CBC00B12A68 /* HTMLParamElement.cpp in Sources */,
 				BC588B4B0BFA723C00EE679E /* HTMLParserErrorCodes.cpp in Sources */,
+				A8E6A78211D1661B00311F4A /* HTMLParserScheduler.cpp in Sources */,
 				A871D4570A127CBC00B12A68 /* HTMLPlugInElement.cpp in Sources */,
 				4415292F0E1AE8A000C4A2D0 /* HTMLPlugInImageElement.cpp in Sources */,
 				A8EA7CAD0A192B9C00A8EF5F /* HTMLPreElement.cpp in Sources */,
+				97E7936511C6030900E649BC /* HTMLPreloadScanner.cpp in Sources */,
 				A43BF5981149290A00C643CA /* HTMLProgressElement.cpp in Sources */,
 				A8CFF7A50A156978000A4234 /* HTMLQuoteElement.cpp in Sources */,
 				A871DC220A15205700B12A68 /* HTMLScriptElement.cpp in Sources */,
+				A83B3AF011ADEFF500458809 /* HTMLScriptRunner.cpp in Sources */,
 				A81369D9097374F600D74463 /* HTMLSelectElement.cpp in Sources */,
 				E44613A70CD6331000FADA75 /* HTMLSourceElement.cpp in Sources */,
 				A871DC260A15205700B12A68 /* HTMLStyleElement.cpp in Sources */,
@@ -20498,6 +20663,8 @@
 				A871DB260A150BD600B12A68 /* HTMLTableSectionElement.cpp in Sources */,
 				A81369D7097374F600D74463 /* HTMLTextAreaElement.cpp in Sources */,
 				A871DC290A15205700B12A68 /* HTMLTitleElement.cpp in Sources */,
+				97E8B35611A23CE200169409 /* HTMLTokenizer.cpp in Sources */,
+				A879C62511A9D1F70059237A /* HTMLTreeBuilder.cpp in Sources */,
 				A8EA79F30A1916DF00A8EF5F /* HTMLUListElement.cpp in Sources */,
 				E44613AA0CD6331000FADA75 /* HTMLVideoElement.cpp in Sources */,
 				BCCD74E50A4C8DDF005FDA6D /* HTMLViewSourceDocument.cpp in Sources */,
@@ -20599,6 +20766,7 @@
 				E4EEFFC80D34550C00469A58 /* JSAudioConstructor.cpp in Sources */,
 				BC124EFF0C26447A009E2349 /* JSBarInfo.cpp in Sources */,
 				BC946346107A934B00857193 /* JSBeforeLoadEvent.cpp in Sources */,
+				51721FD211D27EF200638B42 /* JSBeforeProcessEvent.cpp in Sources */,
 				2E2D99CD10E2BBDA00496337 /* JSBlob.cpp in Sources */,
 				89CD029311C85B870070B791 /* JSBlobBuilder.cpp in Sources */,
 				1449E287107D4DB400B5793F /* JSCallbackData.cpp in Sources */,
@@ -20676,6 +20844,8 @@
 				1ACE53DF0A8D18810022947D /* JSDOMParser.cpp in Sources */,
 				BC5A86B50C3367E800EEA649 /* JSDOMSelection.cpp in Sources */,
 				C5137CF211A58378004ADB99 /* JSDOMStringList.cpp in Sources */,
+				BC64649711D82349006455B0 /* JSDOMStringMap.cpp in Sources */,
+				BC64649C11D8238C006455B0 /* JSDOMStringMapCustom.cpp in Sources */,
 				1403BA0C09EB18C700797C7F /* JSDOMWindow.cpp in Sources */,
 				BC6932730D7E293900AE44D1 /* JSDOMWindowBase.cpp in Sources */,
 				BCD9C2620C17AA67005C90A2 /* JSDOMWindowCustom.cpp in Sources */,
@@ -20751,7 +20921,6 @@
 				1AE2AA300A1CDAB400B42B25 /* JSHTMLHRElement.cpp in Sources */,
 				1A85B18F0A1B18A200D8C87C /* JSHTMLHtmlElement.cpp in Sources */,
 				BC4918C80BFEA050009D6316 /* JSHTMLIFrameElement.cpp in Sources */,
-				BC2ED6500C6BC48C00920BFF /* JSHTMLIFrameElementCustom.cpp in Sources */,
 				1AE2AA970A1CDD2D00B42B25 /* JSHTMLImageElement.cpp in Sources */,
 				A80E7E980A1A83E3007FB8C5 /* JSHTMLInputElement.cpp in Sources */,
 				BCC438780E886CC700533DD5 /* JSHTMLInputElementCustom.cpp in Sources */,
@@ -20885,6 +21054,7 @@
 				41D1690510238B66009BC827 /* JSSharedWorkerContext.cpp in Sources */,
 				14CD8D82106B529000A46D23 /* JSSharedWorkerCustom.cpp in Sources */,
 				514C76370CE9225E007EF3CD /* JSSQLError.cpp in Sources */,
+				B525A96611CA2340003A23A8 /* JSSQLException.cpp in Sources */,
 				1AE82FEC0CAB07EE002237AE /* JSSQLResultSet.cpp in Sources */,
 				1AFE11990CBFFCC4003017FA /* JSSQLResultSetRowList.cpp in Sources */,
 				51DCE8020CAC9F1C00488358 /* JSSQLResultSetRowListCustom.cpp in Sources */,
@@ -20943,6 +21113,7 @@
 				B2FA3D6C0AB75A6F000E5AC4 /* JSSVGFEColorMatrixElement.cpp in Sources */,
 				B2FA3D6E0AB75A6F000E5AC4 /* JSSVGFEComponentTransferElement.cpp in Sources */,
 				B2FA3D700AB75A6F000E5AC4 /* JSSVGFECompositeElement.cpp in Sources */,
+				19BFF64E11C0F2AC00B8C04D /* JSSVGFEConvolveMatrixElement.cpp in Sources */,
 				B2FA3D720AB75A6F000E5AC4 /* JSSVGFEDiffuseLightingElement.cpp in Sources */,
 				B2FA3D740AB75A6F000E5AC4 /* JSSVGFEDisplacementMapElement.cpp in Sources */,
 				B2FA3D760AB75A6F000E5AC4 /* JSSVGFEDistantLightElement.cpp in Sources */,
@@ -21118,7 +21289,9 @@
 				A456FA2611AD4A830020B420 /* LabelsNodeList.cpp in Sources */,
 				9352084509BD43B900F2038D /* Language.mm in Sources */,
 				2D9066060BE141D400956998 /* LayoutState.cpp in Sources */,
+				93F19A9C08245E59001E9ABC /* LegacyHTMLDocumentParser.cpp in Sources */,
 				93F19A9B08245E59001E9ABC /* LegacyHTMLTreeBuilder.cpp in Sources */,
+				E49626C20D80D94800E3405C /* LegacyPreloadScanner.cpp in Sources */,
 				512DD8F40D91E6AF000F89EE /* LegacyWebArchive.cpp in Sources */,
 				51B2417B0D931F3F00E83F5C /* LegacyWebArchiveMac.mm in Sources */,
 				BCE65BEA0EACDF16007E4533 /* Length.cpp in Sources */,
@@ -21171,6 +21344,7 @@
 				BCF34A3711A231CD00C71804 /* NamedNodeMap.cpp in Sources */,
 				A81872240977D3C0005826D9 /* NameNodeList.cpp in Sources */,
 				E10B9B6D0B747599003ED890 /* NativeXPathNSResolver.cpp in Sources */,
+				8AF4E55511DC5A36000ED3DE /* Navigation.cpp in Sources */,
 				93CCF0600AF6CA7600018E89 /* NavigationAction.cpp in Sources */,
 				A9C6E5A50D746458006442E9 /* Navigator.cpp in Sources */,
 				E12719CA0EEEC21300F61213 /* NavigatorBase.cpp in Sources */,
@@ -21216,11 +21390,13 @@
 				A80A38FE0E50CC8200A25EBC /* PatternCG.cpp in Sources */,
 				B27535640B053814002CE64F /* PDFDocumentImage.cpp in Sources */,
 				B27535810B053814002CE64F /* Pen.cpp in Sources */,
+				8A844D0411D3C18E0014065C /* Performance.cpp in Sources */,
 				49D5DC2D0F423A73008F20FD /* PerspectiveTransformOperation.cpp in Sources */,
 				377C4CE01014E9F600B9AE42 /* PlaceholderDocument.cpp in Sources */,
 				41BF700F0FE86F61005E8DEC /* PlatformMessagePortChannel.cpp in Sources */,
 				935C477109AC4D7300A6AAB4 /* PlatformMouseEventMac.mm in Sources */,
 				BC94D1080C274F88006BC617 /* PlatformScreenMac.mm in Sources */,
+				1AD8F81C11CAB9E900E93E54 /* PlatformStrategies.cpp in Sources */,
 				A9C6E4EB0D745E2B006442E9 /* Plugin.cpp in Sources */,
 				A9C6E4EF0D745E38006442E9 /* PluginArray.cpp in Sources */,
 				A9C6E4F30D745E48006442E9 /* PluginData.cpp in Sources */,
@@ -21236,7 +21412,6 @@
 				0668E1900ADD9640004128E0 /* PopupMenuMac.mm in Sources */,
 				93F19AF808245E59001E9ABC /* Position.cpp in Sources */,
 				37919C230B7D188600A56998 /* PositionIterator.cpp in Sources */,
-				E49626C20D80D94800E3405C /* LegacyPreloadScanner.cpp in Sources */,
 				B776D43D1104527500BEB0EC /* PrintContext.cpp in Sources */,
 				A8EA7EBD0A1945D000A8EF5F /* ProcessingInstruction.cpp in Sources */,
 				E44613EB0CD681B400FADA75 /* ProgressEvent.cpp in Sources */,
@@ -21276,6 +21451,7 @@
 				BCB4F8930DB28E530039139B /* RenderImageGeneratedContent.cpp in Sources */,
 				A7AA66D611C5ED6A001D8C8C /* RenderIndicator.cpp in Sources */,
 				BCEA4877097D93020094C9E4 /* RenderInline.cpp in Sources */,
+				750D029311D0E7F300BD1B27 /* RenderInputSpeech.cpp in Sources */,
 				BCEA4879097D93020094C9E4 /* RenderLayer.cpp in Sources */,
 				0F580D000F12DE9B0051D689 /* RenderLayerBacking.cpp in Sources */,
 				0F580CFE0F12DE9B0051D689 /* RenderLayerCompositor.cpp in Sources */,
@@ -21382,7 +21558,9 @@
 				1CEFC9BA0D78DC8C007D2579 /* SchedulePair.cpp in Sources */,
 				1CE24F970D7CAF0E007E04C2 /* SchedulePairMac.mm in Sources */,
 				BCEC01BD0C274DAC009F4EC9 /* Screen.cpp in Sources */,
+				A84D82C211D3474800972990 /* ScriptableDocumentParser.cpp in Sources */,
 				7A1E88F5101CC384000C4DF5 /* ScriptArray.cpp in Sources */,
+				200B190911C277D900DCCD3A /* ScriptBreakpoint.cpp in Sources */,
 				41F1D2200EF35C2A00DA8753 /* ScriptCachedFrameData.cpp in Sources */,
 				416E75CC0EDF90C700360E1D /* ScriptCallFrame.cpp in Sources */,
 				416E75BF0EDF8FD700360E1D /* ScriptCallStack.cpp in Sources */,
@@ -21463,6 +21641,7 @@
 				B523CF091182675400EBB29C /* SQLTransactionSync.cpp in Sources */,
 				1A2E6E590CC55213004A2062 /* SQLValue.cpp in Sources */,
 				93F19AE608245E59001E9ABC /* SSLKeyGeneratorMac.mm in Sources */,
+				CEA3949C11D45CDA003094CF /* StaticHashSetNodeList.cpp in Sources */,
 				BC7FA62E0D1F0EFF00DB22A9 /* StaticNodeList.cpp in Sources */,
 				A5AFB34F115151A700B045CB /* StepRange.cpp in Sources */,
 				51E3F9C70DA059DC00250911 /* Storage.cpp in Sources */,
@@ -21501,6 +21680,7 @@
 				BC5EB5E70E81BFEF00B25965 /* StyleSurroundData.cpp in Sources */,
 				BC5EB80F0E81F2CE00B25965 /* StyleTransformData.cpp in Sources */,
 				BC5EB6990E81DA6300B25965 /* StyleVisualData.cpp in Sources */,
+				D000ED2711C1B9CD00C47726 /* SubframeLoader.cpp in Sources */,
 				93E227E40AF589AD00D48324 /* SubresourceLoader.cpp in Sources */,
 				93B2D8180F9920EE006AE6B2 /* SuddenTermination.mm in Sources */,
 				62C1217C11AB9E77003C462C /* SuspendableTimer.cpp in Sources */,
@@ -21539,6 +21719,7 @@
 				B22279CD0D00BF220071B782 /* SVGFEComponentTransferElement.cpp in Sources */,
 				B22279D00D00BF220071B782 /* SVGFECompositeElement.cpp in Sources */,
 				B255997A0D00D8BA00BB825C /* SVGFEConvolveMatrix.cpp in Sources */,
+				1921327411C0E6BB00456238 /* SVGFEConvolveMatrixElement.cpp in Sources */,
 				B255997C0D00D8BA00BB825C /* SVGFEDiffuseLighting.cpp in Sources */,
 				B22279D30D00BF220071B782 /* SVGFEDiffuseLightingElement.cpp in Sources */,
 				B255997E0D00D8BA00BB825C /* SVGFEDisplacementMap.cpp in Sources */,
@@ -21702,6 +21883,7 @@
 				7553CFE9108F473F00EA281E /* TimelineRecordFactory.cpp in Sources */,
 				93309EA4099EB78C0056E581 /* Timer.cpp in Sources */,
 				E44613AF0CD6331000FADA75 /* TimeRanges.cpp in Sources */,
+				8AF4E55B11DC5A63000ED3DE /* Timing.cpp in Sources */,
 				49E911C30EF86D47009D0CAF /* TransformationMatrix.cpp in Sources */,
 				B27535580B053814002CE64F /* TransformationMatrixCG.cpp in Sources */,
 				49E911CF0EF86D47009D0CAF /* TransformOperations.cpp in Sources */,
@@ -21850,13 +22032,6 @@
 				93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */,
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */,
-				D000EBA211BDAFD400C47726 /* FrameLoaderStateMachine.cpp in Sources */,
-				D000ED2711C1B9CD00C47726 /* SubframeLoader.cpp in Sources */,
-				200B190911C277D900DCCD3A /* ScriptBreakpoint.cpp in Sources */,
-				1AD8F81C11CAB9E900E93E54 /* PlatformStrategies.cpp in Sources */,
-				B525A96611CA2340003A23A8 /* JSSQLException.cpp in Sources */,
-				A8E6A78211D1661B00311F4A /* HTMLParserScheduler.cpp in Sources */,
-				CEA3949C11D45CDA003094CF /* StaticHashSetNodeList.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index 8e2aa2c..3d7e712 100644
--- a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -47,6 +47,7 @@
 #include "Editor.h"
 #include "Frame.h"
 #include "FrameView.h"
+#include "GOwnPtr.h"
 #include "HostWindow.h"
 #include "HTMLNames.h"
 #include "HTMLTableCaptionElement.h"
@@ -1005,16 +1006,257 @@ static gint webkit_accessible_text_get_caret_offset(AtkText* text)
     return offset;
 }
 
-static AtkAttributeSet* webkit_accessible_text_get_run_attributes(AtkText* text, gint offset, gint* start_offset, gint* end_offset)
+static AtkAttributeSet* getAttributeSetForAccessibilityObject(const AccessibilityObject* object)
 {
-    notImplemented();
-    return 0;
+    if (!object->isAccessibilityRenderObject())
+        return 0;
+
+    RenderObject* renderer = static_cast<const AccessibilityRenderObject*>(object)->renderer();
+    RenderStyle* style = renderer->style();
+
+    AtkAttributeSet* result = 0;
+    GOwnPtr<gchar> buffer(g_strdup_printf("%i", style->fontSize()));
+    result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_SIZE), buffer.get());
+
+    Color bgColor = style->visitedDependentColor(CSSPropertyBackgroundColor);
+    if (bgColor.isValid()) {
+        buffer.set(g_strdup_printf("%i,%i,%i",
+                                   bgColor.red(), bgColor.green(), bgColor.blue()));
+        result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_BG_COLOR), buffer.get());
+    }
+
+    Color fgColor = style->visitedDependentColor(CSSPropertyColor);
+    if (fgColor.isValid()) {
+        buffer.set(g_strdup_printf("%i,%i,%i",
+                                   fgColor.red(), fgColor.green(), fgColor.blue()));
+        result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_FG_COLOR), buffer.get());
+    }
+
+    int baselinePosition;
+    bool includeRise = true;
+    switch (style->verticalAlign()) {
+    case SUB:
+        baselinePosition = -1 * renderer->baselinePosition(true);
+        break;
+    case SUPER:
+        baselinePosition = renderer->baselinePosition(true);
+        break;
+    case BASELINE:
+        baselinePosition = 0;
+        break;
+    default:
+        includeRise = false;
+        break;
+    }
+
+    if (includeRise) {
+        buffer.set(g_strdup_printf("%i", baselinePosition));
+        result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_RISE), buffer.get());
+    }
+
+    int indentation = style->textIndent().calcValue(object->size().width());
+    if (indentation != undefinedLength) {
+        buffer.set(g_strdup_printf("%i", indentation));
+        result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_INDENT), buffer.get());
+    }
+
+    String fontFamilyName = style->font().family().family().string();
+    if (fontFamilyName.left(8) == "-webkit-")
+        fontFamilyName = fontFamilyName.substring(8);
+
+    result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_FAMILY_NAME), fontFamilyName.utf8().data());
+
+    int fontWeight = -1;
+    switch (style->font().weight()) {
+    case FontWeight100:
+        fontWeight = 100;
+        break;
+    case FontWeight200:
+        fontWeight = 200;
+        break;
+    case FontWeight300:
+        fontWeight = 300;
+        break;
+    case FontWeight400:
+        fontWeight = 400;
+        break;
+    case FontWeight500:
+        fontWeight = 500;
+        break;
+    case FontWeight600:
+        fontWeight = 600;
+        break;
+    case FontWeight700:
+        fontWeight = 700;
+        break;
+    case FontWeight800:
+        fontWeight = 800;
+        break;
+    case FontWeight900:
+        fontWeight = 900;
+    }
+    if (fontWeight > 0) {
+        buffer.set(g_strdup_printf("%i", fontWeight));
+        result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_WEIGHT), buffer.get());
+    }
+
+    switch (style->textAlign()) {
+    case TAAUTO:
+        break;
+    case LEFT:
+    case WEBKIT_LEFT:
+        result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_JUSTIFICATION), "left");
+        break;
+    case RIGHT:
+    case WEBKIT_RIGHT:
+        result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_JUSTIFICATION), "right");
+        break;
+    case CENTER:
+    case WEBKIT_CENTER:
+        result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_JUSTIFICATION), "center");
+        break;
+    case JUSTIFY:
+        result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_JUSTIFICATION), "fill");
+    }
+
+    result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_UNDERLINE), (style->textDecoration() & UNDERLINE) ? "single" : "none");
+
+    result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_STYLE), style->font().italic() ? "italic" : "normal");
+
+    result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_STRIKETHROUGH), (style->textDecoration() & LINE_THROUGH) ? "true" : "false");
+
+    result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_INVISIBLE), (style->visibility() == HIDDEN) ? "true" : "false");
+
+    result = addAttributeToSet(result, atk_text_attribute_get_name(ATK_TEXT_ATTR_EDITABLE), object->isReadOnly() ? "false" : "true");
+
+    return result;
+}
+
+static gint compareAttribute(const AtkAttribute* a, const AtkAttribute* b)
+{
+    return g_strcmp0(a->name, b->name) || g_strcmp0(a->value, b->value);
+}
+
+// Returns an AtkAttributeSet with the elements of a1 which are either
+// not present or different in a2.  Neither a1 nor a2 should be used
+// after calling this function.
+static AtkAttributeSet* attributeSetDifference(AtkAttributeSet* a1, AtkAttributeSet* a2)
+{
+    if (!a2)
+        return a1;
+
+    AtkAttributeSet* i = a1;
+    AtkAttributeSet* found;
+    AtkAttributeSet* toDelete = 0;
+
+    while (i) {
+        found = g_slist_find_custom(a2, i->data, (GCompareFunc)compareAttribute);
+        if (found) {
+            AtkAttributeSet* t = i->next;
+            toDelete = g_slist_prepend(toDelete, i->data);
+            a1 = g_slist_delete_link(a1, i);
+            i = t;
+        } else
+            i = i->next;
+    }
+
+    atk_attribute_set_free(a2);
+    atk_attribute_set_free(toDelete);
+    return a1;
+}
+
+static guint accessibilityObjectLength(const AccessibilityObject* object)
+{
+    GOwnPtr<gchar> text(webkit_accessible_text_get_text(ATK_TEXT(object->wrapper()), 0, -1));
+    return g_utf8_strlen(text.get(), -1);
+}
+
+static const AccessibilityObject* getAccessibilityObjectForOffset(const AccessibilityObject* object, guint offset, gint* startOffset, gint* endOffset)
+{
+    const AccessibilityObject* result;
+    guint length = accessibilityObjectLength(object);
+    if (length > offset) {
+        *startOffset = 0;
+        *endOffset = length;
+        result = object;
+    } else {
+        *startOffset = -1;
+        *endOffset = -1;
+        result = 0;
+    }
+
+    if (!object->firstChild())
+        return result;
+
+    AccessibilityObject* child = object->firstChild();
+    guint currentOffset = 0;
+    guint childPosition = 0;
+    while (child && currentOffset <= offset) {
+        guint childLength = accessibilityObjectLength(child);
+        currentOffset = childLength + childPosition;
+        if (currentOffset > offset) {
+            gint childStartOffset;
+            gint childEndOffset;
+            const AccessibilityObject* grandChild = getAccessibilityObjectForOffset(child, offset-childPosition,  &childStartOffset, &childEndOffset);
+            if (childStartOffset >= 0) {
+                *startOffset = childStartOffset + childPosition;
+                *endOffset = childEndOffset + childPosition;
+                result = grandChild;
+            }
+        } else {
+            childPosition += childLength;
+            child = child->nextSibling();
+        }
+    }
+    return result;
+}
+
+static AtkAttributeSet* getRunAttributesFromAccesibilityObject(const AccessibilityObject* element, gint offset, gint* startOffset, gint* endOffset)
+{
+    const AccessibilityObject *child = getAccessibilityObjectForOffset(element, offset, startOffset, endOffset);
+    if (!child) {
+        *startOffset = -1;
+        *endOffset = -1;
+        return 0;
+    }
+
+    AtkAttributeSet* defaultAttributes = getAttributeSetForAccessibilityObject(element);
+    AtkAttributeSet* childAttributes = getAttributeSetForAccessibilityObject(child);
+
+    return attributeSetDifference(childAttributes, defaultAttributes);
+}
+
+static AtkAttributeSet* webkit_accessible_text_get_run_attributes(AtkText* text, gint offset, gint* startOffset, gint* endOffset)
+{
+    AccessibilityObject* coreObject = core(text);
+    AtkAttributeSet* result;
+
+    if (!coreObject) {
+        *startOffset = 0;
+        *endOffset = atk_text_get_character_count(text);
+        return 0;
+    }
+
+    if (offset == -1)
+        offset = atk_text_get_caret_offset(text);
+
+    result = getRunAttributesFromAccesibilityObject(coreObject, offset, startOffset, endOffset);
+
+    if (*startOffset < 0) {
+        *startOffset = offset;
+        *endOffset = offset;
+    }
+
+    return result;
 }
 
 static AtkAttributeSet* webkit_accessible_text_get_default_attributes(AtkText* text)
 {
-    notImplemented();
-    return 0;
+    AccessibilityObject* coreObject = core(text);
+    if (!coreObject || !coreObject->isAccessibilityRenderObject())
+        return 0;
+
+    return getAttributeSetForAccessibilityObject(coreObject);
 }
 
 static void webkit_accessible_text_get_character_extents(AtkText* text, gint offset, gint* x, gint* y, gint* width, gint* height, AtkCoordType coords)
@@ -1448,8 +1690,19 @@ static gint webkit_accessible_table_get_row_extent_at(AtkTable* table, gint row,
 
 static AtkObject* webkit_accessible_table_get_column_header(AtkTable* table, gint column)
 {
-    // FIXME: This needs to be implemented.
-    notImplemented();
+    AccessibilityObject* accTable = core(table);
+    if (accTable->isAccessibilityRenderObject()) {
+        AccessibilityObject::AccessibilityChildrenVector allColumnHeaders;
+        static_cast<AccessibilityTable*>(accTable)->columnHeaders(allColumnHeaders);
+        unsigned columnCount = allColumnHeaders.size();
+        for (unsigned k = 0; k < columnCount; ++k) {
+            pair<int, int> columnRange;
+            AccessibilityTableCell* cell = static_cast<AccessibilityTableCell*>(allColumnHeaders.at(k).get());
+            cell->columnIndexRange(columnRange);
+            if (columnRange.first <= column && column < columnRange.first + columnRange.second)
+                return allColumnHeaders[k]->wrapper();
+        }
+    }
     return 0;
 }
 
@@ -1459,11 +1712,12 @@ static AtkObject* webkit_accessible_table_get_row_header(AtkTable* table, gint r
     if (accTable->isAccessibilityRenderObject()) {
         AccessibilityObject::AccessibilityChildrenVector allRowHeaders;
         static_cast<AccessibilityTable*>(accTable)->rowHeaders(allRowHeaders);
-
         unsigned rowCount = allRowHeaders.size();
         for (unsigned k = 0; k < rowCount; ++k) {
-            AccessibilityObject* rowObject = allRowHeaders[k]->parentObject();
-            if (static_cast<AccessibilityTableRow*>(rowObject)->rowIndex() == row)
+            pair<int, int> rowRange;
+            AccessibilityTableCell* cell = static_cast<AccessibilityTableCell*>(allRowHeaders.at(k).get());
+            cell->rowIndexRange(rowRange);
+            if (rowRange.first <= row && row < rowRange.first + rowRange.second)
                 return allRowHeaders[k]->wrapper();
         }
     }
diff --git a/WebCore/bindings/generic/BindingElement.h b/WebCore/bindings/generic/BindingElement.h
deleted file mode 100644
index ba7856a..0000000
--- a/WebCore/bindings/generic/BindingElement.h
+++ /dev/null
@@ -1,102 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- * 
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef BindingElement_h
-#define BindingElement_h
-
-#include "Attr.h"
-#include "BindingSecurity.h"
-#include "Element.h"
-#include "ExceptionCode.h"
-
-#include <wtf/RefPtr.h>
-
-namespace WebCore {
-
-template <class Binding>
-class BindingElement {
-public:
-    static void setAttribute(State<Binding>*, Element*, const AtomicString&, const AtomicString&, ExceptionCode&);
-    static RefPtr<Attr> setAttributeNode(State<Binding>*, Element*, Attr*, ExceptionCode&);
-    static void setAttributeNS(State<Binding>*, Element*, const AtomicString&, const AtomicString&, const AtomicString&, ExceptionCode&);
-    static RefPtr<Attr> setAttributeNodeNS(State<Binding>*, Element*, Attr*, ExceptionCode&);
-};
-
-// Implementations of templated methods must be in this file.
-
-template <class Binding>
-void BindingElement<Binding>::setAttribute(State<Binding>* state, Element* element, const AtomicString& name, const AtomicString& value, ExceptionCode& ec)
-{
-    ASSERT(element);
-
-    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, name, value))
-        return;
-
-    element->setAttribute(name, value, ec);
-}
-
-template <class Binding>
-RefPtr<Attr> BindingElement<Binding>::setAttributeNode(State<Binding>* state, Element* element, Attr* newAttr, ExceptionCode& ec)
-{
-    ASSERT(element);
-    ASSERT(newAttr);
-
-    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, newAttr->name(), newAttr->value()))
-        return 0;
-
-    return element->setAttributeNode(newAttr, ec);
-}
-
-template <class Binding>
-void BindingElement<Binding>::setAttributeNS(State<Binding>* state, Element* element, const AtomicString& namespaceURI, const AtomicString& qualifiedName, const AtomicString& value, ExceptionCode& ec)
-{
-    ASSERT(element);
-
-    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, qualifiedName, value))
-        return;
-
-    element->setAttributeNS(namespaceURI, qualifiedName, value, ec);
-}
-
-template <class Binding>
-RefPtr<Attr> BindingElement<Binding>::setAttributeNodeNS(State<Binding>* state, Element* element, Attr* newAttr, ExceptionCode& ec)
-{
-    ASSERT(element);
-    ASSERT(newAttr);
-
-    if (!BindingSecurity<Binding>::allowSettingSrcToJavascriptURL(state, element, newAttr->name(), newAttr->value()))
-        return 0;
-
-    return element->setAttributeNodeNS(newAttr, ec);
-}
-
-} // namespace WebCore
-
-#endif // BindingElement_h
diff --git a/WebCore/bindings/gobject/WebKitDOMObject.cpp b/WebCore/bindings/gobject/WebKitDOMObject.cpp
index fc8a874..d8452ac 100644
--- a/WebCore/bindings/gobject/WebKitDOMObject.cpp
+++ b/WebCore/bindings/gobject/WebKitDOMObject.cpp
@@ -11,13 +11,49 @@
 #include "glib-object.h"
 #include "WebKitDOMBinding.h"
 
+enum {
+    PROP_0,
+    PROP_CORE_OBJECT
+};
+
 G_DEFINE_TYPE(WebKitDOMObject, webkit_dom_object, G_TYPE_OBJECT);
 
 static void webkit_dom_object_init(WebKitDOMObject* object)
 {
 }
 
+static void webkit_dom_object_get_property(GObject* object, guint prop_id, GValue* value, GParamSpec* pspec)
+{
+    switch (prop_id) {
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
+        break;
+    }
+}
+
+static void webkit_dom_object_set_property(GObject* object, guint prop_id, const GValue* value, GParamSpec* pspec)
+{
+    switch (prop_id) {
+    case PROP_CORE_OBJECT:
+        WEBKIT_DOM_OBJECT(object)->coreObject = g_value_get_pointer(value);
+        break;
+    default:
+        G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
+        break;
+    }
+}
+
 static void webkit_dom_object_class_init(WebKitDOMObjectClass* klass)
 {
+    GObjectClass* gobjectClass = G_OBJECT_CLASS(klass);
+    gobjectClass->set_property = webkit_dom_object_set_property;
+    gobjectClass->get_property = webkit_dom_object_get_property;
+
+    g_object_class_install_property(gobjectClass,
+                                    PROP_CORE_OBJECT,
+                                    g_param_spec_pointer("core-object",
+                                                         "Core Object",
+                                                         "The WebCore object the WebKitDOMObject wraps",
+                                                         static_cast<GParamFlags>(G_PARAM_WRITABLE | G_PARAM_CONSTRUCT_ONLY)));
 }
 
diff --git a/WebCore/bindings/js/IDBBindingUtilities.cpp b/WebCore/bindings/js/IDBBindingUtilities.cpp
new file mode 100644
index 0000000..faa2370
--- /dev/null
+++ b/WebCore/bindings/js/IDBBindingUtilities.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IDBBindingUtilities.h"
+
+#include "IDBKey.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+PassRefPtr<IDBKey> createIDBKeyFromValue(JSC::ExecState* exec, JSC::JSValue value)
+{
+    if (value.isNull())
+        return IDBKey::create();
+    if (value.isInt32())
+        return IDBKey::create(value.toInt32(exec));
+    if (value.isString())
+        return IDBKey::create(ustringToString(value.toString(exec)));
+    // FIXME: Implement dates.
+    return 0;
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/bindings/js/IDBBindingUtilities.h b/WebCore/bindings/js/IDBBindingUtilities.h
new file mode 100644
index 0000000..0a2fb790
--- /dev/null
+++ b/WebCore/bindings/js/IDBBindingUtilities.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBBindingUtilities_h
+#define IDBBindingUtilities_h
+
+#include "ScriptValue.h"
+#include <wtf/PassRefPtr.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+class IDBKey;
+
+PassRefPtr<IDBKey> createIDBKeyFromValue(JSC::ExecState*, JSC::JSValue);
+
+}
+
+#endif // ENABLE(INDEXED_DATABASE)
+
+#endif // IDBBindingUtilities_h
diff --git a/WebCore/bindings/js/JSArrayBufferViewHelper.h b/WebCore/bindings/js/JSArrayBufferViewHelper.h
index 331e950..27a9a98 100644
--- a/WebCore/bindings/js/JSArrayBufferViewHelper.h
+++ b/WebCore/bindings/js/JSArrayBufferViewHelper.h
@@ -96,9 +96,14 @@ PassRefPtr<ArrayBufferView> constructArrayBufferView(JSC::ExecState* exec)
     //
     RefPtr<C> arrayObject;
     
-    // For the 0 args case, just create an object without a buffer 
+    // For the 0 args case, just create a zero-length view. We could
+    // consider raising a SyntaxError for this case, but not all
+    // JavaScript DOM bindings can distinguish between "new
+    // <Type>Array()" and what occurs when a previously-constructed
+    // ArrayBufferView is returned to JavaScript; e.g., from
+    // "array.slice()".
     if (exec->argumentCount() < 1)
-        return C::create(0, 0, 0);
+        return C::create(0);
     
     if (exec->argument(0).isNull()) {
         // Invalid first argument
diff --git a/WebCore/bindings/js/JSBindingsAllInOne.cpp b/WebCore/bindings/js/JSBindingsAllInOne.cpp
index 1d64198..c9a77fb 100644
--- a/WebCore/bindings/js/JSBindingsAllInOne.cpp
+++ b/WebCore/bindings/js/JSBindingsAllInOne.cpp
@@ -25,6 +25,8 @@
 
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
+#include "DOMObjectHashTableMap.cpp"
+#include "DOMWrapperWorld.cpp"
 #include "GCController.cpp"
 #include "JSAttrCustom.cpp"
 #include "JSAudioConstructor.cpp"
@@ -39,19 +41,25 @@
 #include "JSClipboardCustom.cpp"
 #include "JSConsoleCustom.cpp"
 #include "JSCoordinatesCustom.cpp"
+#include "JSCustomPositionCallback.cpp"
+#include "JSCustomPositionErrorCallback.cpp"
 #include "JSCustomSQLStatementErrorCallback.cpp"
 #include "JSCustomVoidCallback.cpp"
 #include "JSCustomXPathNSResolver.cpp"
 #include "JSDOMApplicationCacheCustom.cpp"
 #include "JSDOMBinding.cpp"
+#include "JSDOMFormDataCustom.cpp"
 #include "JSDOMGlobalObject.cpp"
+#include "JSDOMStringMapCustom.cpp"
 #include "JSDOMWindowBase.cpp"
 #include "JSDOMWindowCustom.cpp"
 #include "JSDOMWindowShell.cpp"
+#include "JSDOMWrapper.cpp"
 #include "JSDataGridColumnListCustom.cpp"
 #include "JSDataGridDataSource.cpp"
 #include "JSDatabaseCustom.cpp"
 #include "JSDatabaseSyncCustom.cpp"
+#include "JSDebugWrapperSet.cpp"
 #include "JSDedicatedWorkerContextCustom.cpp"
 #include "JSDesktopNotificationsCustom.cpp"
 #include "JSDocumentCustom.cpp"
@@ -61,6 +69,7 @@
 #include "JSEventSourceCustom.cpp"
 #include "JSEventTarget.cpp"
 #include "JSExceptionBase.cpp"
+#include "JSGeolocationCustom.cpp"
 #include "JSHTMLAllCollectionCustom.cpp"
 #include "JSHTMLAppletElementCustom.cpp"
 #include "JSHTMLCanvasElementCustom.cpp"
@@ -72,7 +81,6 @@
 #include "JSHTMLFormElementCustom.cpp"
 #include "JSHTMLFrameElementCustom.cpp"
 #include "JSHTMLFrameSetElementCustom.cpp"
-#include "JSHTMLIFrameElementCustom.cpp"
 #include "JSHTMLInputElementCustom.cpp"
 #include "JSHTMLObjectElementCustom.cpp"
 #include "JSHTMLOptionsCollectionCustom.cpp"
@@ -101,6 +109,7 @@
 #include "JSPluginArrayCustom.cpp"
 #include "JSPluginCustom.cpp"
 #include "JSPluginElementFunctions.cpp"
+#include "JSPopStateEventCustom.cpp"
 #include "JSSQLResultSetRowListCustom.cpp"
 #include "JSSQLTransactionCustom.cpp"
 #include "JSSQLTransactionSyncCustom.cpp"
@@ -138,6 +147,7 @@
 #include "ScriptDebugServer.cpp"
 #include "ScriptEventListener.cpp"
 #include "ScriptFunctionCall.cpp"
+#include "ScriptGCEvent.cpp"
 #include "ScriptProfiler.cpp"
 #include "ScriptState.cpp"
 #include "SerializedScriptValue.cpp"
diff --git a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
index 914dea0..e88afc2 100644
--- a/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
+++ b/WebCore/bindings/js/JSCanvasRenderingContext2DCustom.cpp
@@ -220,6 +220,7 @@ JSValue JSCanvasRenderingContext2D::drawImage(ExecState* exec)
         switch (exec->argumentCount()) {
             case 3:
                 context->drawImage(canvas, exec->argument(1).toFloat(exec), exec->argument(2).toFloat(exec), ec);
+                setDOMException(exec, ec);
                 break;
             case 5:
                 context->drawImage(canvas, exec->argument(1).toFloat(exec), exec->argument(2).toFloat(exec),
diff --git a/WebCore/bindings/js/JSDOMStringMapCustom.cpp b/WebCore/bindings/js/JSDOMStringMapCustom.cpp
new file mode 100644
index 0000000..455c7b1
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMStringMapCustom.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "JSDOMStringMap.h"
+
+#include "AtomicString.h"
+#include "DOMStringMap.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+bool JSDOMStringMap::canGetItemsForName(ExecState*, DOMStringMap* impl, const Identifier& propertyName)
+{
+    return impl->contains(identifierToAtomicString(propertyName));
+}
+
+JSValue JSDOMStringMap::nameGetter(ExecState* exec, JSValue slotBase, const Identifier& propertyName)
+{
+    JSDOMStringMap* thisObj = static_cast<JSDOMStringMap*>(asObject(slotBase));
+    return jsString(exec, thisObj->impl()->item(identifierToAtomicString(propertyName)));
+}
+
+void JSDOMStringMap::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
+{
+    Vector<String> names;
+    m_impl->getNames(names);
+    size_t length = names.size();
+    for (size_t i = 0; i < length; ++i)
+        propertyNames.add(Identifier(exec, stringToUString(names[i])));
+
+    Base::getOwnPropertyNames(exec, propertyNames, mode);
+}
+
+bool JSDOMStringMap::deleteProperty(ExecState* exec, const Identifier& propertyName)
+{
+    // Only perform the custom delete if the object doesn't have a native property by this name.
+    // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
+    // the native property slots manually.
+    PropertySlot slot;
+    if (getStaticValueSlot<JSDOMStringMap, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
+        return false;
+        
+    JSValue prototype = this->prototype();
+    if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
+        return false;
+
+    ExceptionCode ec = 0;
+    m_impl->deleteItem(identifierToString(propertyName), ec);
+    setDOMException(exec, ec);
+
+    return true;
+}
+
+bool JSDOMStringMap::putDelegate(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot&)
+{
+    // Only perform the custom put if the object doesn't have a native property by this name.
+    // Since hasProperty() would end up calling canGetItemsForName() and be fooled, we need to check
+    // the native property slots manually.
+    PropertySlot slot;
+    if (getStaticValueSlot<JSDOMStringMap, Base>(exec, s_info.propHashTable(exec), this, propertyName, slot))
+        return false;
+        
+    JSValue prototype = this->prototype();
+    if (prototype.isObject() && asObject(prototype)->hasProperty(exec, propertyName))
+        return false;
+    
+    String stringValue = ustringToString(value.toString(exec));
+    if (exec->hadException())
+        return true;
+    
+    ExceptionCode ec = 0;
+    impl()->setItem(identifierToString(propertyName), stringValue, ec);
+    setDOMException(exec, ec);
+
+    return true;
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/js/JSDOMStringMapCustom.h b/WebCore/bindings/js/JSDOMStringMapCustom.h
new file mode 100644
index 0000000..095fd21
--- /dev/null
+++ b/WebCore/bindings/js/JSDOMStringMapCustom.h
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef JSDOMStringMapCustom_h
+#define JSDOMStringMapCustom_h
+
+#include "JSDOMStringMap.h"
+
+#endif // JSDOMStringMapCustom_h
diff --git a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index 6e01513..345cffe 100644
--- a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -51,17 +51,6 @@ static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement*
     return true;
 }
 
-void JSHTMLFrameElement::setSrc(ExecState* exec, JSValue value)
-{
-    HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
-    String srcValue = valueToStringWithNullCheck(exec, value);
-
-    if (!allowSettingJavascriptURL(exec, imp, srcValue))
-        return;
-
-    imp->setAttribute(srcAttr, srcValue);
-}
-
 void JSHTMLFrameElement::setLocation(ExecState* exec, JSValue value)
 {
     HTMLFrameElement* imp = static_cast<HTMLFrameElement*>(impl());
diff --git a/WebCore/bindings/js/JSIDBKeyCustom.cpp b/WebCore/bindings/js/JSIDBKeyCustom.cpp
new file mode 100644
index 0000000..98c9315
--- /dev/null
+++ b/WebCore/bindings/js/JSIDBKeyCustom.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(INDEXED_DATABASE)
+#include "JSIDBKey.h"
+
+#include "IDBBindingUtilities.h"
+#include "IDBKey.h"
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue toJS(ExecState* exec, JSDOMGlobalObject*, IDBKey* key)
+{
+    if (!key)
+        return jsNull();
+
+    switch (key->type()) {
+    case IDBKey::NullType:
+        return jsNull();
+    case IDBKey::NumberType:
+        return jsNumber(exec, key->number());
+    case IDBKey::StringType:
+        return jsString(exec, key->string());
+    // FIXME: Implement dates.
+    }
+
+    ASSERT_NOT_REACHED();
+    return jsUndefined();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
diff --git a/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp b/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
index eb4f549..0342ab6 100644
--- a/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
+++ b/WebCore/bindings/js/JSWebGLRenderingContextCustom.cpp
@@ -55,6 +55,7 @@
 #include "WebGLProgram.h"
 #include "WebGLRenderingContext.h"
 #include <runtime/Error.h>
+#include <runtime/JSArray.h>
 #include <wtf/FastMalloc.h>
 #include <wtf/OwnFastMallocPtr.h>
 
@@ -72,6 +73,13 @@ static JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, const WebG
     switch (info.getType()) {
     case WebGLGetInfo::kTypeBool:
         return jsBoolean(info.getBool());
+    case WebGLGetInfo::kTypeBoolArray: {
+        MarkedArgumentBuffer list;
+        const Vector<bool>& value = info.getBoolArray();
+        for (size_t ii = 0; ii < value.size(); ++ii)
+            list.append(jsBoolean(value[ii]));
+        return constructArray(exec, list);
+    }
     case WebGLGetInfo::kTypeFloat:
         return jsNumber(exec, info.getFloat());
     case WebGLGetInfo::kTypeLong:
@@ -153,6 +161,29 @@ enum WhichProgramCall {
     kProgramParameter, kUniform
 };
 
+JSValue JSWebGLRenderingContext::getAttachedShaders(ExecState* exec)
+{
+    if (exec->argumentCount() < 1)
+        return throwSyntaxError(exec);
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = static_cast<WebGLRenderingContext*>(impl());
+    WebGLProgram* program = toWebGLProgram(exec->argument(0));
+    if (exec->hadException())
+        return jsUndefined();
+    Vector<WebGLShader*> shaders;
+    bool succeed = context->getAttachedShaders(program, shaders, ec);
+    if (ec) {
+        setDOMException(exec, ec);
+        return jsUndefined();
+    }
+    if (!succeed)
+        return jsUndefined();
+    MarkedArgumentBuffer list;
+    for (size_t ii = 0; ii < shaders.size(); ++ii)
+        list.append(toJS(exec, globalObject(), shaders[ii]));
+    return constructArray(exec, list);
+}
+
 JSValue JSWebGLRenderingContext::getBufferParameter(ExecState* exec)
 {
     return getObjectParameter(this, exec, kBuffer);
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index 6f0457a..0aa8f52 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -21,7 +21,7 @@
 #include "config.h"
 #include "ScriptController.h"
 
-#include "DocumentParser.h"
+#include "ScriptableDocumentParser.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "Frame.h"
@@ -238,11 +238,12 @@ JSDOMWindowShell* ScriptController::initScript(DOMWrapperWorld* world)
 int ScriptController::eventHandlerLineNumber() const
 {
     // JSC expects 1-based line numbers, so we must add one here to get it right.
-    if (DocumentParser* parser = m_frame->document()->parser())
+    ScriptableDocumentParser* parser = m_frame->document()->scriptableDocumentParser();
+    if (parser)
         return parser->lineNumber() + 1;
     return 0;
 }
-    
+
 bool ScriptController::processingUserGesture(DOMWrapperWorld* world) const
 {
     if (m_allowPopupsFromPlugin || isJavaScriptAnchorNavigation())
diff --git a/WebCore/bindings/js/ScriptDebugServer.cpp b/WebCore/bindings/js/ScriptDebugServer.cpp
index 1fd9ae4..d1b5112 100644
--- a/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -137,15 +137,17 @@ bool ScriptDebugServer::hasListenersInterestedInPage(Page* page)
     return m_pageListenersMap.contains(page);
 }
 
-void ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNumber, ScriptBreakpoint breakpoint)
+bool ScriptDebugServer::setBreakpoint(const String& sourceID, ScriptBreakpoint breakpoint, unsigned lineNumber, unsigned* actualLineNumber)
 {
     intptr_t sourceIDValue = sourceID.toIntPtr();
     if (!sourceIDValue)
-        return;
+        return false;
     BreakpointsMap::iterator it = m_breakpoints.find(sourceIDValue);
     if (it == m_breakpoints.end())
         it = m_breakpoints.set(sourceIDValue, SourceBreakpoints()).first;
     it->second.set(lineNumber, breakpoint);
+    *actualLineNumber = lineNumber;
+    return true;
 }
 
 void ScriptDebugServer::removeBreakpoint(const String& sourceID, unsigned lineNumber)
@@ -255,7 +257,7 @@ JavaScriptCallFrame* ScriptDebugServer::currentCallFrame()
 void ScriptDebugServer::dispatchDidPause(ScriptDebugListener* listener)
 {
     ASSERT(m_paused);
-    ScriptState* state = m_currentCallFrame->scopeChain()->globalObject->globalExec();        
+    ScriptState* state = m_currentCallFrame->scopeChain()->globalObject->globalExec();
     listener->didPause(state);
 }
 
diff --git a/WebCore/bindings/js/ScriptDebugServer.h b/WebCore/bindings/js/ScriptDebugServer.h
index dcf290e..6a8209b 100644
--- a/WebCore/bindings/js/ScriptDebugServer.h
+++ b/WebCore/bindings/js/ScriptDebugServer.h
@@ -63,7 +63,7 @@ public:
     void addListener(ScriptDebugListener*, Page*);
     void removeListener(ScriptDebugListener*, Page*);
 
-    void setBreakpoint(const String& sourceID, unsigned lineNumber, ScriptBreakpoint breakpoint);
+    bool setBreakpoint(const String& sourceID, ScriptBreakpoint breakpoint, unsigned lineNumber, unsigned* actualLineNumber);
     void removeBreakpoint(const String& sourceID, unsigned lineNumber);
     void clearBreakpoints();
     void setBreakpointsActivated(bool activated);
diff --git a/WebCore/bindings/js/ScriptSourceProvider.h b/WebCore/bindings/js/ScriptSourceProvider.h
index 3fe3584..2144169 100644
--- a/WebCore/bindings/js/ScriptSourceProvider.h
+++ b/WebCore/bindings/js/ScriptSourceProvider.h
@@ -35,8 +35,8 @@ namespace WebCore {
 
     class ScriptSourceProvider : public JSC::SourceProvider {
     public:
-        ScriptSourceProvider(const JSC::UString& url, JSC::SourceBOMPresence hasBOMs = JSC::SourceCouldHaveBOMs)
-            : SourceProvider(url, hasBOMs)
+        ScriptSourceProvider(const JSC::UString& url)
+            : SourceProvider(url)
         {
         }
 
diff --git a/WebCore/bindings/js/StringSourceProvider.h b/WebCore/bindings/js/StringSourceProvider.h
index 478c1d1..2a18006 100644
--- a/WebCore/bindings/js/StringSourceProvider.h
+++ b/WebCore/bindings/js/StringSourceProvider.h
@@ -49,6 +49,10 @@ namespace WebCore {
             : ScriptSourceProvider(stringToUString(url))
             , m_source(source)
         {
+            if (m_source.length()) {
+                bool scratch = false;
+                m_source = String(source.impl()->copyStringWithoutBOMs(false, scratch));
+            }
         }
         
         String m_source;
diff --git a/WebCore/bindings/objc/DOM.mm b/WebCore/bindings/objc/DOM.mm
index 378efe2..008acec 100644
--- a/WebCore/bindings/objc/DOM.mm
+++ b/WebCore/bindings/objc/DOM.mm
@@ -165,6 +165,7 @@ static void createElementClassMap()
     addElementClass(SVGNames::feColorMatrixTag, [DOMSVGFEColorMatrixElement class]);
     addElementClass(SVGNames::feComponentTransferTag, [DOMSVGFEComponentTransferElement class]);
     addElementClass(SVGNames::feCompositeTag, [DOMSVGFECompositeElement class]);
+    addElementClass(SVGNames::feConvolveMatrixTag, [DOMSVGFEConvolveMatrixElement class]);
     addElementClass(SVGNames::feDiffuseLightingTag, [DOMSVGFEDiffuseLightingElement class]);
     addElementClass(SVGNames::feDisplacementMapTag, [DOMSVGFEDisplacementMapElement class]);
     addElementClass(SVGNames::feDistantLightTag, [DOMSVGFEDistantLightElement class]);
diff --git a/WebCore/bindings/objc/DOMSVG.h b/WebCore/bindings/objc/DOMSVG.h
index c59532f..eda705e 100644
--- a/WebCore/bindings/objc/DOMSVG.h
+++ b/WebCore/bindings/objc/DOMSVG.h
@@ -63,6 +63,7 @@
 #import <WebCore/DOMSVGFEColorMatrixElement.h>
 #import <WebCore/DOMSVGFEComponentTransferElement.h>
 #import <WebCore/DOMSVGFECompositeElement.h>
+#import <WebCore/DOMSVGFEConvolveMatrixElement.h>
 #import <WebCore/DOMSVGFEDiffuseLightingElement.h>
 #import <WebCore/DOMSVGFEDisplacementMapElement.h>
 #import <WebCore/DOMSVGFEDistantLightElement.h>
diff --git a/WebCore/bindings/scripts/CodeGeneratorGObject.pm b/WebCore/bindings/scripts/CodeGeneratorGObject.pm
index ef2a125..ae4ac39 100644
--- a/WebCore/bindings/scripts/CodeGeneratorGObject.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorGObject.pm
@@ -192,7 +192,7 @@ sub SkipFunction {
     if ($isCustomFunction &&
         $functionName ne "webkit_dom_node_replace_child" &&
         $functionName ne "webkit_dom_node_insert_before" &&
-        $functionName ne "webkit_dom_node_replace_child" &&
+        $functionName ne "webkit_dom_node_remove_child" &&
         $functionName ne "webkit_dom_node_append_child" &&
         $functionName ne "webkit_dom_html_collection_item" &&
         $functionName ne "webkit_dom_html_collection_named_item") {
@@ -504,7 +504,7 @@ EOF
     my ${listenerName} = $domSignalName . "Listener";
 
     my $txtInstallEventListener = << "EOF";
-    RefPtr<WebCore::GObjectEventListener> ${listenerName} = WebCore::GObjectEventListener::create(reinterpret_cast<GObject*>(wrapper), "${gobjectSignalName}");
+    RefPtr<WebCore::GObjectEventListener> ${listenerName} = WebCore::GObjectEventListener::create(reinterpret_cast<GObject*>(object), "${gobjectSignalName}");
     coreObject->addEventListener("${domSignalName}", ${listenerName}, false);
 EOF
     push(@txtInstallEventListeners, $txtInstallEventListener);
@@ -536,6 +536,7 @@ EOF
     my $txtGetProp = << "EOF";
 static void ${lowerCaseIfaceName}_get_property(GObject* object, guint prop_id, GValue* value, GParamSpec* pspec)
 {
+    WebCore::JSMainThreadNullState state;
 EOF
     push(@txtGetProps, $txtGetProp);
     if (scalar @readableProperties > 0) {
@@ -556,6 +557,7 @@ EOF
     my $txtSetProps = << "EOF";
 static void ${lowerCaseIfaceName}_set_property(GObject* object, guint prop_id, const GValue* value, GParamSpec* pspec)
 {
+    WebCore::JSMainThreadNullState state;
 EOF
     push(@txtSetProps, $txtSetProps);
 
@@ -625,12 +627,31 @@ static void ${lowerCaseIfaceName}_finalize(GObject* object)
 
 @txtGetProps
 
+static void ${lowerCaseIfaceName}_constructed(GObject* object)
+{
+EOF
+    push(@cBodyPriv, $implContent);
+
+    if (scalar @txtInstallEventListeners > 0) {
+        $implContent = << "EOF";
+    WebCore::${interfaceName}* coreObject = static_cast<WebCore::${interfaceName}*>(WEBKIT_DOM_OBJECT(object)->coreObject);
+EOF
+    push(@cBodyPriv, $implContent);
+    }
+
+    $implContent = << "EOF";
+@txtInstallEventListeners
+    if (G_OBJECT_CLASS(${lowerCaseIfaceName}_parent_class)->constructed)
+        G_OBJECT_CLASS(${lowerCaseIfaceName}_parent_class)->constructed(object);
+}
+
 static void ${lowerCaseIfaceName}_class_init(${className}Class* requestClass)
 {
     GObjectClass *gobjectClass = G_OBJECT_CLASS(requestClass);
     gobjectClass->finalize = ${lowerCaseIfaceName}_finalize;
     gobjectClass->set_property = ${lowerCaseIfaceName}_set_property;
     gobjectClass->get_property = ${lowerCaseIfaceName}_get_property;
+    gobjectClass->constructed = ${lowerCaseIfaceName}_constructed;
 
 @txtInstallProps
 @txtInstallSignals
@@ -823,6 +844,7 @@ sub GenerateFunction {
 
     push(@cBody, "#if ${conditionalString}\n") if $conditionalString;
     push(@cBody, "$returnType\n$functionName($functionSig)\n{\n");
+    push(@cBody, "    WebCore::JSMainThreadNullState state;\n");
 
     if ($conditionalMethods{$functionName}) {
         push(@cBody, "#if ENABLE($conditionalMethods{$functionName})\n");
@@ -1101,20 +1123,15 @@ namespace WebKit {
 ${className}* wrap${interfaceName}(WebCore::${interfaceName}* coreObject)
 {
     g_return_val_if_fail(coreObject, 0);
-    
-    ${className}* wrapper = WEBKIT_DOM_${clsCaps}(g_object_new(WEBKIT_TYPE_DOM_${clsCaps}, NULL));
-    g_return_val_if_fail(wrapper, 0);
 
     /* We call ref() rather than using a C++ smart pointer because we can't store a C++ object
      * in a C-allocated GObject structure.  See the finalize() code for the
      * matching deref().
      */
-
     coreObject->ref();
-    WEBKIT_DOM_OBJECT(wrapper)->coreObject = coreObject;
-@txtInstallEventListeners
 
-    return wrapper;
+    return  WEBKIT_DOM_${clsCaps}(g_object_new(WEBKIT_TYPE_DOM_${clsCaps},
+                                               "core-object", coreObject, NULL));
 }
 } // namespace WebKit
 EOF
@@ -1264,6 +1281,7 @@ sub Generate {
     $implIncludes{"webkit/$className.h"} = 1;
     $implIncludes{"webkit/${className}Private.h"} = 1;
     $implIncludes{"${interfaceName}.h"} = 1;
+    $implIncludes{"JSMainThreadExecState.h"} = 1;
     $implIncludes{"ExceptionCode.h"} = 1;
 
     $hdrIncludes{"webkit/${parentClassName}.h"} = 1;
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 4e2e911..4c0cbe1 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -2179,7 +2179,11 @@ sub GenerateCallbackImplementation
 
             foreach my $param (@params) {
                 my $paramName = $param->name;
-                push(@implContent, "    args.append(toJS(exec, ${paramName}));\n");
+                if ($param->type eq "DOMString") {
+                    push(@implContent, "    args.append(jsString(exec, ${paramName}));\n");
+                } else {
+                    push(@implContent, "    args.append(toJS(exec, ${paramName}));\n");
+                }
             }
 
             push(@implContent, "\n    bool raisedException = false;\n");
@@ -2259,6 +2263,7 @@ my %nativeType = (
     "DOMObject" => "ScriptValue",
     "NodeFilter" => "RefPtr<NodeFilter>",
     "SerializedScriptValue" => "RefPtr<SerializedScriptValue>",
+    "IDBKey" => "RefPtr<IDBKey>",
     "SVGAngle" => "SVGAngle",
     "SVGLength" => "SVGLength",
     "SVGMatrix" => "AffineTransform",
@@ -2326,6 +2331,12 @@ sub JSValueToNative
         return "SerializedScriptValue::create(exec, $value)";
     }
 
+    if ($type eq "IDBKey") {
+        $implIncludes{"IDBBindingUtilities.h"} = 1;
+        $implIncludes{"IDBKey.h"} = 1;
+        return "createIDBKeyFromValue(exec, $value)";
+    }
+
     $implIncludes{"FloatPoint.h"} = 1 if $type eq "SVGPoint";
     $implIncludes{"FloatRect.h"} = 1 if $type eq "SVGRect";
     $implIncludes{"HTMLOptionElement.h"} = 1 if $type eq "HTMLOptionElement";
diff --git a/WebCore/bindings/scripts/CodeGeneratorV8.pm b/WebCore/bindings/scripts/CodeGeneratorV8.pm
index e249caa..1ae0f8f 100644
--- a/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -2748,6 +2748,8 @@ sub GetNativeType
 
     return "RefPtr<SerializedScriptValue>" if $type eq "SerializedScriptValue";
 
+    return "RefPtr<IDBKey>" if $type eq "IDBKey";
+
     # necessary as resolvers could be constructed on fly.
     return "RefPtr<XPathNSResolver>" if $type eq "XPathNSResolver";
 
@@ -2829,6 +2831,12 @@ sub JSValueToNative
 
     die "Unexpected SerializedScriptValue" if $type eq "SerializedScriptValue";
 
+    if ($type eq "IDBKey") {
+        $implIncludes{"IDBBindingUtilities.h"} = 1;
+        $implIncludes{"IDBKey.h"} = 1;
+        return "createIDBKeyFromValue($value)";
+    }
+
     if ($type eq "DOMObject") {
         $implIncludes{"ScriptValue.h"} = 1;
         return "ScriptValue($value)";
@@ -2985,7 +2993,8 @@ my %non_wrapper_types = (
     'DOMObject' => 1,
     'EventTarget' => 1,
     'NodeFilter' => 1,
-    'EventListener' => 1
+    'EventListener' => 1,
+    'IDBKey' => 1
 );
 
 
diff --git a/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp b/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
index 65bc9f3..ee8afcf 100644
--- a/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
+++ b/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.cpp
@@ -23,9 +23,11 @@
 
 #include "AtomicString.h"
 #include "HTMLNames.h"
+#include "IDBKey.h"
 #include "KURL.h"
 #include "SerializedScriptValue.h"
 #include "TestObj.h"
+#include "WebDOMIDBKey.h"
 #include "WebDOMString.h"
 #include "WebExceptionHandler.h"
 #include "WebNativeEventListener.h"
@@ -549,6 +551,14 @@ void WebDOMTestObj::serializedValue(const WebDOMString& serializedArg)
     impl()->serializedValue(WebCore::SerializedScriptValue::create(WebCore::String(serializedArg)));
 }
 
+void WebDOMTestObj::idbKey(const WebDOMIDBKey& key)
+{
+    if (!impl())
+        return;
+
+    impl()->idbKey(toWebCore(key));
+}
+
 void WebDOMTestObj::methodWithException()
 {
     if (!impl())
diff --git a/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h b/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
index 33bc7fb..cdd47ed 100644
--- a/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
+++ b/WebCore/bindings/scripts/test/CPP/WebDOMTestObj.h
@@ -31,6 +31,7 @@ class TestObj;
 };
 
 class WebDOMEventListener;
+class WebDOMIDBKey;
 class WebDOMString;
 class WebDOMTestObj;
 
@@ -101,6 +102,7 @@ public:
     WebDOMTestObj methodThatRequiresAllArgs(const WebDOMString& strArg, const WebDOMTestObj& objArg);
     WebDOMTestObj methodThatRequiresAllArgsAndThrows(const WebDOMString& strArg, const WebDOMTestObj& objArg);
     void serializedValue(const WebDOMString& serializedArg);
+    void idbKey(const WebDOMIDBKey& key);
     void methodWithException();
     void customMethod();
     void customMethodWithArgs(int intArg, const WebDOMString& strArg, const WebDOMTestObj& objArg);
diff --git a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp
index 94f4ca5..6581b1f 100644
--- a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp
+++ b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestCallback.cpp
@@ -26,6 +26,7 @@
 #include <wtf/GetPtr.h>
 #include <wtf/RefPtr.h>
 #include "ExceptionCode.h"
+#include "JSMainThreadExecState.h"
 #include "TestCallback.h"
 #include "WebKitDOMBinding.h"
 #include "gobject/ConvertToUTF8String.h"
@@ -57,6 +58,7 @@ gpointer kit(WebCore::TestCallback* obj)
 gboolean
 webkit_dom_test_callback_callback_with_class1param(WebKitDOMTestCallback* self, WebKitDOMClass1*  class1param)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestCallback * item = WebKit::core(self);
     g_return_val_if_fail(class1param, 0);
@@ -69,6 +71,7 @@ webkit_dom_test_callback_callback_with_class1param(WebKitDOMTestCallback* self,
 gboolean
 webkit_dom_test_callback_callback_with_class2param(WebKitDOMTestCallback* self, WebKitDOMClass2*  class2param, gchar*  str_arg)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestCallback * item = WebKit::core(self);
     g_return_val_if_fail(class2param, 0);
@@ -83,6 +86,7 @@ webkit_dom_test_callback_callback_with_class2param(WebKitDOMTestCallback* self,
 glong
 webkit_dom_test_callback_callback_with_non_bool_return_type(WebKitDOMTestCallback* self, WebKitDOMClass3*  class3param)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestCallback * item = WebKit::core(self);
     g_return_val_if_fail(class3param, 0);
@@ -131,6 +135,7 @@ static void webkit_dom_test_callback_finalize(GObject* object)
 
 static void webkit_dom_test_callback_set_property(GObject* object, guint prop_id, const GValue* value, GParamSpec* pspec)
 {
+    WebCore::JSMainThreadNullState state;
     switch (prop_id) {
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
@@ -141,6 +146,7 @@ static void webkit_dom_test_callback_set_property(GObject* object, guint prop_id
 
 static void webkit_dom_test_callback_get_property(GObject* object, guint prop_id, GValue* value, GParamSpec* pspec)
 {
+    WebCore::JSMainThreadNullState state;
     switch (prop_id) {
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
@@ -149,12 +155,20 @@ static void webkit_dom_test_callback_get_property(GObject* object, guint prop_id
 }
 
 
+static void webkit_dom_test_callback_constructed(GObject* object)
+{
+
+    if (G_OBJECT_CLASS(webkit_dom_test_callback_parent_class)->constructed)
+        G_OBJECT_CLASS(webkit_dom_test_callback_parent_class)->constructed(object);
+}
+
 static void webkit_dom_test_callback_class_init(WebKitDOMTestCallbackClass* requestClass)
 {
     GObjectClass *gobjectClass = G_OBJECT_CLASS(requestClass);
     gobjectClass->finalize = webkit_dom_test_callback_finalize;
     gobjectClass->set_property = webkit_dom_test_callback_set_property;
     gobjectClass->get_property = webkit_dom_test_callback_get_property;
+    gobjectClass->constructed = webkit_dom_test_callback_constructed;
 
 
 
@@ -168,20 +182,15 @@ namespace WebKit {
 WebKitDOMTestCallback* wrapTestCallback(WebCore::TestCallback* coreObject)
 {
     g_return_val_if_fail(coreObject, 0);
-    
-    WebKitDOMTestCallback* wrapper = WEBKIT_DOM_TEST_CALLBACK(g_object_new(WEBKIT_TYPE_DOM_TEST_CALLBACK, NULL));
-    g_return_val_if_fail(wrapper, 0);
 
     /* We call ref() rather than using a C++ smart pointer because we can't store a C++ object
      * in a C-allocated GObject structure.  See the finalize() code for the
      * matching deref().
      */
-
     coreObject->ref();
-    WEBKIT_DOM_OBJECT(wrapper)->coreObject = coreObject;
-
 
-    return wrapper;
+    return  WEBKIT_DOM_TEST_CALLBACK(g_object_new(WEBKIT_TYPE_DOM_TEST_CALLBACK,
+                                               "core-object", coreObject, NULL));
 }
 } // namespace WebKit
 #endif /* ENABLE(DATABASE) */
diff --git a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
index af22530..a13da45 100644
--- a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
+++ b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestInterface.cpp
@@ -26,6 +26,7 @@
 #include <wtf/GetPtr.h>
 #include <wtf/RefPtr.h>
 #include "ExceptionCode.h"
+#include "JSMainThreadExecState.h"
 #include "TestInterface.h"
 #include "WebKitDOMBinding.h"
 #include "gobject/ConvertToUTF8String.h"
@@ -87,6 +88,7 @@ static void webkit_dom_test_interface_finalize(GObject* object)
 
 static void webkit_dom_test_interface_set_property(GObject* object, guint prop_id, const GValue* value, GParamSpec* pspec)
 {
+    WebCore::JSMainThreadNullState state;
     switch (prop_id) {
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
@@ -97,6 +99,7 @@ static void webkit_dom_test_interface_set_property(GObject* object, guint prop_i
 
 static void webkit_dom_test_interface_get_property(GObject* object, guint prop_id, GValue* value, GParamSpec* pspec)
 {
+    WebCore::JSMainThreadNullState state;
     switch (prop_id) {
     default:
         G_OBJECT_WARN_INVALID_PROPERTY_ID(object, prop_id, pspec);
@@ -105,12 +108,20 @@ static void webkit_dom_test_interface_get_property(GObject* object, guint prop_i
 }
 
 
+static void webkit_dom_test_interface_constructed(GObject* object)
+{
+
+    if (G_OBJECT_CLASS(webkit_dom_test_interface_parent_class)->constructed)
+        G_OBJECT_CLASS(webkit_dom_test_interface_parent_class)->constructed(object);
+}
+
 static void webkit_dom_test_interface_class_init(WebKitDOMTestInterfaceClass* requestClass)
 {
     GObjectClass *gobjectClass = G_OBJECT_CLASS(requestClass);
     gobjectClass->finalize = webkit_dom_test_interface_finalize;
     gobjectClass->set_property = webkit_dom_test_interface_set_property;
     gobjectClass->get_property = webkit_dom_test_interface_get_property;
+    gobjectClass->constructed = webkit_dom_test_interface_constructed;
 
 
 
@@ -124,20 +135,15 @@ namespace WebKit {
 WebKitDOMTestInterface* wrapTestInterface(WebCore::TestInterface* coreObject)
 {
     g_return_val_if_fail(coreObject, 0);
-    
-    WebKitDOMTestInterface* wrapper = WEBKIT_DOM_TEST_INTERFACE(g_object_new(WEBKIT_TYPE_DOM_TEST_INTERFACE, NULL));
-    g_return_val_if_fail(wrapper, 0);
 
     /* We call ref() rather than using a C++ smart pointer because we can't store a C++ object
      * in a C-allocated GObject structure.  See the finalize() code for the
      * matching deref().
      */
-
     coreObject->ref();
-    WEBKIT_DOM_OBJECT(wrapper)->coreObject = coreObject;
-
 
-    return wrapper;
+    return  WEBKIT_DOM_TEST_INTERFACE(g_object_new(WEBKIT_TYPE_DOM_TEST_INTERFACE,
+                                               "core-object", coreObject, NULL));
 }
 } // namespace WebKit
 #endif /* ENABLE(Condition1) || ENABLE(Condition2) */
diff --git a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
index efb362b..3fcd3f7 100644
--- a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
+++ b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.cpp
@@ -25,9 +25,12 @@
 #include <wtf/RefPtr.h>
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
+#include "JSMainThreadExecState.h"
 #include "TestObj.h"
 #include "WebKitDOMBinding.h"
 #include "gobject/ConvertToUTF8String.h"
+#include "webkit/WebKitDOMIDBKey.h"
+#include "webkit/WebKitDOMIDBKeyPrivate.h"
 #include "webkit/WebKitDOMSerializedScriptValue.h"
 #include "webkit/WebKitDOMSerializedScriptValuePrivate.h"
 #include "webkit/WebKitDOMTestObj.h"
@@ -52,6 +55,7 @@ gpointer kit(WebCore::TestObj* obj)
 void
 webkit_dom_test_obj_void_method(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->voidMethod();
@@ -60,6 +64,7 @@ webkit_dom_test_obj_void_method(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_void_method_with_args(WebKitDOMTestObj* self, glong int_arg, gchar*  str_arg, WebKitDOMTestObj*  obj_arg)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_if_fail(str_arg);
@@ -73,6 +78,7 @@ webkit_dom_test_obj_void_method_with_args(WebKitDOMTestObj* self, glong int_arg,
 glong
 webkit_dom_test_obj_int_method(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->intMethod();
@@ -82,6 +88,7 @@ webkit_dom_test_obj_int_method(WebKitDOMTestObj* self)
 glong
 webkit_dom_test_obj_int_method_with_args(WebKitDOMTestObj* self, glong int_arg, gchar*  str_arg, WebKitDOMTestObj*  obj_arg)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_val_if_fail(str_arg, 0);
@@ -96,6 +103,7 @@ webkit_dom_test_obj_int_method_with_args(WebKitDOMTestObj* self, glong int_arg,
 WebKitDOMTestObj* 
 webkit_dom_test_obj_obj_method(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->objMethod());
@@ -106,6 +114,7 @@ webkit_dom_test_obj_obj_method(WebKitDOMTestObj* self)
 WebKitDOMTestObj* 
 webkit_dom_test_obj_obj_method_with_args(WebKitDOMTestObj* self, glong int_arg, gchar*  str_arg, WebKitDOMTestObj*  obj_arg)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_val_if_fail(str_arg, 0);
@@ -121,6 +130,7 @@ webkit_dom_test_obj_obj_method_with_args(WebKitDOMTestObj* self, glong int_arg,
 WebKitDOMTestObj* 
 webkit_dom_test_obj_method_that_requires_all_args(WebKitDOMTestObj* self, gchar*  str_arg, WebKitDOMTestObj*  obj_arg)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_val_if_fail(str_arg, 0);
@@ -136,6 +146,7 @@ webkit_dom_test_obj_method_that_requires_all_args(WebKitDOMTestObj* self, gchar*
 WebKitDOMTestObj* 
 webkit_dom_test_obj_method_that_requires_all_args_and_throws(WebKitDOMTestObj* self, gchar*  str_arg, WebKitDOMTestObj*  obj_arg, GError **error)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_val_if_fail(str_arg, 0);
@@ -157,6 +168,7 @@ webkit_dom_test_obj_method_that_requires_all_args_and_throws(WebKitDOMTestObj* s
 void
 webkit_dom_test_obj_serialized_value(WebKitDOMTestObj* self, WebKitDOMSerializedScriptValue*  serialized_arg)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_if_fail(serialized_arg);
@@ -166,8 +178,20 @@ webkit_dom_test_obj_serialized_value(WebKitDOMTestObj* self, WebKitDOMSerialized
 }
 
 void
+webkit_dom_test_obj_idb_key(WebKitDOMTestObj* self, WebKitDOMIDBKey*  key)
+{
+    g_return_if_fail(self);
+    WebCore::TestObj * item = WebKit::core(self);
+    g_return_if_fail(key);
+    WebCore::IDBKey * converted_key = WebKit::core(key);
+    g_return_if_fail(converted_key);
+    item->idbKey(converted_key);
+}
+
+void
 webkit_dom_test_obj_method_with_exception(WebKitDOMTestObj* self, GError **error)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     WebCore::ExceptionCode ec = 0;
@@ -188,6 +212,7 @@ webkit_dom_test_obj_method_with_exception(WebKitDOMTestObj* self, GError **error
 void
 webkit_dom_test_obj_with_dynamic_frame(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->withDynamicFrame();
@@ -196,6 +221,7 @@ webkit_dom_test_obj_with_dynamic_frame(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_with_dynamic_frame_and_arg(WebKitDOMTestObj* self, glong int_arg)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->withDynamicFrameAndArg(int_arg);
@@ -204,6 +230,7 @@ webkit_dom_test_obj_with_dynamic_frame_and_arg(WebKitDOMTestObj* self, glong int
 void
 webkit_dom_test_obj_with_dynamic_frame_and_optional_arg(WebKitDOMTestObj* self, glong int_arg, glong optional_arg)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->withDynamicFrameAndOptionalArg(int_arg, optional_arg);
@@ -212,6 +239,7 @@ webkit_dom_test_obj_with_dynamic_frame_and_optional_arg(WebKitDOMTestObj* self,
 void
 webkit_dom_test_obj_with_dynamic_frame_and_user_gesture(WebKitDOMTestObj* self, glong int_arg)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->withDynamicFrameAndUserGesture(int_arg);
@@ -220,6 +248,7 @@ webkit_dom_test_obj_with_dynamic_frame_and_user_gesture(WebKitDOMTestObj* self,
 void
 webkit_dom_test_obj_with_dynamic_frame_and_user_gesture_asad(WebKitDOMTestObj* self, glong int_arg, glong optional_arg)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->withDynamicFrameAndUserGestureASAD(int_arg, optional_arg);
@@ -228,6 +257,7 @@ webkit_dom_test_obj_with_dynamic_frame_and_user_gesture_asad(WebKitDOMTestObj* s
 void
 webkit_dom_test_obj_with_script_state_void(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->withScriptStateVoid();
@@ -236,6 +266,7 @@ webkit_dom_test_obj_with_script_state_void(WebKitDOMTestObj* self)
 WebKitDOMTestObj* 
 webkit_dom_test_obj_with_script_state_obj(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->withScriptStateObj());
@@ -246,6 +277,7 @@ webkit_dom_test_obj_with_script_state_obj(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_with_script_state_void_exception(WebKitDOMTestObj* self, GError **error)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     WebCore::ExceptionCode ec = 0;
@@ -260,6 +292,7 @@ webkit_dom_test_obj_with_script_state_void_exception(WebKitDOMTestObj* self, GEr
 WebKitDOMTestObj* 
 webkit_dom_test_obj_with_script_state_obj_exception(WebKitDOMTestObj* self, GError **error)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     WebCore::ExceptionCode ec = 0;
@@ -276,6 +309,7 @@ webkit_dom_test_obj_with_script_state_obj_exception(WebKitDOMTestObj* self, GErr
 void
 webkit_dom_test_obj_with_script_execution_context(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->withScriptExecutionContext();
@@ -284,6 +318,7 @@ webkit_dom_test_obj_with_script_execution_context(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_method_with_optional_arg(WebKitDOMTestObj* self, glong opt)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->methodWithOptionalArg(opt);
@@ -292,6 +327,7 @@ webkit_dom_test_obj_method_with_optional_arg(WebKitDOMTestObj* self, glong opt)
 void
 webkit_dom_test_obj_method_with_non_optional_arg_and_optional_arg(WebKitDOMTestObj* self, glong non_opt, glong opt)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->methodWithNonOptionalArgAndOptionalArg(non_opt, opt);
@@ -300,6 +336,7 @@ webkit_dom_test_obj_method_with_non_optional_arg_and_optional_arg(WebKitDOMTestO
 void
 webkit_dom_test_obj_method_with_non_optional_arg_and_two_optional_args(WebKitDOMTestObj* self, glong non_opt, glong opt1, glong opt2)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->methodWithNonOptionalArgAndTwoOptionalArgs(non_opt, opt1, opt2);
@@ -308,6 +345,7 @@ webkit_dom_test_obj_method_with_non_optional_arg_and_two_optional_args(WebKitDOM
 glong
 webkit_dom_test_obj_get_read_only_int_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->readOnlyIntAttr();
@@ -317,6 +355,7 @@ webkit_dom_test_obj_get_read_only_int_attr(WebKitDOMTestObj* self)
 gchar* 
 webkit_dom_test_obj_get_read_only_string_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gchar*  res = convertToUTF8String(item->readOnlyStringAttr());
@@ -326,6 +365,7 @@ webkit_dom_test_obj_get_read_only_string_attr(WebKitDOMTestObj* self)
 WebKitDOMTestObj* 
 webkit_dom_test_obj_get_read_only_test_obj_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->readOnlyTestObjAttr());
@@ -336,6 +376,7 @@ webkit_dom_test_obj_get_read_only_test_obj_attr(WebKitDOMTestObj* self)
 glong
 webkit_dom_test_obj_get_int_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->intAttr();
@@ -345,6 +386,7 @@ webkit_dom_test_obj_get_int_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_int_attr(WebKitDOMTestObj* self, glong value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setIntAttr(value);
@@ -353,6 +395,7 @@ webkit_dom_test_obj_set_int_attr(WebKitDOMTestObj* self, glong value)
 gint64
 webkit_dom_test_obj_get_long_long_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gint64 res = item->longLongAttr();
@@ -362,6 +405,7 @@ webkit_dom_test_obj_get_long_long_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_long_long_attr(WebKitDOMTestObj* self, gint64 value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setLongLongAttr(value);
@@ -370,6 +414,7 @@ webkit_dom_test_obj_set_long_long_attr(WebKitDOMTestObj* self, gint64 value)
 guint64
 webkit_dom_test_obj_get_unsigned_long_long_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     guint64 res = item->unsignedLongLongAttr();
@@ -379,6 +424,7 @@ webkit_dom_test_obj_get_unsigned_long_long_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_unsigned_long_long_attr(WebKitDOMTestObj* self, guint64 value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setUnsignedLongLongAttr(value);
@@ -387,6 +433,7 @@ webkit_dom_test_obj_set_unsigned_long_long_attr(WebKitDOMTestObj* self, guint64
 gchar* 
 webkit_dom_test_obj_get_string_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gchar*  res = convertToUTF8String(item->stringAttr());
@@ -396,6 +443,7 @@ webkit_dom_test_obj_get_string_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_string_attr(WebKitDOMTestObj* self, gchar*  value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_if_fail(value);
@@ -406,6 +454,7 @@ webkit_dom_test_obj_set_string_attr(WebKitDOMTestObj* self, gchar*  value)
 WebKitDOMTestObj* 
 webkit_dom_test_obj_get_test_obj_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     PassRefPtr<WebCore::TestObj> g_res = WTF::getPtr(item->testObjAttr());
@@ -416,6 +465,7 @@ webkit_dom_test_obj_get_test_obj_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_test_obj_attr(WebKitDOMTestObj* self, WebKitDOMTestObj*  value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_if_fail(value);
@@ -427,6 +477,7 @@ webkit_dom_test_obj_set_test_obj_attr(WebKitDOMTestObj* self, WebKitDOMTestObj*
 gchar* 
 webkit_dom_test_obj_get_reflected_string_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gchar*  res = convertToUTF8String(item->getAttribute(WebCore::HTMLNames::reflectedstringattrAttr));
@@ -436,6 +487,7 @@ webkit_dom_test_obj_get_reflected_string_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_reflected_string_attr(WebKitDOMTestObj* self, gchar*  value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_if_fail(value);
@@ -446,6 +498,7 @@ webkit_dom_test_obj_set_reflected_string_attr(WebKitDOMTestObj* self, gchar*  va
 glong
 webkit_dom_test_obj_get_reflected_integral_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->getIntegralAttribute(WebCore::HTMLNames::reflectedintegralattrAttr);
@@ -455,6 +508,7 @@ webkit_dom_test_obj_get_reflected_integral_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_reflected_integral_attr(WebKitDOMTestObj* self, glong value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setIntegralAttribute(WebCore::HTMLNames::reflectedintegralattrAttr, value);
@@ -463,6 +517,7 @@ webkit_dom_test_obj_set_reflected_integral_attr(WebKitDOMTestObj* self, glong va
 gboolean
 webkit_dom_test_obj_get_reflected_boolean_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gboolean res = item->hasAttribute(WebCore::HTMLNames::reflectedbooleanattrAttr);
@@ -472,6 +527,7 @@ webkit_dom_test_obj_get_reflected_boolean_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_reflected_boolean_attr(WebKitDOMTestObj* self, gboolean value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setBooleanAttribute(WebCore::HTMLNames::reflectedbooleanattrAttr, value);
@@ -480,6 +536,7 @@ webkit_dom_test_obj_set_reflected_boolean_attr(WebKitDOMTestObj* self, gboolean
 gchar* 
 webkit_dom_test_obj_get_reflected_url_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gchar*  res = convertToUTF8String(item->getURLAttribute(WebCore::HTMLNames::reflectedurlattrAttr));
@@ -489,6 +546,7 @@ webkit_dom_test_obj_get_reflected_url_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_reflected_url_attr(WebKitDOMTestObj* self, gchar*  value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_if_fail(value);
@@ -499,6 +557,7 @@ webkit_dom_test_obj_set_reflected_url_attr(WebKitDOMTestObj* self, gchar*  value
 gchar* 
 webkit_dom_test_obj_get_reflected_string_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gchar*  res = convertToUTF8String(item->getAttribute(WebCore::HTMLNames::customContentStringAttrAttr));
@@ -508,6 +567,7 @@ webkit_dom_test_obj_get_reflected_string_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_reflected_string_attr(WebKitDOMTestObj* self, gchar*  value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_if_fail(value);
@@ -518,6 +578,7 @@ webkit_dom_test_obj_set_reflected_string_attr(WebKitDOMTestObj* self, gchar*  va
 glong
 webkit_dom_test_obj_get_reflected_custom_integral_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->getIntegralAttribute(WebCore::HTMLNames::customContentIntegralAttrAttr);
@@ -527,6 +588,7 @@ webkit_dom_test_obj_get_reflected_custom_integral_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_reflected_custom_integral_attr(WebKitDOMTestObj* self, glong value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setIntegralAttribute(WebCore::HTMLNames::customContentIntegralAttrAttr, value);
@@ -535,6 +597,7 @@ webkit_dom_test_obj_set_reflected_custom_integral_attr(WebKitDOMTestObj* self, g
 gboolean
 webkit_dom_test_obj_get_reflected_custom_boolean_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gboolean res = item->hasAttribute(WebCore::HTMLNames::customContentBooleanAttrAttr);
@@ -544,6 +607,7 @@ webkit_dom_test_obj_get_reflected_custom_boolean_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_reflected_custom_boolean_attr(WebKitDOMTestObj* self, gboolean value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setBooleanAttribute(WebCore::HTMLNames::customContentBooleanAttrAttr, value);
@@ -552,6 +616,7 @@ webkit_dom_test_obj_set_reflected_custom_boolean_attr(WebKitDOMTestObj* self, gb
 gchar* 
 webkit_dom_test_obj_get_reflected_url_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gchar*  res = convertToUTF8String(item->getURLAttribute(WebCore::HTMLNames::customContentURLAttrAttr));
@@ -561,6 +626,7 @@ webkit_dom_test_obj_get_reflected_url_attr(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_reflected_url_attr(WebKitDOMTestObj* self, gchar*  value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_if_fail(value);
@@ -571,6 +637,7 @@ webkit_dom_test_obj_set_reflected_url_attr(WebKitDOMTestObj* self, gchar*  value
 glong
 webkit_dom_test_obj_get_attr_with_getter_exception(WebKitDOMTestObj* self, GError **error)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     WebCore::ExceptionCode ec = 0;
@@ -586,6 +653,7 @@ webkit_dom_test_obj_get_attr_with_getter_exception(WebKitDOMTestObj* self, GErro
 void
 webkit_dom_test_obj_set_attr_with_getter_exception(WebKitDOMTestObj* self, glong value, GError **error)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     WebCore::ExceptionCode ec = 0;
@@ -600,6 +668,7 @@ webkit_dom_test_obj_set_attr_with_getter_exception(WebKitDOMTestObj* self, glong
 glong
 webkit_dom_test_obj_get_attr_with_setter_exception(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->attrWithSetterException();
@@ -609,6 +678,7 @@ webkit_dom_test_obj_get_attr_with_setter_exception(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_attr_with_setter_exception(WebKitDOMTestObj* self, glong value, GError **error)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     WebCore::ExceptionCode ec = 0;
@@ -623,6 +693,7 @@ webkit_dom_test_obj_set_attr_with_setter_exception(WebKitDOMTestObj* self, glong
 gchar* 
 webkit_dom_test_obj_get_string_attr_with_getter_exception(WebKitDOMTestObj* self, GError **error)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     WebCore::ExceptionCode ec = 0;
@@ -633,6 +704,7 @@ webkit_dom_test_obj_get_string_attr_with_getter_exception(WebKitDOMTestObj* self
 void
 webkit_dom_test_obj_set_string_attr_with_getter_exception(WebKitDOMTestObj* self, gchar*  value, GError **error)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_if_fail(value);
@@ -649,6 +721,7 @@ webkit_dom_test_obj_set_string_attr_with_getter_exception(WebKitDOMTestObj* self
 gchar* 
 webkit_dom_test_obj_get_string_attr_with_setter_exception(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gchar*  res = convertToUTF8String(item->stringAttrWithSetterException());
@@ -658,6 +731,7 @@ webkit_dom_test_obj_get_string_attr_with_setter_exception(WebKitDOMTestObj* self
 void
 webkit_dom_test_obj_set_string_attr_with_setter_exception(WebKitDOMTestObj* self, gchar*  value, GError **error)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     g_return_if_fail(value);
@@ -674,6 +748,7 @@ webkit_dom_test_obj_set_string_attr_with_setter_exception(WebKitDOMTestObj* self
 gchar* 
 webkit_dom_test_obj_get_script_string_attr(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gchar*  res = convertToUTF8String(item->scriptStringAttr());
@@ -684,6 +759,7 @@ webkit_dom_test_obj_get_script_string_attr(WebKitDOMTestObj* self)
 glong
 webkit_dom_test_obj_get_conditional_attr1(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->conditionalAttr1();
@@ -695,6 +771,7 @@ webkit_dom_test_obj_get_conditional_attr1(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_conditional_attr1(WebKitDOMTestObj* self, glong value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setConditionalAttr1(value);
@@ -705,6 +782,7 @@ webkit_dom_test_obj_set_conditional_attr1(WebKitDOMTestObj* self, glong value)
 glong
 webkit_dom_test_obj_get_conditional_attr2(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->conditionalAttr2();
@@ -716,6 +794,7 @@ webkit_dom_test_obj_get_conditional_attr2(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_conditional_attr2(WebKitDOMTestObj* self, glong value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setConditionalAttr2(value);
@@ -726,6 +805,7 @@ webkit_dom_test_obj_set_conditional_attr2(WebKitDOMTestObj* self, glong value)
 glong
 webkit_dom_test_obj_get_conditional_attr3(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->conditionalAttr3();
@@ -737,6 +817,7 @@ webkit_dom_test_obj_get_conditional_attr3(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_conditional_attr3(WebKitDOMTestObj* self, glong value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setConditionalAttr3(value);
@@ -746,6 +827,7 @@ webkit_dom_test_obj_set_conditional_attr3(WebKitDOMTestObj* self, glong value)
 glong
 webkit_dom_test_obj_get_description(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->description();
@@ -755,6 +837,7 @@ webkit_dom_test_obj_get_description(WebKitDOMTestObj* self)
 glong
 webkit_dom_test_obj_get_id(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     glong res = item->id();
@@ -764,6 +847,7 @@ webkit_dom_test_obj_get_id(WebKitDOMTestObj* self)
 void
 webkit_dom_test_obj_set_id(WebKitDOMTestObj* self, glong value)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_if_fail(self);
     WebCore::TestObj * item = WebKit::core(self);
     item->setId(value);
@@ -772,6 +856,7 @@ webkit_dom_test_obj_set_id(WebKitDOMTestObj* self, glong value)
 gchar* 
 webkit_dom_test_obj_get_hash(WebKitDOMTestObj* self)
 {
+    WebCore::JSMainThreadNullState state;
     g_return_val_if_fail(self, 0);
     WebCore::TestObj * item = WebKit::core(self);
     gchar*  res = convertToUTF8String(item->hash());
@@ -851,6 +936,7 @@ static void webkit_dom_test_obj_finalize(GObject* object)
 
 static void webkit_dom_test_obj_set_property(GObject* object, guint prop_id, const GValue* value, GParamSpec* pspec)
 {
+    WebCore::JSMainThreadNullState state;
     WebKitDOMTestObj* self = WEBKIT_DOM_TEST_OBJ(object);
     WebCore::TestObj* coreSelf = WebKit::core(self);
     switch (prop_id) {
@@ -968,6 +1054,7 @@ static void webkit_dom_test_obj_set_property(GObject* object, guint prop_id, con
 
 static void webkit_dom_test_obj_get_property(GObject* object, guint prop_id, GValue* value, GParamSpec* pspec)
 {
+    WebCore::JSMainThreadNullState state;
     WebKitDOMTestObj* self = WEBKIT_DOM_TEST_OBJ(object);
     WebCore::TestObj* coreSelf = WebKit::core(self);
     switch (prop_id) {
@@ -1123,12 +1210,20 @@ static void webkit_dom_test_obj_get_property(GObject* object, guint prop_id, GVa
 }
 
 
+static void webkit_dom_test_obj_constructed(GObject* object)
+{
+
+    if (G_OBJECT_CLASS(webkit_dom_test_obj_parent_class)->constructed)
+        G_OBJECT_CLASS(webkit_dom_test_obj_parent_class)->constructed(object);
+}
+
 static void webkit_dom_test_obj_class_init(WebKitDOMTestObjClass* requestClass)
 {
     GObjectClass *gobjectClass = G_OBJECT_CLASS(requestClass);
     gobjectClass->finalize = webkit_dom_test_obj_finalize;
     gobjectClass->set_property = webkit_dom_test_obj_set_property;
     gobjectClass->get_property = webkit_dom_test_obj_get_property;
+    gobjectClass->constructed = webkit_dom_test_obj_constructed;
 
     g_object_class_install_property(gobjectClass,
                                     PROP_READ_ONLY_INT_ATTR,
@@ -1363,19 +1458,14 @@ namespace WebKit {
 WebKitDOMTestObj* wrapTestObj(WebCore::TestObj* coreObject)
 {
     g_return_val_if_fail(coreObject, 0);
-    
-    WebKitDOMTestObj* wrapper = WEBKIT_DOM_TEST_OBJ(g_object_new(WEBKIT_TYPE_DOM_TEST_OBJ, NULL));
-    g_return_val_if_fail(wrapper, 0);
 
     /* We call ref() rather than using a C++ smart pointer because we can't store a C++ object
      * in a C-allocated GObject structure.  See the finalize() code for the
      * matching deref().
      */
-
     coreObject->ref();
-    WEBKIT_DOM_OBJECT(wrapper)->coreObject = coreObject;
-
 
-    return wrapper;
+    return  WEBKIT_DOM_TEST_OBJ(g_object_new(WEBKIT_TYPE_DOM_TEST_OBJ,
+                                               "core-object", coreObject, NULL));
 }
 } // namespace WebKit
diff --git a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
index 8dcd8c3..61c3d95 100644
--- a/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
+++ b/WebCore/bindings/scripts/test/GObject/WebKitDOMTestObj.h
@@ -74,6 +74,9 @@ WEBKIT_API void
 webkit_dom_test_obj_serialized_value(WebKitDOMTestObj* self, WebKitDOMSerializedScriptValue*  serialized_arg);
 
 WEBKIT_API void
+webkit_dom_test_obj_idb_key(WebKitDOMTestObj* self, WebKitDOMIDBKey*  key);
+
+WEBKIT_API void
 webkit_dom_test_obj_method_with_exception(WebKitDOMTestObj* self, GError **error);
 
 
diff --git a/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp b/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
index df403c6..043a6ed 100644
--- a/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
+++ b/WebCore/bindings/scripts/test/JS/JSTestCallback.cpp
@@ -89,7 +89,7 @@ bool JSTestCallback::callbackWithClass2Param(ScriptExecutionContext* context, Cl
     ExecState* exec = globalObject->globalExec();
     MarkedArgumentBuffer args;
     args.append(toJS(exec, class2Param));
-    args.append(toJS(exec, strArg));
+    args.append(jsString(exec, strArg));
 
     bool raisedException = false;
     m_data->invokeCallback(args, &raisedException);
diff --git a/WebCore/bindings/scripts/test/JS/JSTestObj.cpp b/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
index 360782d..31a3f70 100644
--- a/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
+++ b/WebCore/bindings/scripts/test/JS/JSTestObj.cpp
@@ -22,6 +22,8 @@
 #include "JSTestObj.h"
 
 #include "HTMLNames.h"
+#include "IDBBindingUtilities.h"
+#include "IDBKey.h"
 #include "JSEventListener.h"
 #include "JSTestObj.h"
 #include "JSlog.h"
@@ -144,7 +146,7 @@ bool JSTestObjConstructor::getOwnPropertyDescriptor(ExecState* exec, const Ident
 #define THUNK_GENERATOR(generator)
 #endif
 
-static const HashTableValue JSTestObjPrototypeTableValues[30] =
+static const HashTableValue JSTestObjPrototypeTableValues[31] =
 {
     { "voidMethod", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionVoidMethod), (intptr_t)0 THUNK_GENERATOR(0) },
     { "voidMethodWithArgs", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionVoidMethodWithArgs), (intptr_t)3 THUNK_GENERATOR(0) },
@@ -155,6 +157,7 @@ static const HashTableValue JSTestObjPrototypeTableValues[30] =
     { "methodThatRequiresAllArgs", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodThatRequiresAllArgs), (intptr_t)2 THUNK_GENERATOR(0) },
     { "methodThatRequiresAllArgsAndThrows", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows), (intptr_t)2 THUNK_GENERATOR(0) },
     { "serializedValue", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionSerializedValue), (intptr_t)1 THUNK_GENERATOR(0) },
+    { "idbKey", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionIdbKey), (intptr_t)1 THUNK_GENERATOR(0) },
     { "methodWithException", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionMethodWithException), (intptr_t)0 THUNK_GENERATOR(0) },
     { "customMethod", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionCustomMethod), (intptr_t)0 THUNK_GENERATOR(0) },
     { "customMethodWithArgs", DontDelete | Function, (intptr_t)static_cast<NativeFunction>(jsTestObjPrototypeFunctionCustomMethodWithArgs), (intptr_t)3 THUNK_GENERATOR(0) },
@@ -179,7 +182,7 @@ static const HashTableValue JSTestObjPrototypeTableValues[30] =
 };
 
 #undef THUNK_GENERATOR
-static JSC_CONST_HASHTABLE HashTable JSTestObjPrototypeTable = { 69, 63, JSTestObjPrototypeTableValues, 0 };
+static JSC_CONST_HASHTABLE HashTable JSTestObjPrototypeTable = { 130, 127, JSTestObjPrototypeTableValues, 0 };
 const ClassInfo JSTestObjPrototype::s_info = { "TestObjPrototype", 0, &JSTestObjPrototypeTable, 0 };
 
 JSObject* JSTestObjPrototype::self(ExecState* exec, JSGlobalObject* globalObject)
@@ -797,6 +800,19 @@ EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionSerializedValue(ExecState
     return JSValue::encode(jsUndefined());
 }
 
+EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionIdbKey(ExecState* exec)
+{
+    JSValue thisValue = exec->hostThisValue();
+    if (!thisValue.inherits(&JSTestObj::s_info))
+        return throwVMTypeError(exec);
+    JSTestObj* castedThis = static_cast<JSTestObj*>(asObject(thisValue));
+    TestObj* imp = static_cast<TestObj*>(castedThis->impl());
+    RefPtr<IDBKey> key = createIDBKeyFromValue(exec, exec->argument(0));
+
+    imp->idbKey(key);
+    return JSValue::encode(jsUndefined());
+}
+
 EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithException(ExecState* exec)
 {
     JSValue thisValue = exec->hostThisValue();
diff --git a/WebCore/bindings/scripts/test/JS/JSTestObj.h b/WebCore/bindings/scripts/test/JS/JSTestObj.h
index 3b21c85..4dea3d2 100644
--- a/WebCore/bindings/scripts/test/JS/JSTestObj.h
+++ b/WebCore/bindings/scripts/test/JS/JSTestObj.h
@@ -95,6 +95,7 @@ JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionObjMethodWithArgs(JS
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodThatRequiresAllArgs(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodThatRequiresAllArgsAndThrows(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionSerializedValue(JSC::ExecState*);
+JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionIdbKey(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionMethodWithException(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomMethod(JSC::ExecState*);
 JSC::EncodedJSValue JSC_HOST_CALL jsTestObjPrototypeFunctionCustomMethodWithArgs(JSC::ExecState*);
diff --git a/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h b/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
index d8862da..d38dece 100644
--- a/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
+++ b/WebCore/bindings/scripts/test/ObjC/DOMTestObj.h
@@ -28,6 +28,7 @@
 
 #if WEBKIT_VERSION_MAX_ALLOWED >= WEBKIT_VERSION_LATEST
 
+@class DOMIDBKey;
 @class DOMTestObj;
 @class DOMlog;
 @class NSString;
@@ -99,6 +100,7 @@
 - (DOMTestObj *)methodThatRequiresAllArgs:(NSString *)strArg objArg:(DOMTestObj *)objArg;
 - (DOMTestObj *)methodThatRequiresAllArgsAndThrows:(NSString *)strArg objArg:(DOMTestObj *)objArg;
 - (void)serializedValue:(NSString *)serializedArg;
+- (void)idbKey:(DOMIDBKey *)key;
 - (void)methodWithException;
 - (void)customMethod;
 - (void)customMethodWithArgs:(int)intArg strArg:(NSString *)strArg objArg:(DOMTestObj *)objArg;
diff --git a/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm b/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
index 9bbbf14..d71cb05 100644
--- a/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
+++ b/WebCore/bindings/scripts/test/ObjC/DOMTestObj.mm
@@ -33,6 +33,7 @@
 #import "DOMCSSRuleInternal.h"
 #import "DOMCSSValueInternal.h"
 #import "DOMEventInternal.h"
+#import "DOMIDBKeyInternal.h"
 #import "DOMNodeInternal.h"
 #import "DOMStyleSheetInternal.h"
 #import "DOMTestObjInternal.h"
@@ -40,6 +41,7 @@
 #import "EventListener.h"
 #import "ExceptionHandlers.h"
 #import "HTMLNames.h"
+#import "IDBKey.h"
 #import "JSMainThreadExecState.h"
 #import "KURL.h"
 #import "ObjCEventListener.h"
@@ -451,6 +453,12 @@
     IMPL->serializedValue(WebCore::SerializedScriptValue::create(WebCore::String(serializedArg)));
 }
 
+- (void)idbKey:(DOMIDBKey *)key
+{
+    WebCore::JSMainThreadNullState state;
+    IMPL->idbKey(core(key));
+}
+
 - (void)methodWithException
 {
     WebCore::JSMainThreadNullState state;
diff --git a/WebCore/bindings/scripts/test/TestObj.idl b/WebCore/bindings/scripts/test/TestObj.idl
index ef4db10..3467116 100644
--- a/WebCore/bindings/scripts/test/TestObj.idl
+++ b/WebCore/bindings/scripts/test/TestObj.idl
@@ -63,6 +63,7 @@ module test {
             raises(DOMException);
 
         void serializedValue(in SerializedScriptValue serializedArg);
+        void idbKey(in IDBKey key);
 
         // Exceptions
         void methodWithException() raises(DOMException);
diff --git a/WebCore/bindings/scripts/test/V8/V8TestObj.cpp b/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
index 4a54ae3..1ad8a41 100644
--- a/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
+++ b/WebCore/bindings/scripts/test/V8/V8TestObj.cpp
@@ -23,6 +23,8 @@
 
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
+#include "IDBBindingUtilities.h"
+#include "IDBKey.h"
 #include "RuntimeEnabledFeatures.h"
 #include "ScriptCallStack.h"
 #include "SerializedScriptValue.h"
@@ -573,6 +575,15 @@ static v8::Handle<v8::Value> serializedValueCallback(const v8::Arguments& args)
     return v8::Handle<v8::Value>();
 }
 
+static v8::Handle<v8::Value> idbKeyCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.TestObj.idbKey");
+    TestObj* imp = V8TestObj::toNative(args.Holder());
+    RefPtr<IDBKey> key = createIDBKeyFromValue(args[0]);
+    imp->idbKey(key);
+    return v8::Handle<v8::Value>();
+}
+
 static v8::Handle<v8::Value> methodWithExceptionCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.TestObj.methodWithException");
@@ -947,6 +958,7 @@ static const BatchedCallback TestObjCallbacks[] = {
     {"intMethod", TestObjInternal::intMethodCallback},
     {"objMethod", TestObjInternal::objMethodCallback},
     {"serializedValue", TestObjInternal::serializedValueCallback},
+    {"idbKey", TestObjInternal::idbKeyCallback},
     {"methodWithException", TestObjInternal::methodWithExceptionCallback},
     {"customMethod", V8TestObj::customMethodCallback},
     {"customMethodWithArgs", V8TestObj::customMethodWithArgsCallback},
diff --git a/WebCore/bindings/v8/IDBBindingUtilities.cpp b/WebCore/bindings/v8/IDBBindingUtilities.cpp
new file mode 100644
index 0000000..2f977e0
--- /dev/null
+++ b/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IDBBindingUtilities.h"
+
+#include "IDBKey.h"
+#include "V8Binding.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+PassRefPtr<IDBKey> createIDBKeyFromValue(v8::Handle<v8::Value> value)
+{
+    if (value->IsNull())
+        return IDBKey::create();
+    if (value->IsInt32())
+        return IDBKey::create(value->Int32Value());
+    if (value->IsString())
+        return IDBKey::create(v8ValueToWebCoreString(value));
+    // FIXME: Implement dates.
+    return 0;
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/bindings/v8/IDBBindingUtilities.h b/WebCore/bindings/v8/IDBBindingUtilities.h
new file mode 100644
index 0000000..04e5c29
--- /dev/null
+++ b/WebCore/bindings/v8/IDBBindingUtilities.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBBindingUtilities_h
+#define IDBBindingUtilities_h
+
+#include <v8.h>
+#include <wtf/PassRefPtr.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+class IDBKey;
+
+PassRefPtr<IDBKey> createIDBKeyFromValue(v8::Handle<v8::Value>);
+
+}
+
+#endif // ENABLE(INDEXED_DATABASE)
+
+#endif // IDBBindingUtilities_h
diff --git a/WebCore/bindings/v8/ScriptController.cpp b/WebCore/bindings/v8/ScriptController.cpp
index 6f17373..889642f 100644
--- a/WebCore/bindings/v8/ScriptController.cpp
+++ b/WebCore/bindings/v8/ScriptController.cpp
@@ -34,7 +34,7 @@
 
 #include "PlatformBridge.h"
 #include "Document.h"
-#include "DocumentParser.h"
+#include "ScriptableDocumentParser.h"
 #include "DOMWindow.h"
 #include "Event.h"
 #include "EventListener.h"
@@ -53,6 +53,7 @@
 #include "V8BindingState.h"
 #include "V8DOMWindow.h"
 #include "V8Event.h"
+#include "V8HiddenPropertyName.h"
 #include "V8HTMLEmbedElement.h"
 #include "V8IsolatedContext.h"
 #include "V8NPObject.h"
@@ -160,16 +161,13 @@ void ScriptController::updatePlatformScriptObjects()
 
 bool ScriptController::processingUserGesture(DOMWrapperWorld*) const
 {
-    Frame* activeFrame = V8Proxy::retrieveFrameForEnteredContext();
     // No script is running, so it is user-initiated unless the gesture stack
     // explicitly says it is not.
-    if (!activeFrame)
+    if (!m_proxy->executingScript())
         return UserGestureIndicator::getUserGestureState() != DefinitelyNotProcessingUserGesture;
 
-    V8Proxy* activeProxy = activeFrame->script()->proxy();
-
     v8::HandleScope handleScope;
-    v8::Handle<v8::Context> v8Context = V8Proxy::mainWorldContext(activeFrame);
+    v8::Handle<v8::Context> v8Context = m_proxy->mainWorldContext();
     // FIXME: find all cases context can be empty:
     //  1) JS is disabled;
     //  2) page is NULL;
@@ -179,33 +177,24 @@ bool ScriptController::processingUserGesture(DOMWrapperWorld*) const
     v8::Context::Scope scope(v8Context);
 
     v8::Handle<v8::Object> global = v8Context->Global();
-    v8::Handle<v8::Value> jsEvent = global->Get(v8::String::NewSymbol("event"));
+    v8::Handle<v8::String> eventSymbol = V8HiddenPropertyName::event();
+    v8::Handle<v8::Value> jsEvent = global->GetHiddenValue(eventSymbol);
     Event* event = V8DOMWrapper::isValidDOMObject(jsEvent) ? V8Event::toNative(v8::Handle<v8::Object>::Cast(jsEvent)) : 0;
 
-    // Based on code from kjs_bindings.cpp.
+    // Based on code from JSC's ScriptController::processingUserGesture.
     // Note: This is more liberal than Firefox's implementation.
     if (event) {
-        if (!UserGestureIndicator::processingUserGesture())
-            return false;
-
-        const AtomicString& type = event->type();
-        bool eventOk =
-            // mouse events
-            type == eventNames().clickEvent || type == eventNames().mousedownEvent || type == eventNames().mouseupEvent || type == eventNames().dblclickEvent
-            // keyboard events
-            || type == eventNames().keydownEvent || type == eventNames().keypressEvent || type == eventNames().keyupEvent
-            // other accepted events
-            || type == eventNames().selectEvent || type == eventNames().changeEvent || type == eventNames().focusEvent || type == eventNames().blurEvent || type == eventNames().submitEvent;
-
-        if (eventOk)
-            return true;
-    } else if (m_sourceURL && m_sourceURL->isNull() && !activeProxy->timerCallback()) {
+        // Event::fromUserGesture will return false when UserGestureIndicator::processingUserGesture() returns false.
+        return event->fromUserGesture();
+    }
+    if (m_sourceURL && m_sourceURL->isNull() && !m_proxy->timerCallback()) {
         // This is the <a href="javascript:window.open('...')> case -> we let it through.
         return true;
     }
 
     // This is the <script>window.open(...)</script> case or a timer callback -> block it.
-    return false;
+    // Based on JSC version, use returned value of UserGestureIndicator::processingUserGesture for all other situations. 
+    return UserGestureIndicator::processingUserGesture();
 }
 
 bool ScriptController::anyPageIsProcessingUserGesture() const
@@ -261,14 +250,16 @@ ScriptValue ScriptController::evaluate(const ScriptSourceCode& sourceCode, Shoul
 
 int ScriptController::eventHandlerLineNumber() const
 {
-    if (DocumentParser* parser = m_frame->document()->parser())
+    ScriptableDocumentParser* parser = m_frame->document()->scriptableDocumentParser();
+    if (parser)
         return parser->lineNumber();
     return 0;
 }
 
 int ScriptController::eventHandlerColumnNumber() const
 {
-    if (DocumentParser* parser = m_frame->document()->parser())
+    ScriptableDocumentParser* parser = m_frame->document()->scriptableDocumentParser();
+    if (parser)
         return parser->columnNumber();
     return 0;
 }
diff --git a/WebCore/bindings/v8/ScriptDebugServer.cpp b/WebCore/bindings/v8/ScriptDebugServer.cpp
index 38fcd8a..8553ee5 100644
--- a/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -126,7 +126,7 @@ void ScriptDebugServer::removeListener(ScriptDebugListener* listener, Page* page
     // FIXME: Remove all breakpoints set by the agent.
 }
 
-void ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNumber, ScriptBreakpoint breakpoint)
+bool ScriptDebugServer::setBreakpoint(const String& sourceID, ScriptBreakpoint breakpoint, unsigned lineNumber, unsigned* actualLineNumber)
 {
 #if ENABLE(V8_SCRIPT_DEBUG_SERVER)
     v8::HandleScope scope;
@@ -140,7 +140,14 @@ void ScriptDebugServer::setBreakpoint(const String& sourceID, unsigned lineNumbe
     args->Set(v8::String::New("enabled"), v8::Boolean::New(breakpoint.enabled));
 
     v8::Handle<v8::Function> setBreakpointFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("setBreakpoint")));
-    v8::Debug::Call(setBreakpointFunction, args);
+    v8::Handle<v8::Value> result = v8::Debug::Call(setBreakpointFunction, args);
+    if (!result->IsNumber())
+        return false;
+    ASSERT(result->Int32Value() >= 0);
+    *actualLineNumber = result->Int32Value();
+    return true;
+#else
+    return false;
 #endif
 }
 
@@ -299,7 +306,7 @@ PassRefPtr<JavaScriptCallFrame> ScriptDebugServer::currentCallFrame()
         v8::Handle<v8::Function> currentCallFrameFunction = v8::Local<v8::Function>::Cast(m_debuggerScript.get()->Get(v8::String::New("currentCallFrame")));
         v8::Handle<v8::Value> argv[] = { m_executionState.get() };
         v8::Handle<v8::Value> currentCallFrameV8 = currentCallFrameFunction->Call(m_debuggerScript.get(), 1, argv);
-        m_currentCallFrame = JavaScriptCallFrame::create(v8::Debug::GetDebugContext(), v8::Handle<v8::Object>::Cast(currentCallFrameV8)); 
+        m_currentCallFrame = JavaScriptCallFrame::create(v8::Debug::GetDebugContext(), v8::Handle<v8::Object>::Cast(currentCallFrameV8));
     }
     return m_currentCallFrame;
 }
diff --git a/WebCore/bindings/v8/ScriptDebugServer.h b/WebCore/bindings/v8/ScriptDebugServer.h
index b46f673..26ca785 100644
--- a/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/WebCore/bindings/v8/ScriptDebugServer.h
@@ -55,7 +55,7 @@ public:
     void addListener(ScriptDebugListener*, Page*);
     void removeListener(ScriptDebugListener*, Page*);
 
-    void setBreakpoint(const String& sourceID, unsigned lineNumber, ScriptBreakpoint breakpoint);
+    bool setBreakpoint(const String& sourceID, ScriptBreakpoint breakpoint, unsigned lineNumber, unsigned* actualLineNumber);
     void removeBreakpoint(const String& sourceID, unsigned lineNumber);
     void clearBreakpoints();
     void setBreakpointsActivated(bool activated);
diff --git a/WebCore/bindings/v8/SerializedScriptValue.cpp b/WebCore/bindings/v8/SerializedScriptValue.cpp
index 8e91920..47c4c2e 100644
--- a/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -34,6 +34,7 @@
 #include "Blob.h"
 #include "ByteArray.h"
 #include "CanvasPixelArray.h"
+#include "ExceptionCode.h"
 #include "File.h"
 #include "FileList.h"
 #include "ImageData.h"
diff --git a/WebCore/bindings/v8/V8AbstractEventListener.cpp b/WebCore/bindings/v8/V8AbstractEventListener.cpp
index b6c53df..bda4345 100644
--- a/WebCore/bindings/v8/V8AbstractEventListener.cpp
+++ b/WebCore/bindings/v8/V8AbstractEventListener.cpp
@@ -38,6 +38,7 @@
 #include "V8Binding.h"
 #include "V8Event.h"
 #include "V8EventListenerList.h"
+#include "V8HiddenPropertyName.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 #include "WorkerContext.h"
@@ -126,7 +127,7 @@ void V8AbstractEventListener::invokeEventHandler(ScriptExecutionContext* context
         return;
 
     // We push the event being processed into the global object, so that it can be exposed by DOMWindow's bindings.
-    v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
+    v8::Handle<v8::String> eventSymbol = V8HiddenPropertyName::event();
     v8::Local<v8::Value> returnValue;
 
     // In beforeunload/unload handlers, we want to avoid sleeps which do tight loops of calling Date.getTime().
diff --git a/WebCore/bindings/v8/V8Binding.h b/WebCore/bindings/v8/V8Binding.h
index 9eebf51..a15ece1 100644
--- a/WebCore/bindings/v8/V8Binding.h
+++ b/WebCore/bindings/v8/V8Binding.h
@@ -32,7 +32,6 @@
 #define V8Binding_h
 
 #include "AtomicString.h"
-#include "BindingElement.h"
 #include "BindingSecurity.h"
 #include "MathExtras.h"
 #include "PlatformString.h"
@@ -53,7 +52,6 @@ namespace WebCore {
         typedef V8BindingDOMWindow DOMWindow;
     };
     typedef BindingSecurity<V8Binding> V8BindingSecurity;
-    typedef BindingElement<V8Binding> V8BindingElement;
     
     enum ExternalMode {
         Externalize,
diff --git a/WebCore/bindings/v8/V8HiddenPropertyName.h b/WebCore/bindings/v8/V8HiddenPropertyName.h
index 0bfadd9..2d0e8d6 100644
--- a/WebCore/bindings/v8/V8HiddenPropertyName.h
+++ b/WebCore/bindings/v8/V8HiddenPropertyName.h
@@ -41,7 +41,8 @@ namespace WebCore {
     V(attributeListener) \
     V(scriptState) \
     V(sleepFunction) \
-    V(toStringString)
+    V(toStringString) \
+    V(event)
 
     class V8HiddenPropertyName {
     public:
diff --git a/WebCore/bindings/v8/V8Proxy.cpp b/WebCore/bindings/v8/V8Proxy.cpp
index adaea81..50e9fdc 100644
--- a/WebCore/bindings/v8/V8Proxy.cpp
+++ b/WebCore/bindings/v8/V8Proxy.cpp
@@ -380,6 +380,11 @@ PassOwnPtr<v8::ScriptData> V8Proxy::precompileScript(v8::Handle<v8::String> code
     return scriptData.release();
 }
 
+bool V8Proxy::executingScript() const
+{
+    return m_recursion;
+}
+
 v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* node)
 {
     ASSERT(v8::Context::InContext());
diff --git a/WebCore/bindings/v8/V8Proxy.h b/WebCore/bindings/v8/V8Proxy.h
index ec9352c..4dc28ef 100644
--- a/WebCore/bindings/v8/V8Proxy.h
+++ b/WebCore/bindings/v8/V8Proxy.h
@@ -210,6 +210,9 @@ namespace WebCore {
         // constructors.
         void evaluateInIsolatedWorld(int worldId, const Vector<ScriptSourceCode>& sources, int extensionGroup);
 
+        // Returns true if the proxy is currently executing a script in V8.
+        bool executingScript() const;
+
         // Evaluate a script file in the current execution environment.
         // The caller must hold an execution context.
         // If cannot evalute the script, it returns an error.
diff --git a/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h b/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
index 1c5d731..afaf6bf 100644
--- a/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
+++ b/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.h
@@ -50,12 +50,20 @@ v8::Handle<v8::Value> constructWebGLArray(const v8::Arguments& args, WrapperType
     int argLen = args.Length();
     if (argLen == 0) {
         // This happens when we return a previously constructed
-        // ArrayBufferView, e.g. from the call to WebGL<T>Array.slice().
+        // ArrayBufferView, e.g. from the call to <Type>Array.slice().
         // The V8DOMWrapper will set the internal pointer in the
         // created object. Unfortunately it doesn't look like it's
         // possible to distinguish between this case and that where
-        // the user calls "new WebGL<T>Array()" from JavaScript.
-        return args.Holder();
+        // the user calls "new <Type>Array()" from JavaScript. We must
+        // construct an empty view to avoid crashes when fetching the
+        // length.
+        RefPtr<ArrayClass> array = ArrayClass::create(0);
+        // Transform the holder into a wrapper object for the array.
+        V8DOMWrapper::setDOMWrapper(args.Holder(), type, array.get());
+        // Do not call SetIndexedPropertiesToExternalArrayData on this
+        // object. Not only is there no point from a performance
+        // perspective, but doing so causes errors in the slice() case.
+        return toV8(array.release(), args.Holder());
     }
 
     // Supported constructors:
diff --git a/WebCore/bindings/v8/custom/V8BindingMacros.h b/WebCore/bindings/v8/custom/V8BindingMacros.h
index 16c3651..4c8ecd3 100644
--- a/WebCore/bindings/v8/custom/V8BindingMacros.h
+++ b/WebCore/bindings/v8/custom/V8BindingMacros.h
@@ -28,11 +28,21 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#define EXCEPTION_BLOCK(type, var, value)         \
-    type var;                                     \
-    {                                             \
-        v8::TryCatch block;                       \
-        var = value;                              \
-        if (block.HasCaught())                    \
-            return throwError(block.Exception()); \
+#define EXCEPTION_BLOCK(type, var, value) \
+    type var;                             \
+    {                                     \
+        v8::TryCatch block;               \
+        var = (value);                    \
+        if (block.HasCaught())            \
+            return block.ReThrow();       \
+    }
+
+#define TO_WEBCORE_STRING_EXCEPTION_BLOCK(var, value)                      \
+    String var;                                                            \
+    {                                                                      \
+        v8::TryCatch block;                                                \
+        v8::Handle<v8::String> v8String = (value)->ToString();             \
+        if (block.HasCaught())                                             \
+            return block.ReThrow();                                        \
+        var = v8StringToWebCoreString<String>(v8String, DoNotExternalize); \
     }
diff --git a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
index 25564ee..210e974 100644
--- a/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMWindowCustom.cpp
@@ -58,6 +58,7 @@
 #include "V8Database.h"
 #include "V8DatabaseCallback.h"
 #include "V8GCForContextDispose.h"
+#include "V8HiddenPropertyName.h"
 #include "V8HTMLAudioElementConstructor.h"
 #include "V8HTMLCollection.h"
 #include "V8HTMLImageElementConstructor.h"
@@ -175,7 +176,7 @@ v8::Handle<v8::Value> V8DOMWindow::eventAccessorGetter(v8::Local<v8::String> nam
     if (context.IsEmpty())
         return v8::Undefined();
 
-    v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
+    v8::Handle<v8::String> eventSymbol = V8HiddenPropertyName::event();
     v8::Handle<v8::Value> jsEvent = context->Global()->GetHiddenValue(eventSymbol);
     if (jsEvent.IsEmpty())
         return v8::Undefined();
@@ -196,7 +197,7 @@ void V8DOMWindow::eventAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::
     if (context.IsEmpty())
         return;
 
-    v8::Local<v8::String> eventSymbol = v8::String::NewSymbol("event");
+    v8::Handle<v8::String> eventSymbol = V8HiddenPropertyName::event();
     context->Global()->SetHiddenValue(eventSymbol, value);
 }
 
@@ -795,9 +796,9 @@ v8::Handle<v8::Value> V8DOMWindow::openDatabaseCallback(const v8::Arguments& arg
     if (args.Length() < 4)
         return throwError(SYNTAX_ERR);
 
-    EXCEPTION_BLOCK(String, name, toWebCoreString(args[0]));
-    EXCEPTION_BLOCK(String, version, toWebCoreString(args[1]));
-    EXCEPTION_BLOCK(String, displayName, toWebCoreString(args[2]));
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(name, args[0]);
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(version, args[1]);
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(displayName, args[2]);
     EXCEPTION_BLOCK(unsigned long, estimatedSize, args[3]->Uint32Value());
 
     DOMWindow* imp = V8DOMWindow::toNative(args.Holder());
diff --git a/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp b/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp
index 20f7c40..44a6eeb 100644
--- a/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DatabaseCustom.cpp
@@ -34,6 +34,7 @@
 #include "V8Database.h"
 
 #include "Database.h"
+#include "ExceptionCode.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
 #include "V8SQLTransactionCallback.h"
@@ -50,8 +51,8 @@ v8::Handle<v8::Value> V8Database::changeVersionCallback(const v8::Arguments& arg
     if (args.Length() < 2)
         return throwError(SYNTAX_ERR);
 
-    EXCEPTION_BLOCK(String, oldVersion, toWebCoreString(args[0]));
-    EXCEPTION_BLOCK(String, newVersion, toWebCoreString(args[1]));
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(oldVersion, args[0]);
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(newVersion, args[1]);
 
     Database* database = V8Database::toNative(args.Holder());
 
diff --git a/WebCore/bindings/v8/custom/V8DatabaseSyncCustom.cpp b/WebCore/bindings/v8/custom/V8DatabaseSyncCustom.cpp
index 4fe30dc..8a317d7 100644
--- a/WebCore/bindings/v8/custom/V8DatabaseSyncCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DatabaseSyncCustom.cpp
@@ -34,6 +34,7 @@
 #include "V8DatabaseSync.h"
 
 #include "DatabaseSync.h"
+#include "ExceptionCode.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
 #include "V8Proxy.h"
@@ -48,8 +49,8 @@ v8::Handle<v8::Value> V8DatabaseSync::changeVersionCallback(const v8::Arguments&
     if (args.Length() < 2)
         return throwError(SYNTAX_ERR);
 
-    EXCEPTION_BLOCK(String, oldVersion, toWebCoreString(args[0]));
-    EXCEPTION_BLOCK(String, newVersion, toWebCoreString(args[1]));
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(oldVersion, args[0]);
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(newVersion, args[1]);
 
     DatabaseSync* database = V8DatabaseSync::toNative(args.Holder());
 
diff --git a/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp b/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
index d3de1dc..35818af 100644
--- a/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8HTMLFrameElementCustom.cpp
@@ -41,17 +41,6 @@ namespace WebCore {
 
 using namespace HTMLNames; 
 
-void V8HTMLFrameElement::srcAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
-{
-    HTMLFrameElement* frame = V8HTMLFrameElement::toNative(info.Holder());
-    String srcValue = toWebCoreStringWithNullCheck(value);
-
-    if (!V8BindingSecurity::allowSettingFrameSrcToJavascriptUrl(V8BindingState::Only(), frame, srcValue))
-        return;
-
-    frame->setAttribute(srcAttr, srcValue); 
-}
-
 void V8HTMLFrameElement::locationAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
 {
     HTMLFrameElement* frame = V8HTMLFrameElement::toNative(info.Holder());
diff --git a/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp b/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
new file mode 100644
index 0000000..2afa55f
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8IDBKeyCustom.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(INDEXED_DATABASE)
+#include "V8IDBAny.h"
+
+#include "IDBBindingUtilities.h"
+#include "IDBKey.h"
+#include "V8Binding.h"
+
+namespace WebCore {
+
+v8::Handle<v8::Value> toV8(IDBKey* key)
+{
+    if (!key)
+        return v8::Null();
+
+    switch (key->type()) {
+    case IDBKey::NullType:
+        return v8::Null();
+    case IDBKey::NumberType:
+        return v8::Integer::New(key->number());
+    case IDBKey::StringType:
+        return v8String(key->string());
+    // FIXME: Implement dates.
+    }
+
+    ASSERT_NOT_REACHED();
+    return v8::Undefined();
+}
+
+#endif // ENABLE(INDEXED_DATABASE)
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp b/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
index f1b708a..e2a5070 100644
--- a/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8SQLTransactionCustom.cpp
@@ -35,6 +35,7 @@
 #include "V8SQLTransaction.h"
 
 #include "Database.h"
+#include "ExceptionCode.h"
 #include "SQLValue.h"
 #include "V8Binding.h"
 #include "V8BindingMacros.h"
@@ -54,7 +55,7 @@ v8::Handle<v8::Value> V8SQLTransaction::executeSqlCallback(const v8::Arguments&
     if (args.Length() == 0)
         return throwError(SYNTAX_ERR);
 
-    EXCEPTION_BLOCK(String, statement, toWebCoreString(args[0]));
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(statement, args[0]);
 
     Vector<SQLValue> sqlValues;
 
@@ -81,7 +82,7 @@ v8::Handle<v8::Value> V8SQLTransaction::executeSqlCallback(const v8::Arguments&
                 EXCEPTION_BLOCK(double, sqlValue, value->NumberValue());
                 sqlValues.append(SQLValue(sqlValue));
             } else {
-                EXCEPTION_BLOCK(String, sqlValue, toWebCoreString(value));
+                TO_WEBCORE_STRING_EXCEPTION_BLOCK(sqlValue, value);
                 sqlValues.append(SQLValue(sqlValue));
             }
         }
diff --git a/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp b/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
index 651c79b..8ef11ce 100644
--- a/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8SQLTransactionSyncCustom.cpp
@@ -35,6 +35,7 @@
 #include "V8SQLTransactionSync.h"
 
 #include "DatabaseSync.h"
+#include "ExceptionCode.h"
 #include "SQLResultSet.h"
 #include "SQLValue.h"
 #include "V8Binding.h"
@@ -53,7 +54,7 @@ v8::Handle<v8::Value> V8SQLTransactionSync::executeSqlCallback(const v8::Argumen
     if (!args.Length())
         return throwError(SYNTAX_ERR);
 
-    EXCEPTION_BLOCK(String, statement, toWebCoreString(args[0]));
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(statement, args[0]);
 
     Vector<SQLValue> sqlValues;
 
@@ -80,7 +81,7 @@ v8::Handle<v8::Value> V8SQLTransactionSync::executeSqlCallback(const v8::Argumen
                 EXCEPTION_BLOCK(double, sqlValue, value->NumberValue());
                 sqlValues.append(SQLValue(sqlValue));
             } else {
-                EXCEPTION_BLOCK(String, sqlValue, toWebCoreString(value));
+                TO_WEBCORE_STRING_EXCEPTION_BLOCK(sqlValue, value);
                 sqlValues.append(SQLValue(sqlValue));
             }
         }
diff --git a/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp b/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
index 5da4b3e..e1a9c0e 100644
--- a/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WebGLRenderingContextCustom.cpp
@@ -110,6 +110,13 @@ static v8::Handle<v8::Value> toV8Object(const WebGLGetInfo& info)
     switch (info.getType()) {
     case WebGLGetInfo::kTypeBool:
         return v8::Boolean::New(info.getBool());
+    case WebGLGetInfo::kTypeBoolArray: {
+        const Vector<bool>& value = info.getBoolArray();
+        v8::Local<v8::Array> array = v8::Array::New(value.size());
+        for (size_t ii = 0; ii < value.size(); ++ii)
+            array->Set(v8::Integer::New(ii), v8::Boolean::New(value[ii]));
+        return array;
+    }
     case WebGLGetInfo::kTypeFloat:
         return v8::Number::New(info.getFloat());
     case WebGLGetInfo::kTypeLong:
@@ -209,6 +216,32 @@ enum WhichProgramCall {
     kProgramParameter, kUniform
 };
 
+v8::Handle<v8::Value> V8WebGLRenderingContext::getAttachedShadersCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.WebGLRenderingContext.getAttachedShaders()");
+
+    if (args.Length() < 1) {
+        V8Proxy::setDOMException(SYNTAX_ERR);
+        return notHandledByInterceptor();
+    }
+
+    ExceptionCode ec = 0;
+    WebGLRenderingContext* context = V8WebGLRenderingContext::toNative(args.Holder());
+    WebGLProgram* program = V8WebGLProgram::HasInstance(args[0]) ? V8WebGLProgram::toNative(v8::Handle<v8::Object>::Cast(args[0])) : 0;
+    Vector<WebGLShader*> shaders;
+    bool succeed = context->getAttachedShaders(program, shaders, ec);
+    if (ec) {
+        V8Proxy::setDOMException(ec);
+        return v8::Undefined();
+    }
+    if (!succeed)
+        return v8::Undefined();
+    v8::Local<v8::Array> array = v8::Array::New(shaders.size());
+    for (size_t ii = 0; ii < shaders.size(); ++ii)
+        array->Set(v8::Integer::New(ii), toV8(shaders[ii]));
+    return array;
+}
+
 v8::Handle<v8::Value> V8WebGLRenderingContext::getBufferParameterCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.WebGLRenderingContext.getBufferParameter()");
diff --git a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
index acf10b7..f66ff3d 100755
--- a/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8WorkerContextCustom.cpp
@@ -150,9 +150,9 @@ v8::Handle<v8::Value> V8WorkerContext::openDatabaseCallback(const v8::Arguments&
     if (args.Length() < 4)
         return throwError(SYNTAX_ERR);
 
-    EXCEPTION_BLOCK(String, name, toWebCoreString(args[0]));
-    EXCEPTION_BLOCK(String, version, toWebCoreString(args[1]));
-    EXCEPTION_BLOCK(String, displayName, toWebCoreString(args[2]));
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(name, args[0]);
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(version, args[1]);
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(displayName, args[2]);
     EXCEPTION_BLOCK(unsigned long, estimatedSize, args[3]->Uint32Value());
 
     WorkerContext* workerContext = V8WorkerContext::toNative(args.Holder());
@@ -178,9 +178,9 @@ v8::Handle<v8::Value> V8WorkerContext::openDatabaseSyncCallback(const v8::Argume
     if (args.Length() < 4)
         return throwError(SYNTAX_ERR);
 
-    EXCEPTION_BLOCK(String, name, toWebCoreString(args[0]));
-    EXCEPTION_BLOCK(String, version, toWebCoreString(args[1]));
-    EXCEPTION_BLOCK(String, displayName, toWebCoreString(args[2]));
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(name, args[0]);
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(version, args[1]);
+    TO_WEBCORE_STRING_EXCEPTION_BLOCK(displayName, args[2]);
     EXCEPTION_BLOCK(unsigned long, estimatedSize, args[3]->Uint32Value());
 
     WorkerContext* workerContext = V8WorkerContext::toNative(args.Holder());
diff --git a/WebCore/config.h b/WebCore/config.h
index c46a53c..6e20614 100644
--- a/WebCore/config.h
+++ b/WebCore/config.h
@@ -302,7 +302,9 @@
 #endif /* !defined(WTF_USE_V8) */
 
 /* Using V8 implies not using JSC and vice versa */
+#if !defined(WTF_USE_JSC)
 #define WTF_USE_JSC !WTF_USE_V8
+#endif
 
 #if PLATFORM(CG)
 #ifndef CGFLOAT_DEFINED
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index 57c42d3..087018b 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -3717,7 +3717,8 @@ bool CSSParser::parseFontFaceUnicodeRange()
             if (failed)
                 break;
         }
-        values->append(CSSUnicodeRangeValue::create(from, to));
+        if (from <= to)
+            values->append(CSSUnicodeRangeValue::create(from, to));
         m_valueList->next();
     }
     if (failed || !values->length())
@@ -3731,7 +3732,7 @@ static inline bool isCSSWhitespace(UChar c)
     return c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == '\f';
 }
 
-static inline bool parseInt(const UChar*& string, const UChar* end, UChar terminator, int& value)
+static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar terminator, int& value)
 {
     const UChar* current = string;
     int localValue = 0;
@@ -3744,8 +3745,17 @@ static inline bool parseInt(const UChar*& string, const UChar* end, UChar termin
     }
     if (current == end || !isASCIIDigit(*current))
         return false;
-    while (current != end && isASCIIDigit(*current))
-        localValue = localValue * 10 + *current++ - '0';
+    while (current != end && isASCIIDigit(*current)) {
+        int newValue = localValue * 10 + *current++ - '0';
+        if (newValue >= 255) {
+            // Clamp values at 255.
+            localValue = 255;
+            while (current != end && isASCIIDigit(*current))
+                ++current;
+            break;
+        }
+        localValue = newValue;
+    }
     while (current != end && isCSSWhitespace(*current))
         current++;
     if (current == end || *current++ != terminator)
@@ -3768,11 +3778,11 @@ bool CSSParser::parseColor(const String &name, RGBA32& rgb, bool strict)
         int red;
         int green;
         int blue;
-        if (!parseInt(current, end, ',', red))
+        if (!parseColorInt(current, end, ',', red))
             return false;
-        if (!parseInt(current, end, ',', green))
+        if (!parseColorInt(current, end, ',', green))
             return false;
-        if (!parseInt(current, end, ')', blue))
+        if (!parseColorInt(current, end, ')', blue))
             return false;
         if (current != end)
             return false;
@@ -3789,6 +3799,23 @@ bool CSSParser::parseColor(const String &name, RGBA32& rgb, bool strict)
     return false;
 }
 
+static inline int colorIntFromValue(CSSParserValue* v)
+{
+    if (v->fValue <= 0.0)
+        return 0;
+
+    if (v->unit == CSSPrimitiveValue::CSS_PERCENTAGE) {
+        if (v->fValue >= 100.0)
+            return 255;
+        return static_cast<int>(v->fValue * 256.0 / 100.0);
+    }
+
+    if (v->fValue >= 255.0)
+        return 255;
+
+    return static_cast<int>(v->fValue);
+}
+
 bool CSSParser::parseColorParameters(CSSParserValue* value, int* colorArray, bool parseAlpha)
 {
     CSSParserValueList* args = value->function->args;
@@ -3801,7 +3828,7 @@ bool CSSParser::parseColorParameters(CSSParserValue* value, int* colorArray, boo
         unitType = FPercent;
     else
         return false;
-    colorArray[0] = static_cast<int>(v->fValue * (v->unit == CSSPrimitiveValue::CSS_PERCENTAGE ? 256.0 / 100.0 : 1.0));
+    colorArray[0] = colorIntFromValue(v);
     for (int i = 1; i < 3; i++) {
         v = args->next();
         if (v->unit != CSSParserValue::Operator && v->iValue != ',')
@@ -3809,7 +3836,7 @@ bool CSSParser::parseColorParameters(CSSParserValue* value, int* colorArray, boo
         v = args->next();
         if (!validUnit(v, unitType, true))
             return false;
-        colorArray[i] = static_cast<int>(v->fValue * (v->unit == CSSPrimitiveValue::CSS_PERCENTAGE ? 256.0 / 100.0 : 1.0));
+        colorArray[i] = colorIntFromValue(v);
     }
     if (parseAlpha) {
         v = args->next();
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index 3af3291..750988e 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -30,7 +30,6 @@
 #include "CSSBorderImageValue.h"
 #include "CSSCursorImageValue.h"
 #include "CSSFontFaceRule.h"
-#include "CSSHelper.h"
 #include "CSSImportRule.h"
 #include "CSSMediaRule.h"
 #include "CSSPageRule.h"
@@ -1373,6 +1372,55 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForElement(Element* e, RenderStyl
     return m_style.release();
 }
 
+PassRefPtr<RenderStyle> CSSStyleSelector::styleForKeyframe(const RenderStyle* elementStyle, const WebKitCSSKeyframeRule* keyframeRule, KeyframeList& list)
+{
+    if (keyframeRule->style())
+        addMatchedDeclaration(keyframeRule->style());
+
+    ASSERT(!m_style);
+
+    // Create the style
+    m_style = RenderStyle::clone(elementStyle);
+
+    m_lineHeightValue = 0;
+
+    // We don't need to bother with !important. Since there is only ever one
+    // decl, there's nothing to override. So just add the first properties.
+    if (keyframeRule->style())
+        applyDeclarations<true>(false, 0, m_matchedDecls.size() - 1);
+
+    // If our font got dirtied, go ahead and update it now.
+    if (m_fontDirty)
+        updateFont();
+
+    // Line-height is set when we are sure we decided on the font-size
+    if (m_lineHeightValue)
+        applyProperty(CSSPropertyLineHeight, m_lineHeightValue);
+
+    // Now do rest of the properties.
+    if (keyframeRule->style())
+        applyDeclarations<false>(false, 0, m_matchedDecls.size() - 1);
+
+    // If our font got dirtied by one of the non-essential font props,
+    // go ahead and update it a second time.
+    if (m_fontDirty)
+        updateFont();
+
+    // Add all the animating properties to the list
+    if (keyframeRule->style()) {
+        CSSMutableStyleDeclaration::const_iterator end = keyframeRule->style()->end();
+        for (CSSMutableStyleDeclaration::const_iterator it = keyframeRule->style()->begin(); it != end; ++it) {
+            int property = (*it).id();
+            // Timing-function within keyframes is special, because it is not animated; it just
+            // describes the timing function between this keyframe and the next.
+            if (property != CSSPropertyWebkitAnimationTimingFunction)
+                list.addProperty(property);
+        }
+    }
+
+    return m_style.release();
+}
+
 void CSSStyleSelector::keyframeStylesForAnimation(Element* e, const RenderStyle* elementStyle, KeyframeList& list)
 {
     list.clear();
@@ -1387,6 +1435,7 @@ void CSSStyleSelector::keyframeStylesForAnimation(Element* e, const RenderStyle*
         return;
         
     const WebKitCSSKeyframesRule* rule = m_keyframesRuleMap.find(list.animationName().impl()).get()->second.get();
+    RefPtr<RenderStyle> keyframeStyle;
     
     // Construct and populate the style for each keyframe
     for (unsigned i = 0; i < rule->length(); ++i) {
@@ -1394,65 +1443,36 @@ void CSSStyleSelector::keyframeStylesForAnimation(Element* e, const RenderStyle*
         initElement(e);
         initForStyleResolve(e);
         
-        const WebKitCSSKeyframeRule* kf = rule->item(i);
-        addMatchedDeclaration(kf->style());
-
-        ASSERT(!m_style);
-
-        // Create the style
-        m_style = RenderStyle::clone(elementStyle);
-        
-        m_lineHeightValue = 0;
+        const WebKitCSSKeyframeRule* keyframeRule = rule->item(i);
         
-        // We don't need to bother with !important. Since there is only ever one
-        // decl, there's nothing to override. So just add the first properties.
-        applyDeclarations<true>(false, 0, m_matchedDecls.size() - 1);
-        
-        // If our font got dirtied, go ahead and update it now.
-        if (m_fontDirty)
-            updateFont();
+        keyframeStyle = styleForKeyframe(elementStyle, keyframeRule, list);
 
-        // Line-height is set when we are sure we decided on the font-size
-        if (m_lineHeightValue)
-            applyProperty(CSSPropertyLineHeight, m_lineHeightValue);
-        
-        // Now do rest of the properties.
-        applyDeclarations<false>(false, 0, m_matchedDecls.size() - 1);
-        
-        // If our font got dirtied by one of the non-essential font props, 
-        // go ahead and update it a second time.
-        if (m_fontDirty)
-            updateFont();
-
-        // Add all the animating properties to the list
-        CSSMutableStyleDeclaration::const_iterator end = kf->style()->end();
-        for (CSSMutableStyleDeclaration::const_iterator it = kf->style()->begin(); it != end; ++it) {
-            int property = (*it).id();
-            // Timing-function within keyframes is special, because it is not animated; it just
-            // describes the timing function between this keyframe and the next.
-            if (property != CSSPropertyWebkitAnimationTimingFunction)
-                list.addProperty(property);
-        }
-        
         // Add this keyframe style to all the indicated key times
         Vector<float> keys;
-        kf->getKeys(keys);
+        keyframeRule->getKeys(keys);
         for (size_t keyIndex = 0; keyIndex < keys.size(); ++keyIndex) {
             float key = keys[keyIndex];
-            list.insert(key, m_style);
+            list.insert(key, keyframeStyle.get());
         }
-        m_style = 0;
+        keyframeStyle.release();
     }
     
-    // Make sure there is a 0% and a 100% keyframe
-    float first = -1;
-    float last = -1;
-    if (list.size() >= 2) {
-        first = list.beginKeyframes()->key();
-        last = (list.endKeyframes()-1)->key();
-    }
-    if (first != 0 || last != 1)
-        list.clear();
+    // If the 0% keyframe is missing, create it (but only if there is at least one other keyframe)
+    int initialListSize = list.size();
+    if (initialListSize > 0 && list.beginKeyframes()->key() != 0) {
+        RefPtr<WebKitCSSKeyframeRule> keyframe = WebKitCSSKeyframeRule::create();
+        keyframe->setKeyText("0%");
+        keyframeStyle = styleForKeyframe(elementStyle, keyframe.get(), list);
+        list.insert(0, keyframeStyle.release());
+    }
+
+    // If the 100% keyframe is missing, create it (but only if there is at least one other keyframe)
+    if (initialListSize > 0 && (list.endKeyframes() - 1)->key() != 1) {
+        RefPtr<WebKitCSSKeyframeRule> keyframe = WebKitCSSKeyframeRule::create();
+        keyframe->setKeyText("100%");
+        keyframeStyle = styleForKeyframe(elementStyle, keyframe.get(), list);
+        list.insert(1, keyframeStyle.release());
+    }
 }
 
 PassRefPtr<RenderStyle> CSSStyleSelector::pseudoStyleForElement(PseudoId pseudo, Element* e, RenderStyle* parentStyle, bool matchVisitedPseudoClass)
@@ -5527,14 +5547,17 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 
 void CSSStyleSelector::applyPageSizeProperty(CSSValue* value)
 {
+    m_style->resetPageSizeType();
     if (!value->isValueList())
         return;
     CSSValueList* valueList = static_cast<CSSValueList*>(value);
     Length width;
     Length height;
+    PageSizeType pageSizeType = PAGE_SIZE_AUTO;
     switch (valueList->length()) {
     case 2: {
         // <length>{2} | <page-size> <orientation>
+        pageSizeType = PAGE_SIZE_RESOLVED;
         if (!valueList->item(0)->isPrimitiveValue() || !valueList->item(1)->isPrimitiveValue())
             return;
         CSSPrimitiveValue* primitiveValue0 = static_cast<CSSPrimitiveValue*>(valueList->item(0));
@@ -5563,24 +5586,24 @@ void CSSStyleSelector::applyPageSizeProperty(CSSValue* value)
         int type = primitiveValue->primitiveType();
         if (CSSPrimitiveValue::isUnitTypeLength(type)) {
             // <length>
+            pageSizeType = PAGE_SIZE_RESOLVED;
             width = height = Length(primitiveValue->computeLengthIntForLength(style(), m_rootElementStyle), Fixed);
         } else {
             if (type != CSSPrimitiveValue::CSS_IDENT)
                 return;
             switch (primitiveValue->getIdent()) {
             case CSSValueAuto:
-                // auto
-                if (!pageSizeFromName(0, 0, width, height))
-                    return;
+                pageSizeType = PAGE_SIZE_AUTO;
                 break;
             case CSSValuePortrait:
+                pageSizeType = PAGE_SIZE_AUTO_PORTRAIT;
+                break;
             case CSSValueLandscape:
-                // <page-size>
-                if (!pageSizeFromName(0, primitiveValue, width, height))
-                    return;
+                pageSizeType = PAGE_SIZE_AUTO_LANDSCAPE;
                 break;
             default:
-                // [ portrait | landscape]
+                // <page-size>
+                pageSizeType = PAGE_SIZE_RESOLVED;
                 if (!pageSizeFromName(primitiveValue, 0, width, height))
                     return;
             }
@@ -5590,6 +5613,7 @@ void CSSStyleSelector::applyPageSizeProperty(CSSValue* value)
     default:
         return;
     }
+    m_style->setPageSizeType(pageSizeType);
     m_style->setPageSize(LengthSize(width, height));
     return;
 }
@@ -5605,31 +5629,10 @@ bool CSSStyleSelector::pageSizeFromName(CSSPrimitiveValue* pageSizeName, CSSPrim
     static const Length legalWidth = inchLength(8.5), legalHeight = inchLength(14);
     static const Length ledgerWidth = inchLength(11), ledgerHeight = inchLength(17);
 
-    // FIXME: Define UA default page size. Assume letter for now.
-    int ident = CSSValueLetter;
-    if (pageSizeName) {
-        if (pageSizeName->primitiveType() != CSSPrimitiveValue::CSS_IDENT)
-            return false;
-        ident = pageSizeName->getIdent();
-    }
+    if (!pageSizeName || pageSizeName->primitiveType() != CSSPrimitiveValue::CSS_IDENT)
+        return false;
 
-    // FIXME: Define UA default page orientation. Assume portrait for now.
-    bool portrait = true;
-    if (pageOrientation) {
-        if (pageOrientation->primitiveType() != CSSPrimitiveValue::CSS_IDENT)
-            return false;
-        switch (pageOrientation->getIdent()) {
-        case CSSValueLandscape:
-            portrait = false;
-            break;
-        case CSSValuePortrait:
-            portrait = true;
-            break;
-        default:
-            return false;
-        }
-    }
-    switch (ident) {
+    switch (pageSizeName->getIdent()) {
     case CSSValueA5:
         width = a5Width;
         height = a5Height;
@@ -5665,8 +5668,21 @@ bool CSSStyleSelector::pageSizeFromName(CSSPrimitiveValue* pageSizeName, CSSPrim
     default:
         return false;
     }
-    if (!portrait)
-        swap(width, height);
+
+    if (pageOrientation) {
+        if (pageOrientation->primitiveType() != CSSPrimitiveValue::CSS_IDENT)
+            return false;
+        switch (pageOrientation->getIdent()) {
+        case CSSValueLandscape:
+            std::swap(width, height);
+            break;
+        case CSSValuePortrait:
+            // Nothing to do.
+            break;
+        default:
+            return false;
+        }
+    }
     return true;
 }
 
diff --git a/WebCore/css/CSSStyleSelector.h b/WebCore/css/CSSStyleSelector.h
index f0de83b..dca6c1c 100644
--- a/WebCore/css/CSSStyleSelector.h
+++ b/WebCore/css/CSSStyleSelector.h
@@ -64,6 +64,7 @@ class StyleImage;
 class StyleSheet;
 class StyleSheetList;
 class StyledElement;
+class WebKitCSSKeyframeRule;
 class WebKitCSSKeyframesRule;
 
 class MediaQueryResult : public Noncopyable {
@@ -111,6 +112,8 @@ public:
 
         RenderStyle* style() const { return m_style.get(); }
 
+        PassRefPtr<RenderStyle> styleForKeyframe(const RenderStyle*, const WebKitCSSKeyframeRule*, KeyframeList&);
+
     public:
         // These methods will give back the set of rules that matched for a given element (or a pseudo-element).
         PassRefPtr<CSSRuleList> styleRulesForElement(Element*, bool authorOnly);
diff --git a/WebCore/css/CSSStyleSheet.cpp b/WebCore/css/CSSStyleSheet.cpp
index 40bb0de..227d37c 100644
--- a/WebCore/css/CSSStyleSheet.cpp
+++ b/WebCore/css/CSSStyleSheet.cpp
@@ -207,7 +207,8 @@ void CSSStyleSheet::checkLoaded()
     if (parent())
         parent()->checkLoaded();
 
-    // Avoid |this| being deleted by scripts that run via LegacyHTMLDocumentParser::executeScriptsWaitingForStylesheets().
+    // Avoid |this| being deleted by scripts that run via
+    // ScriptableDocumentParser::executeScriptsWaitingForStylesheets().
     // See <rdar://problem/6622300>.
     RefPtr<CSSStyleSheet> protector(this);
     m_loadCompleted = ownerNode() ? ownerNode()->sheetLoaded() : true;
diff --git a/WebCore/css/html.css b/WebCore/css/html.css
index dc27ff8..d65acb0 100644
--- a/WebCore/css/html.css
+++ b/WebCore/css/html.css
@@ -584,10 +584,12 @@ progress {
     height: 1em;
     width: 10em;
     vertical-align: -0.2em;
+    background-color: gray;
 }
 
-progress::-webkit-progress-bar {
+progress::-webkit-progress-bar-value {
     -webkit-appearance: progress-bar;
+    background-color: green;
 }
 
 /* datagrid */
@@ -629,6 +631,11 @@ pre, xmp, plaintext, listing {
     margin: 1__qem 0
 }
 
+mark {
+    background-color: yellow;
+    color: black
+}
+
 big {
     font-size: larger
 }
@@ -733,7 +740,9 @@ iframe {
 @page {
     /* FIXME: Define the right default values for page properties. */
     size: auto;
-    margin: 1in;
+    margin: auto;
+    padding: 0px;
+    border-width: 0px;
 }
 
 /* noscript is handled internally, as it depends on settings */
diff --git a/WebCore/dom/BeforeProcessEvent.cpp b/WebCore/dom/BeforeProcessEvent.cpp
new file mode 100644
index 0000000..7314481
--- /dev/null
+++ b/WebCore/dom/BeforeProcessEvent.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#include "config.h"
+#include "BeforeProcessEvent.h"
+
+namespace WebCore {
+
+String BeforeProcessEvent::text() const
+{
+    // FIXME - Return innerText for <style> elements and inline <script> elements, or the resource text for remote <script> elements
+    return String();
+}
+
+void BeforeProcessEvent::setText(const String&)
+{
+    // FIXME - Replace innerText for <style> elements and inline <script> elements, and remove the src attribute on 
+    // remote <script> elements, replacing it with an innerText property.
+}
+
+} // namespace WebCore
diff --git a/WebCore/dom/BeforeProcessEvent.h b/WebCore/dom/BeforeProcessEvent.h
new file mode 100644
index 0000000..035d2da
--- /dev/null
+++ b/WebCore/dom/BeforeProcessEvent.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+#ifndef BeforeProcessEvent_h
+#define BeforeProcessEvent_h
+
+#include "Event.h"
+#include "EventNames.h"
+
+namespace WebCore {
+
+class BeforeProcessEvent : public Event {
+public:
+    static PassRefPtr<BeforeProcessEvent> create()
+    {
+        return adoptRef(new BeforeProcessEvent);
+    }
+
+    void initBeforeProcessEvent(const AtomicString& type, bool canBubble, bool cancelable)
+    {
+        initEvent(type, canBubble, cancelable);
+    }
+
+    String text() const;
+    void setText(const String&);
+
+private:
+    BeforeProcessEvent()
+        : Event(eventNames().beforeprocessEvent, false, true)
+    {
+    }
+
+};
+
+} // namespace WebCore
+
+#endif // BeforeProcessEvent_h
diff --git a/WebCore/dom/BeforeProcessEvent.idl b/WebCore/dom/BeforeProcessEvent.idl
new file mode 100644
index 0000000..28b1a81
--- /dev/null
+++ b/WebCore/dom/BeforeProcessEvent.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ *
+ */
+
+module events {
+
+    interface BeforeProcessEvent : Event {
+        void initBeforeProcessEvent(in DOMString type, in boolean canBubble, in boolean cancelable);
+        attribute DOMString text;
+    };
+
+}
diff --git a/WebCore/dom/CharacterData.cpp b/WebCore/dom/CharacterData.cpp
index 9670988..075df47 100644
--- a/WebCore/dom/CharacterData.cpp
+++ b/WebCore/dom/CharacterData.cpp
@@ -38,15 +38,15 @@ void CharacterData::setData(const String& data, ExceptionCode&)
     int oldLength = length();
     RefPtr<StringImpl> oldStr = m_data;
     m_data = dataImpl;
-    
+
     if ((!renderer() || !rendererIsNeeded(renderer()->style())) && attached()) {
         detach();
         attach();
     } else if (renderer())
-        toRenderText(renderer())->setText(m_data);
-    
+        toRenderText(renderer())->setTextWithOffset(m_data, 0, oldLength);
+
     dispatchModifiedEvent(oldStr.get());
-    
+
     document()->textRemoved(this, 0, oldLength);
 }
 
diff --git a/WebCore/dom/ContainerNode.cpp b/WebCore/dom/ContainerNode.cpp
index fddccdd..6539e5b 100644
--- a/WebCore/dom/ContainerNode.cpp
+++ b/WebCore/dom/ContainerNode.cpp
@@ -537,7 +537,31 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
     return true;
 }
 
-ContainerNode* ContainerNode::addChild(PassRefPtr<Node> newChild)
+void ContainerNode::addChildCommon(Node* newChild)
+{
+    ASSERT(!newChild->parent()); // Use appendChild if you need to handle reparenting.
+    forbidEventDispatch();
+    Node* last = m_lastChild;
+    // FIXME: This method should take a PassRefPtr.
+    appendChildToContainer<Node, ContainerNode>(newChild, this);
+    allowEventDispatch();
+
+    document()->incDOMTreeVersion();
+    if (inDocument())
+        newChild->insertedIntoDocument();
+    childrenChanged(true, last, 0, 1);
+}
+
+void ContainerNode::parserAddChild(PassRefPtr<Node> newChild)
+{
+    ASSERT(newChild);
+    // This function is only used during parsing.
+    // It does not send any DOM mutation events or handle reparenting.
+
+    addChildCommon(newChild.get());
+}
+
+ContainerNode* ContainerNode::legacyParserAddChild(PassRefPtr<Node> newChild)
 {
     ASSERT(newChild);
     // This function is only used during parsing.
@@ -547,16 +571,8 @@ ContainerNode* ContainerNode::addChild(PassRefPtr<Node> newChild)
     if (document()->isHTMLDocument() && !childAllowed(newChild.get()))
         return 0;
 
-    forbidEventDispatch();
-    Node* last = m_lastChild;
-    appendChildToContainer<Node, ContainerNode>(newChild.get(), this);
-    allowEventDispatch();
+    addChildCommon(newChild.get());
 
-    document()->incDOMTreeVersion();
-    if (inDocument())
-        newChild->insertedIntoDocument();
-    childrenChanged(true, last, 0, 1);
-    
     if (newChild->isElementNode())
         return static_cast<ContainerNode*>(newChild.get());
     return this;
diff --git a/WebCore/dom/ContainerNode.h b/WebCore/dom/ContainerNode.h
index 9789f1f..36e6ac5 100644
--- a/WebCore/dom/ContainerNode.h
+++ b/WebCore/dom/ContainerNode.h
@@ -48,7 +48,9 @@ public:
     virtual bool removeChild(Node* child, ExceptionCode&);
     virtual bool appendChild(PassRefPtr<Node> newChild, ExceptionCode&, bool shouldLazyAttach = false);
 
-    virtual ContainerNode* addChild(PassRefPtr<Node>);
+    virtual ContainerNode* legacyParserAddChild(PassRefPtr<Node>);
+    virtual void parserAddChild(PassRefPtr<Node>);
+
     bool hasChildNodes() const { return m_firstChild; }
     virtual void attach();
     virtual void detach();
@@ -89,10 +91,13 @@ protected:
 
     void setFirstChild(Node* child) { m_firstChild = child; }
     void setLastChild(Node* child) { m_lastChild = child; }
-    
+
 private:
+    // FIXME: This should take a PassRefPtr.
+    void addChildCommon(Node*);
+
     static void dispatchPostAttachCallbacks();
-    
+
     bool getUpperLeftCorner(FloatPoint&) const;
     bool getLowerRightCorner(FloatPoint&) const;
 
diff --git a/WebCore/dom/DOMImplementation.cpp b/WebCore/dom/DOMImplementation.cpp
index 3483b23..467f1fc 100644
--- a/WebCore/dom/DOMImplementation.cpp
+++ b/WebCore/dom/DOMImplementation.cpp
@@ -256,10 +256,11 @@ PassRefPtr<Document> DOMImplementation::createDocument(const String& namespaceUR
         return 0;
     }
 
+    // FIXME: Shouldn't this call appendChild instead?
     if (doctype)
-        doc->addChild(doctype);
+        doc->legacyParserAddChild(doctype);
     if (documentElement)
-        doc->addChild(documentElement.release());
+        doc->legacyParserAddChild(documentElement.release());
 
     return doc.release();
 }
diff --git a/WebCore/dom/DOMStringMap.cpp b/WebCore/dom/DOMStringMap.cpp
new file mode 100644
index 0000000..e63dabe
--- /dev/null
+++ b/WebCore/dom/DOMStringMap.cpp
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMStringMap.h"
+
+namespace WebCore {
+
+DOMStringMap::~DOMStringMap()
+{
+}
+
+} // namespace WebCore
diff --git a/WebCore/dom/DOMStringMap.h b/WebCore/dom/DOMStringMap.h
new file mode 100644
index 0000000..c0bc07d
--- /dev/null
+++ b/WebCore/dom/DOMStringMap.h
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOMStringMap_h
+#define DOMStringMap_h
+
+#include "PlatformString.h"
+#include <wtf/Noncopyable.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+typedef int ExceptionCode;
+
+class DOMStringMap : public Noncopyable {
+public:
+    virtual ~DOMStringMap();
+
+    virtual void ref() = 0;
+    virtual void deref() = 0;
+
+    virtual void getNames(Vector<String>&) = 0;
+    virtual String item(const String& name) = 0;
+    virtual bool contains(const String& name) = 0;
+    virtual void setItem(const String& name, const String& value, ExceptionCode&) = 0;
+    virtual void deleteItem(const String& name, ExceptionCode&) = 0;
+
+protected:
+    DOMStringMap()
+    {
+    }
+};
+
+} // namespace WebCore
+
+#endif // DOMStringMap_h
diff --git a/WebCore/dom/DOMStringMap.idl b/WebCore/dom/DOMStringMap.idl
new file mode 100644
index 0000000..0320b3b
--- /dev/null
+++ b/WebCore/dom/DOMStringMap.idl
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module core {
+
+    interface [
+        HasNameGetter,
+        CustomDeleteProperty,
+        CustomGetPropertyNames,
+        DelegatingPutFunction,
+    ] DOMStringMap {
+    };
+
+}
diff --git a/WebCore/dom/DatasetDOMStringMap.cpp b/WebCore/dom/DatasetDOMStringMap.cpp
new file mode 100644
index 0000000..6359d55
--- /dev/null
+++ b/WebCore/dom/DatasetDOMStringMap.cpp
@@ -0,0 +1,192 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DatasetDOMStringMap.h"
+
+#include "Attribute.h"
+#include "Element.h"
+#include "ExceptionCode.h"
+#include "NamedNodeMap.h"
+#include <wtf/ASCIICType.h>
+
+namespace WebCore {
+
+static bool isValidAttributeName(const String& name)
+{
+    if (!name.startsWith("data-"))
+        return false;
+
+    const UChar* characters = name.characters();
+    unsigned length = name.length();
+    for (unsigned i = 5; i < length; ++i) {
+        if (isASCIIUpper(characters[i]))
+            return false;
+    }
+
+    return true;
+}
+
+static String convertAttributeNameToPropertyName(const String& name)
+{
+    Vector<UChar> newStringBuffer;
+
+    const UChar* characters = name.characters();
+    unsigned length = name.length();
+    for (unsigned i = 5; i < length; ++i) {
+        if (characters[i] != '-')
+            newStringBuffer.append(characters[i]);
+        else {
+            if ((i + 1 < length) && isASCIILower(characters[i + 1])) {
+                newStringBuffer.append(toASCIIUpper(characters[i + 1]));
+                ++i;
+            } else
+                newStringBuffer.append(characters[i]);
+        }
+    }
+
+    return String::adopt(newStringBuffer);
+}
+
+static bool propertyNameMatchesAttributeName(const String& propertyName, const String& attributeName)
+{
+    // FIXME: This should be able to match without creating a new string.
+
+    if (!isValidAttributeName(attributeName))
+        return false;
+
+    String convertedName = convertAttributeNameToPropertyName(attributeName);
+    return (convertedName == propertyName);
+}
+
+static bool isValidPropertyName(const String& name)
+{
+    const UChar* characters = name.characters();
+    unsigned length = name.length();
+    for (unsigned i = 0; i < length; ++i) {
+        if (characters[i] == '-' && (i + 1 < length) && isASCIILower(characters[i + 1]))
+            return false;
+    }
+    return true;
+}
+
+static String convertPropertyNameToAttributeName(const String& name)
+{
+    Vector<UChar> newStringBuffer;
+
+    newStringBuffer.append('d');
+    newStringBuffer.append('a');
+    newStringBuffer.append('t');
+    newStringBuffer.append('a');
+    newStringBuffer.append('-');
+
+    const UChar* characters = name.characters();
+    unsigned length = name.length();
+    for (unsigned i = 0; i < length; ++i) {
+        if (isASCIIUpper(characters[i])) {
+            newStringBuffer.append('-');
+            newStringBuffer.append(toASCIILower(characters[i]));
+        } else
+            newStringBuffer.append(characters[i]);
+    }
+
+    return String::adopt(newStringBuffer);
+}
+
+
+void DatasetDOMStringMap::ref()
+{
+    m_element->ref();
+}
+
+void DatasetDOMStringMap::deref()
+{
+    m_element->deref();
+}
+
+void DatasetDOMStringMap::getNames(Vector<String>& names)
+{
+    NamedNodeMap* attributeMap = m_element->attributes(true);
+    if (attributeMap) {
+        unsigned length = attributeMap->length();
+        for (unsigned i = 0; i < length; i++) {
+            Attribute* attribute = attributeMap->attributeItem(i);
+            if (isValidAttributeName(attribute->localName()))
+                names.append(convertAttributeNameToPropertyName(attribute->localName()));
+        }
+    }
+}
+
+String DatasetDOMStringMap::item(const String& name)
+{
+    NamedNodeMap* attributeMap = m_element->attributes(true);
+    if (attributeMap) {
+        unsigned length = attributeMap->length();
+        for (unsigned i = 0; i < length; i++) {
+            Attribute* attribute = attributeMap->attributeItem(i);
+            if (propertyNameMatchesAttributeName(name, attribute->localName()))
+                return attribute->value();
+        }
+    }
+
+    return String();
+}
+
+bool DatasetDOMStringMap::contains(const String& name)
+{
+    NamedNodeMap* attributeMap = m_element->attributes(true);
+    if (attributeMap) {
+        unsigned length = attributeMap->length();
+        for (unsigned i = 0; i < length; i++) {
+            Attribute* attribute = attributeMap->attributeItem(i);
+            if (propertyNameMatchesAttributeName(name, attribute->localName()))
+                return true;
+        }
+    }
+    return false;
+}
+
+void DatasetDOMStringMap::setItem(const String& name, const String& value, ExceptionCode& ec)
+{
+    if (!isValidPropertyName(name)) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+
+    m_element->setAttribute(convertPropertyNameToAttributeName(name), value, ec);
+}
+
+void DatasetDOMStringMap::deleteItem(const String& name, ExceptionCode& ec)
+{
+    if (!isValidPropertyName(name)) {
+        ec = SYNTAX_ERR;
+        return;
+    }
+
+    ExceptionCode dummy;
+    m_element->removeAttribute(convertPropertyNameToAttributeName(name), dummy);
+}
+
+} // namespace WebCore
diff --git a/WebCore/dom/DatasetDOMStringMap.h b/WebCore/dom/DatasetDOMStringMap.h
new file mode 100644
index 0000000..f82eaa5
--- /dev/null
+++ b/WebCore/dom/DatasetDOMStringMap.h
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DatasetDOMStringMap_h
+#define DatasetDOMStringMap_h
+
+#include "DOMStringMap.h"
+#include <wtf/PassOwnPtr.h>
+
+namespace WebCore {
+
+class Element;
+
+class DatasetDOMStringMap : public DOMStringMap {
+public:
+    static PassOwnPtr<DatasetDOMStringMap> create(Element* element)
+    {
+        return new DatasetDOMStringMap(element);
+    }
+
+    virtual void ref();
+    virtual void deref();
+
+    virtual void getNames(Vector<String>&);
+    virtual String item(const String& name);
+    virtual bool contains(const String& name);
+    virtual void setItem(const String& name, const String& value, ExceptionCode&);
+    virtual void deleteItem(const String& name, ExceptionCode&);
+
+private:
+    DatasetDOMStringMap(Element* element)
+        : m_element(element)
+    {
+    }
+
+    Element* m_element;
+};
+
+} // namespace WebCore
+
+#endif // DatasetDOMStringMap_h
diff --git a/WebCore/dom/DecodedDataDocumentParser.cpp b/WebCore/dom/DecodedDataDocumentParser.cpp
new file mode 100644
index 0000000..51cc847
--- /dev/null
+++ b/WebCore/dom/DecodedDataDocumentParser.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DecodedDataDocumentParser.h"
+
+#include "DocumentWriter.h"
+#include "SegmentedString.h"
+#include "TextResourceDecoder.h"
+
+namespace WebCore {
+
+DecodedDataDocumentParser::DecodedDataDocumentParser(Document* document, bool viewSourceMode)
+    : DocumentParser(document)
+    , m_inViewSourceMode(viewSourceMode)
+{
+}
+
+void DecodedDataDocumentParser::appendBytes(DocumentWriter* writer , const char* data, int length, bool shouldFlush)
+{
+    if (!length && !shouldFlush)
+        return;
+
+    TextResourceDecoder* decoder = writer->createDecoderIfNeeded();
+    String decoded = decoder->decode(data, length);
+    if (shouldFlush)
+        decoded += decoder->flush();
+    if (decoded.isEmpty())
+        return;
+
+    writer->reportDataRecieved();
+
+    append(decoded);
+}
+
+};
+
diff --git a/WebCore/dom/DecodedDataDocumentParser.h b/WebCore/dom/DecodedDataDocumentParser.h
new file mode 100644
index 0000000..f45bb68
--- /dev/null
+++ b/WebCore/dom/DecodedDataDocumentParser.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef DecodedDataDocumentParser_h
+#define DecodedDataDocumentParser_h
+
+#include "DocumentParser.h"
+
+namespace WebCore {
+
+class DecodedDataDocumentParser : public DocumentParser {
+public:
+    // Only used by the XMLDocumentParser to communicate back to
+    // XMLHttpRequest if the responseXML was well formed.
+    virtual bool wellFormed() const { return true; }
+
+    bool inViewSourceMode() const { return m_inViewSourceMode; }
+    void setInViewSourceMode(bool mode) { m_inViewSourceMode = mode; }
+
+protected:
+    DecodedDataDocumentParser(Document*, bool viewSourceMode = false);
+
+private:
+    // append is used by DocumentWriter::replaceDocument
+    virtual void append(const SegmentedString&) = 0;
+
+    // appendBytes is used by DocumentWriter (the loader)
+    virtual void appendBytes(DocumentWriter*, const char* bytes, int length, bool flush);
+
+    bool m_inViewSourceMode;
+};
+
+}
+
+#endif // DecodedDataDocumentParser_h
diff --git a/WebCore/dom/Document.cpp b/WebCore/dom/Document.cpp
index 99ec33e..be2bb4c 100644
--- a/WebCore/dom/Document.cpp
+++ b/WebCore/dom/Document.cpp
@@ -1549,29 +1549,42 @@ bool Document::isPageBoxVisible(int pageIndex)
     return style->visibility() != HIDDEN; // display property doesn't apply to @page.
 }
 
-IntRect Document::pageAreaRectInPixels(int pageIndex)
+void Document::pageSizeAndMarginsInPixels(int pageIndex, IntSize& pageSize, int& marginTop, int& marginRight, int& marginBottom, int& marginLeft)
 {
     RefPtr<RenderStyle> style = styleForPage(pageIndex);
-    IntSize pageSize = preferredPageSizeInPixels(pageIndex);
-    // 100% value for margin-{left,right,top,bottom}. This is used also for top and bottom. http://www.w3.org/TR/CSS2/box.html#value-def-margin-width
-    int maxValue = pageSize.width();
-    int surroundLeft = style->marginLeft().calcValue(maxValue) + style->borderLeft().width() + style->paddingLeft().calcValue(maxValue);
-    int surroundRight = style->marginRight().calcValue(maxValue) + style->borderRight().width() + style->paddingRight().calcValue(maxValue);
-    int surroundTop = style->marginTop().calcValue(maxValue) + style->borderTop().width() + style->paddingTop().calcValue(maxValue);
-    int surroundBottom = style->marginBottom().calcValue(maxValue) + style->borderBottom().width() + style->paddingBottom().calcValue(maxValue);
-    int width = pageSize.width() - surroundLeft - surroundRight;
-    int height = pageSize.height() - surroundTop - surroundBottom;
 
-    return IntRect(surroundLeft, surroundTop, width, height);
-}
+    int width = pageSize.width();
+    int height = pageSize.height();
+    switch (style->pageSizeType()) {
+    case PAGE_SIZE_AUTO:
+        break;
+    case PAGE_SIZE_AUTO_LANDSCAPE:
+        if (width < height)
+            std::swap(width, height);
+        break;
+    case PAGE_SIZE_AUTO_PORTRAIT:
+        if (width > height)
+            std::swap(width, height);
+        break;
+    case PAGE_SIZE_RESOLVED: {
+        LengthSize size = style->pageSize();
+        ASSERT(size.width().isFixed());
+        ASSERT(size.height().isFixed());
+        width = size.width().calcValue(0);
+        height = size.height().calcValue(0);
+        break;
+    }
+    default:
+        ASSERT_NOT_REACHED();
+    }
+    pageSize = IntSize(width, height);
 
-IntSize Document::preferredPageSizeInPixels(int pageIndex)
-{
-    RefPtr<RenderStyle> style = styleForPage(pageIndex);
-    LengthSize size = style->pageSize();
-    ASSERT(size.width().isFixed());
-    ASSERT(size.height().isFixed());
-    return IntSize(size.width().calcValue(0), size.height().calcValue(0));
+    // The percentage is calculated with respect to the width even for margin top and bottom.
+    // http://www.w3.org/TR/CSS2/box.html#margin-properties
+    marginTop = style->marginTop().isAuto() ? marginTop : style->marginTop().calcValue(width);
+    marginRight = style->marginRight().isAuto() ? marginRight : style->marginRight().calcValue(width);
+    marginBottom = style->marginBottom().isAuto() ? marginBottom : style->marginBottom().calcValue(width);
+    marginLeft = style->marginLeft().isAuto() ? marginLeft : style->marginLeft().calcValue(width);
 }
 
 void Document::createStyleSelector()
@@ -1754,6 +1767,11 @@ DocumentParser* Document::createParser()
     return new XMLDocumentParser(this, view());
 }
 
+ScriptableDocumentParser* Document::scriptableDocumentParser() const
+{
+    return parser() ? parser()->asScriptableDocumentParser() : 0;
+}
+
 void Document::open(Document* ownerDocument)
 {
     if (ownerDocument) {
@@ -1763,9 +1781,10 @@ void Document::open(Document* ownerDocument)
     }
 
     if (m_frame) {
-        if (m_frame->loader()->isLoadingMainResource() || (parser() && parser()->isExecutingScript()))
+        ScriptableDocumentParser* parser = scriptableDocumentParser();
+        if (m_frame->loader()->isLoadingMainResource() || (parser && parser->isExecutingScript()))
             return;
-    
+
         if (m_frame->loader()->state() == FrameStateProvisional)
             m_frame->loader()->stopAllLoaders();
     }
@@ -1802,8 +1821,9 @@ void Document::implicitOpen()
     m_parser = createParser();
     setParsing(true);
 
-    if (m_frame)
-        m_parser->setXSSAuditor(m_frame->script()->xssAuditor());
+    ScriptableDocumentParser* parser = scriptableDocumentParser();
+    if (m_frame && parser)
+        parser->setXSSAuditor(m_frame->script()->xssAuditor());
 
     // If we reload, the animation controller sticks around and has
     // a stale animation time. We need to update it here.
@@ -1888,7 +1908,8 @@ void Document::implicitClose()
 
     m_processingLoadEvent = true;
 
-    m_wellFormed = m_parser && m_parser->wellFormed();
+    ScriptableDocumentParser* parser = scriptableDocumentParser();
+    m_wellFormed = parser && parser->wellFormed();
 
     // We have to clear the parser, in case someone document.write()s from the
     // onLoad event handler, as in Radar 3206524.
@@ -2044,21 +2065,7 @@ void Document::write(const SegmentedString& text, Document* ownerDocument)
         open(ownerDocument);
 
     ASSERT(m_parser);
-    // FIXME: forceSynchronous should always be the same as the bool passed to
-    // write().  However LegacyHTMLDocumentParser uses write("", false) to pump
-    // the parser (after running external scripts, etc.) thus necessitating a
-    // separate state for forceSynchronous.
-    bool wasForcedSynchronous = false;
-    LegacyHTMLDocumentParser* parser = m_parser->asHTMLDocumentParser();
-    if (parser) {
-        wasForcedSynchronous = parser->forceSynchronous();
-        parser->setForceSynchronous(true);
-    }
-
-    m_parser->write(text, false);
-
-    if (m_parser && parser && m_parser->asHTMLDocumentParser() == parser)
-        parser->setForceSynchronous(wasForcedSynchronous);
+    m_parser->insert(text);
 
 #ifdef INSTRUMENT_LAYOUT_SCHEDULING
     if (!ownerElement())
@@ -2667,9 +2674,10 @@ void Document::removePendingSheet()
 #endif
 
     updateStyleSelector();
-    
-    if (!m_pendingStylesheets && m_parser)
-        m_parser->executeScriptsWaitingForStylesheets();
+
+    ScriptableDocumentParser* parser = scriptableDocumentParser();
+    if (!m_pendingStylesheets && parser)
+        parser->executeScriptsWaitingForStylesheets();
 
     if (!m_pendingStylesheets && m_gotoAnchorNeededAfterStylesheetsLoad && view())
         view()->scrollToFragment(m_frame->loader()->url());
@@ -3348,6 +3356,8 @@ void Document::addListenerTypeIfNeeded(const AtomicString& eventType)
         addListenerType(TRANSITIONEND_LISTENER);
     else if (eventType == eventNames().beforeloadEvent)
         addListenerType(BEFORELOAD_LISTENER);
+    else if (eventType == eventNames().beforeprocessEvent)
+        addListenerType(BEFOREPROCESS_LISTENER);
 #if ENABLE(TOUCH_EVENTS)
     else if (eventType == eventNames().touchstartEvent
              || eventType == eventNames().touchmoveEvent
@@ -4900,8 +4910,10 @@ HTMLCanvasElement* Document::getCSSCanvasElement(const String& name)
 
 void Document::initDNSPrefetch()
 {
+    Settings* settings = this->settings();
+
     m_haveExplicitlyDisabledDNSPrefetch = false;
-    m_isDNSPrefetchEnabled = securityOrigin()->protocol() == "http";
+    m_isDNSPrefetchEnabled = settings && settings->dnsPrefetchingEnabled() && securityOrigin()->protocol() == "http";
 
     // Inherit DNS prefetch opt-out from parent frame    
     if (Document* parent = parentDocument()) {
diff --git a/WebCore/dom/Document.h b/WebCore/dom/Document.h
index dc4b6ba..3d9cf48 100644
--- a/WebCore/dom/Document.h
+++ b/WebCore/dom/Document.h
@@ -37,6 +37,7 @@
 #include "QualifiedName.h"
 #include "ScriptExecutionContext.h"
 #include "Timer.h"
+#include <wtf/FixedArray.h>
 #include <wtf/HashCountedSet.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -100,6 +101,7 @@ namespace WebCore {
     class RegisteredEventListener;
     class RenderArena;
     class RenderView;
+    class ScriptableDocumentParser;
     class ScriptElementData;
     class SecurityOrigin;
     class SerializedScriptValue;
@@ -483,9 +485,16 @@ public:
     void updateLayoutIgnorePendingStylesheets();
     PassRefPtr<RenderStyle> styleForElementIgnoringPendingStylesheets(Element*);
     PassRefPtr<RenderStyle> styleForPage(int pageIndex);
+
+    // Returns true if page box (margin boxes and page borders) is visible.
     bool isPageBoxVisible(int pageIndex);
-    IntRect pageAreaRectInPixels(int pageIndex);
-    IntSize preferredPageSizeInPixels(int pageIndex);
+
+    // Returns the preferred page size and margins in pixels, assuming 96
+    // pixels per inch. pageSize, marginTop, marginRight, marginBottom,
+    // marginLeft must be initialized to the default values that are used if
+    // auto is specified.
+    void pageSizeAndMarginsInPixels(int pageIndex, IntSize& pageSize, int& marginTop, int& marginRight, int& marginBottom, int& marginLeft);
+
     static void updateStyleForAllDocuments(); // FIXME: Try to reduce the # of calls to this function.
     DocLoader* docLoader() { return m_docLoader.get(); }
 
@@ -541,7 +550,8 @@ public:
     CSSStyleSheet* mappedElementSheet();
     
     virtual DocumentParser* createParser();
-    DocumentParser* parser() { return m_parser.get(); }
+    DocumentParser* parser() const { return m_parser.get(); }
+    ScriptableDocumentParser* scriptableDocumentParser() const;
     
     bool printing() const { return m_printing; }
     void setPrinting(bool p) { m_printing = p; }
@@ -663,7 +673,8 @@ public:
         ANIMATIONITERATION_LISTENER          = 0x400,
         TRANSITIONEND_LISTENER               = 0x800,
         BEFORELOAD_LISTENER                  = 0x1000,
-        TOUCH_LISTENER                       = 0x2000
+        TOUCH_LISTENER                       = 0x2000,
+        BEFOREPROCESS_LISTENER               = 0x4000
     };
 
     bool hasListenerType(ListenerType listenerType) const { return (m_listenerTypes & listenerType); }
@@ -1226,8 +1237,8 @@ private:
     CheckedRadioButtons m_checkedRadioButtons;
 
     typedef HashMap<AtomicStringImpl*, CollectionCache*> NamedCollectionMap;
-    CollectionCache m_collectionInfo[NumUnnamedDocumentCachedTypes];
-    NamedCollectionMap m_nameCollectionInfo[NumNamedDocumentCachedTypes];
+    FixedArray<CollectionCache, NumUnnamedDocumentCachedTypes> m_collectionInfo;
+    FixedArray<NamedCollectionMap, NumNamedDocumentCachedTypes> m_nameCollectionInfo;
 
 #if ENABLE(XPATH)
     RefPtr<XPathEvaluator> m_xpathEvaluator;
diff --git a/WebCore/dom/DocumentFragment.cpp b/WebCore/dom/DocumentFragment.cpp
index 7287439..ecc5725 100644
--- a/WebCore/dom/DocumentFragment.cpp
+++ b/WebCore/dom/DocumentFragment.cpp
@@ -91,7 +91,7 @@ void DocumentFragment::parseHTML(const String& source, FragmentScriptingPermissi
 
 bool DocumentFragment::parseXML(const String& source, Element* parent, FragmentScriptingPermission scriptingPermission)
 {
-    return parseXMLDocumentFragment(source, this, parent, scriptingPermission);
+    return XMLDocumentParser::parseDocumentFragment(source, this, parent, scriptingPermission);
 }
 
 }
diff --git a/WebCore/dom/DocumentParser.cpp b/WebCore/dom/DocumentParser.cpp
new file mode 100644
index 0000000..b80927c
--- /dev/null
+++ b/WebCore/dom/DocumentParser.cpp
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DocumentParser.h"
+
+#include <wtf/Assertions.h>
+
+namespace WebCore {
+
+DocumentParser::DocumentParser(Document* document)
+    : m_parserStopped(false)
+    , m_document(document)
+{
+    ASSERT(document);
+}
+
+};
+
diff --git a/WebCore/dom/DocumentParser.h b/WebCore/dom/DocumentParser.h
index 881136c..7e47a87 100644
--- a/WebCore/dom/DocumentParser.h
+++ b/WebCore/dom/DocumentParser.h
@@ -24,29 +24,34 @@
 #ifndef DocumentParser_h
 #define DocumentParser_h
 
-#include <wtf/Assertions.h>
+#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
 class Document;
+class DocumentWriter;
 class LegacyHTMLTreeBuilder;
-class LegacyHTMLDocumentParser;
 class SegmentedString;
-class XSSAuditor;
+class ScriptableDocumentParser;
 
 class DocumentParser : public Noncopyable {
 public:
     virtual ~DocumentParser() { }
 
-    // Script output must be prepended, while new data
-    // received during executing a script must be appended, hence the
-    // extra bool to be able to distinguish between both cases.
-    // document.write() always uses false, while the loader uses true.
-    virtual void write(const SegmentedString&, bool isFromNetwork) = 0;
+    virtual ScriptableDocumentParser* asScriptableDocumentParser() { return 0; }
+
+    // insert is used by document.write
+    virtual void insert(const SegmentedString&) = 0;
+
+    // appendBytes is used by DocumentWriter (the loader)
+    virtual void appendBytes(DocumentWriter*, const char* bytes, int length, bool flush) = 0;
+
+    // FIXME: append() should be private, but DocumentWriter::replaceDocument
+    // uses it for now.
+    virtual void append(const SegmentedString&) = 0;
+
     virtual void finish() = 0;
     virtual bool finishWasCalled() = 0;
-    virtual bool isWaitingForScripts() const = 0;
-    virtual bool isExecutingScript() const { return false; }
 
     virtual void stopParsing() { m_parserStopped = true; }
     // FIXME: processingData() is only used by DocumentLoader::isLoadingInAPISense
@@ -54,53 +59,22 @@ public:
     // actually implements it.
     virtual bool processingData() const { return false; }
 
-    virtual bool wantsRawData() const { return false; }
-    virtual bool writeRawData(const char* /*data*/, int /*length*/)
-    {
-        ASSERT_NOT_REACHED();
-        return false;
-    }
-
-    virtual bool wellFormed() const { return true; }
-
-    virtual int lineNumber() const { return -1; }
-    virtual int columnNumber() const { return -1; }
-
-    virtual void executeScriptsWaitingForStylesheets() {}
-
+    // FIXME: Exposed for HTMLFormControlElement::removedFromTree.  HTML DOM
+    // code should not need to reach into implementation details of the parser.
     virtual LegacyHTMLTreeBuilder* htmlTreeBuilder() const { return 0; }
-    virtual LegacyHTMLDocumentParser* asHTMLDocumentParser() { return 0; }
-
-    // FIXME: view source mode is only used by the HTML and Text
-    // DocumentParsers and may not belong on the base-class.
-    bool inViewSourceMode() const { return m_inViewSourceMode; }
-    void setInViewSourceMode(bool mode) { m_inViewSourceMode = mode; }
 
     Document* document() const { return m_document; }
 
-    XSSAuditor* xssAuditor() const { return m_XSSAuditor; }
-    void setXSSAuditor(XSSAuditor* auditor) { m_XSSAuditor = auditor; }
-
 protected:
-    DocumentParser(Document* document, bool viewSourceMode = false)
-        : m_parserStopped(false)
-        , m_inViewSourceMode(viewSourceMode)
-        , m_document(document)
-        , m_XSSAuditor(0)
-    {
-        ASSERT(document);
-    }
+    DocumentParser(Document*);
 
     // The parser has buffers, so parsing may continue even after
     // it stops receiving data. We use m_parserStopped to stop the parser
     // even when it has buffered data.
     bool m_parserStopped;
-    bool m_inViewSourceMode;
 
     // Every DocumentParser needs a pointer back to the document.
     Document* m_document;
-    // The XSSAuditor associated with this document parser.
-    XSSAuditor* m_XSSAuditor;
 };
 
 } // namespace WebCore
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index adbb720..3dbd880 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -33,6 +33,7 @@
 #include "CSSStyleSelector.h"
 #include "ClientRect.h"
 #include "ClientRectList.h"
+#include "DatasetDOMStringMap.h"
 #include "Document.h"
 #include "DocumentFragment.h"
 #include "ElementRareData.h"
@@ -153,10 +154,10 @@ PassRefPtr<Element> Element::cloneElementWithoutChildren()
     // This is a sanity check as HTML overloads some of the DOM methods.
     ASSERT(isHTMLElement() == clone->isHTMLElement());
 
-    // Clone attributes.
-    if (namedAttrMap)
-        clone->attributes()->setAttributes(*attributes(true)); // Call attributes(true) to force attribute synchronization to occur (for svg and style) before cloning happens.
-    
+    // Call attributes(true) to force attribute synchronization to occur for SVG and style attributes.
+    if (NamedNodeMap* attributeMap = attributes(true))
+        clone->attributes()->setAttributes(*attributeMap);
+
     clone->copyNonAttributeProperties(this);
 
     return clone.release();
@@ -1520,6 +1521,14 @@ bool Element::webkitMatchesSelector(const String& selector, ExceptionCode& ec)
     return false;
 }
 
+DOMStringMap* Element::dataset()
+{
+    ElementRareData* data = ensureRareData();
+    if (!data->m_datasetDOMStringMap)
+        data->m_datasetDOMStringMap = DatasetDOMStringMap::create(this);
+    return data->m_datasetDOMStringMap.get();
+}
+
 KURL Element::getURLAttribute(const QualifiedName& name) const
 {
 #if !ASSERT_DISABLED
diff --git a/WebCore/dom/Element.h b/WebCore/dom/Element.h
index a0cf7b1..7dd7d80 100644
--- a/WebCore/dom/Element.h
+++ b/WebCore/dom/Element.h
@@ -35,6 +35,7 @@ namespace WebCore {
 class Attribute;
 class ClientRect;
 class ClientRectList;
+class DOMStringMap;
 class ElementRareData;
 class IntSize;
 
@@ -262,6 +263,8 @@ public:
 
     bool webkitMatchesSelector(const String& selectors, ExceptionCode&);
 
+    DOMStringMap* dataset();
+
     virtual bool isFormControlElement() const { return false; }
     virtual bool isEnabledFormControl() const { return true; }
     virtual bool isReadOnlyFormControl() const { return false; }
diff --git a/WebCore/dom/Element.idl b/WebCore/dom/Element.idl
index 6bb0687..0ad3184 100644
--- a/WebCore/dom/Element.idl
+++ b/WebCore/dom/Element.idl
@@ -99,6 +99,12 @@ module core {
         // HTML 5
         NodeList getElementsByClassName(in DOMString name);
 
+#if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
+#if !defined(V8_BINDING) || !V8_BINDING
+        readonly attribute DOMStringMap dataset;
+#endif
+#endif
+
         // NodeSelector - Selector API
         Element querySelector(in DOMString selectors)
             raises(DOMException);
diff --git a/WebCore/dom/ElementRareData.h b/WebCore/dom/ElementRareData.h
index b444d99..8e338ab 100644
--- a/WebCore/dom/ElementRareData.h
+++ b/WebCore/dom/ElementRareData.h
@@ -22,8 +22,10 @@
 #ifndef ElementRareData_h
 #define ElementRareData_h
 
+#include "DatasetDOMStringMap.h"
 #include "Element.h"
 #include "NodeRareData.h"
+#include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
@@ -38,6 +40,8 @@ public:
 
     IntSize m_minimumSizeForResizing;
     RefPtr<RenderStyle> m_computedStyle;
+
+    OwnPtr<DatasetDOMStringMap> m_datasetDOMStringMap;
 };
 
 inline IntSize defaultMinimumSizeForResizing()
diff --git a/WebCore/dom/EventNames.h b/WebCore/dom/EventNames.h
index 0491d02..65abfbf 100644
--- a/WebCore/dom/EventNames.h
+++ b/WebCore/dom/EventNames.h
@@ -34,6 +34,7 @@ namespace WebCore {
     macro(beforecut) \
     macro(beforeload) \
     macro(beforepaste) \
+    macro(beforeprocess) \
     macro(beforeunload) \
     macro(blur) \
     macro(cached) \
diff --git a/WebCore/dom/Node.cpp b/WebCore/dom/Node.cpp
index 4b25d9a..77a88e7 100644
--- a/WebCore/dom/Node.cpp
+++ b/WebCore/dom/Node.cpp
@@ -644,11 +644,16 @@ const AtomicString& Node::virtualNamespaceURI() const
     return nullAtom;
 }
 
-ContainerNode* Node::addChild(PassRefPtr<Node>)
+ContainerNode* Node::legacyParserAddChild(PassRefPtr<Node>)
 {
     return 0;
 }
 
+void Node::parserAddChild(PassRefPtr<Node>)
+{
+    ASSERT_NOT_REACHED();
+}
+
 bool Node::isContentEditable() const
 {
     return parent() && parent()->isContentEditable();
diff --git a/WebCore/dom/Node.h b/WebCore/dom/Node.h
index 6e99cd7..a839c0e 100644
--- a/WebCore/dom/Node.h
+++ b/WebCore/dom/Node.h
@@ -264,7 +264,10 @@ public:
     // Used by the parser. Checks against the DTD, unlike DOM operations like appendChild().
     // Also does not dispatch DOM mutation events.
     // Returns the appropriate container node for future insertions as you parse, or 0 for failure.
-    virtual ContainerNode* addChild(PassRefPtr<Node>);
+    virtual ContainerNode* legacyParserAddChild(PassRefPtr<Node>);
+    // addChild is tied into the logic of the LegacyHTMLTreeBuilder.  We need
+    // a "clean" version to use for the HTML5 version of the HTMLTreeBuilder.
+    virtual void parserAddChild(PassRefPtr<Node>);
 
     // Called by the parser when this element's close tag is reached,
     // signaling that all child tags have been parsed and added.
diff --git a/WebCore/dom/Node.idl b/WebCore/dom/Node.idl
index dec6b19..07046d1 100644
--- a/WebCore/dom/Node.idl
+++ b/WebCore/dom/Node.idl
@@ -134,7 +134,6 @@ module core {
 
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
 #if !defined(LANGUAGE_OBJECTIVE_C) || !LANGUAGE_OBJECTIVE_C
-#if !defined(LANGUAGE_GOBJECT) || !LANGUAGE_GOBJECT
         void addEventListener(in DOMString type, 
                               in EventListener listener, 
                               in boolean useCapture);
@@ -145,7 +144,6 @@ module core {
             raises(EventException);
 #endif
 #endif
-#endif
 
 #if defined(LANGUAGE_CPP) && LANGUAGE_CPP
         [Custom] void addEventListener(in DOMString type, 
diff --git a/WebCore/dom/RawDataDocumentParser.h b/WebCore/dom/RawDataDocumentParser.h
index 77d148d..2eb3d0a 100644
--- a/WebCore/dom/RawDataDocumentParser.h
+++ b/WebCore/dom/RawDataDocumentParser.h
@@ -30,12 +30,6 @@
 
 namespace WebCore {
 
-// FIXME: It seems wrong that RawDataDocumentParser is a subclass of
-// DocumentParser.  RawDataDocumentParser, just wants to override an earlier
-// version of write() before the data is decoded.  Seems the decoding could
-// move into the base-class DocumentParser, and then RawDataDocumentParser
-// would just be short-circuting.  That could simplify some of the
-// DocumentWriter logic.
 class RawDataDocumentParser : public DocumentParser {
 public:
     RawDataDocumentParser(Document* document)
@@ -51,23 +45,23 @@ protected:
     }
 
 private:
-    virtual void write(const SegmentedString&, bool)
+    virtual void insert(const SegmentedString&)
     {
         // <https://bugs.webkit.org/show_bug.cgi?id=25397>: JS code can always call document.write, we need to handle it.
         ASSERT_NOT_REACHED();
     }
 
+    virtual void append(const SegmentedString&)
+    {
+        ASSERT_NOT_REACHED();
+    }
+
     virtual bool finishWasCalled()
     {
         // finish() always calls document()->finishedParsing() so we will be
         // deleted after finish().
         return false;
     }
-
-    virtual bool isWaitingForScripts() const { return false; }
-
-    virtual bool wantsRawData() const { return true; }
-    virtual bool writeRawData(const char*, int) { return false; }
 };
 
 };
diff --git a/WebCore/dom/ScriptExecutionContext.cpp b/WebCore/dom/ScriptExecutionContext.cpp
index 226aad8..291243d 100644
--- a/WebCore/dom/ScriptExecutionContext.cpp
+++ b/WebCore/dom/ScriptExecutionContext.cpp
@@ -109,38 +109,9 @@ DatabaseThread* ScriptExecutionContext::databaseThread()
     return m_databaseThread.get();
 }
 
-void ScriptExecutionContext::addOpenDatabase(Database* database)
-{
-    ASSERT(isContextThread());
-    if (!m_openDatabaseSet)
-        m_openDatabaseSet.set(new DatabaseSet());
-
-    ASSERT(!m_openDatabaseSet->contains(database));
-    m_openDatabaseSet->add(database);
-}
-
-void ScriptExecutionContext::removeOpenDatabase(Database* database)
-{
-    ASSERT(isContextThread());
-    ASSERT(m_openDatabaseSet && m_openDatabaseSet->contains(database));
-    if (!m_openDatabaseSet)
-        return;
-    m_openDatabaseSet->remove(database);
-}
-
 void ScriptExecutionContext::stopDatabases(DatabaseTaskSynchronizer* cleanupSync)
 {
     ASSERT(isContextThread());
-    if (m_openDatabaseSet) {
-        DatabaseSet::iterator i = m_openDatabaseSet->begin();
-        DatabaseSet::iterator end = m_openDatabaseSet->end();
-        for (; i != end; ++i) {
-            (*i)->stop();
-            if (m_databaseThread)
-                m_databaseThread->unscheduleDatabaseTasks(*i);
-        }
-    }
-    
     if (m_databaseThread)
         m_databaseThread->requestTermination(cleanupSync);
     else if (cleanupSync)
diff --git a/WebCore/dom/ScriptExecutionContext.h b/WebCore/dom/ScriptExecutionContext.h
index 18e2cd0..4cd483a 100644
--- a/WebCore/dom/ScriptExecutionContext.h
+++ b/WebCore/dom/ScriptExecutionContext.h
@@ -70,8 +70,6 @@ namespace WebCore {
         DatabaseThread* databaseThread();
         void setHasOpenDatabases() { m_hasOpenDatabases = true; }
         bool hasOpenDatabases() const { return m_hasOpenDatabases; }
-        void addOpenDatabase(Database*);
-        void removeOpenDatabase(Database*);
         // When the database cleanup is done, cleanupSync will be signalled.
         void stopDatabases(DatabaseTaskSynchronizer*);
 #endif
@@ -160,8 +158,6 @@ namespace WebCore {
 #if ENABLE(DATABASE)
         RefPtr<DatabaseThread> m_databaseThread;
         bool m_hasOpenDatabases; // This never changes back to false, even after the database thread is closed.
-        typedef HashSet<Database* > DatabaseSet;
-        OwnPtr<DatabaseSet> m_openDatabaseSet;
 #endif
 
 #if ENABLE(FILE_READER) || ENABLE(FILE_WRITER)
diff --git a/WebCore/dom/ScriptableDocumentParser.cpp b/WebCore/dom/ScriptableDocumentParser.cpp
new file mode 100644
index 0000000..43b3417
--- /dev/null
+++ b/WebCore/dom/ScriptableDocumentParser.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ScriptableDocumentParser.h"
+
+namespace WebCore {
+
+ScriptableDocumentParser::ScriptableDocumentParser(Document* document, bool viewSourceMode)
+    : DecodedDataDocumentParser(document, viewSourceMode)
+    , m_xssAuditor(0)
+{
+}
+
+};
diff --git a/WebCore/dom/ScriptableDocumentParser.h b/WebCore/dom/ScriptableDocumentParser.h
new file mode 100644
index 0000000..f5f2e42
--- /dev/null
+++ b/WebCore/dom/ScriptableDocumentParser.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+ 
+#ifndef ScriptableDocumentParser_h
+#define ScriptableDocumentParser_h
+
+#include "DecodedDataDocumentParser.h"
+
+namespace WebCore {
+
+class SegmentedString;
+class XSSAuditor;
+
+class ScriptableDocumentParser : public DecodedDataDocumentParser {
+public:
+    // Only used by Document::open for deciding if its safe to act on a
+    // JavaScript document.open() call right now, or it should be ignored.
+    virtual bool isExecutingScript() const { return false; }
+
+    // FIXME: Only the HTMLDocumentParser ever blocks script execution on
+    // stylesheet load, which is likely a bug in the XMLDocumentParser.
+    virtual void executeScriptsWaitingForStylesheets() { }
+
+    virtual bool isWaitingForScripts() const = 0;
+
+    // These are used to expose the current line/column to the scripting system.
+    virtual int lineNumber() const = 0;
+    virtual int columnNumber() const = 0;
+
+    XSSAuditor* xssAuditor() const { return m_xssAuditor; }
+    void setXSSAuditor(XSSAuditor* auditor) { m_xssAuditor = auditor; }
+
+    // Exposed for LegacyHTMLTreeBuilder::reportErrorToConsole
+    virtual bool processingContentWrittenByScript() const { return false; }
+
+protected:
+    ScriptableDocumentParser(Document*, bool viewSourceMode = false);
+
+private:
+    virtual ScriptableDocumentParser* asScriptableDocumentParser() { return this; }
+
+    // The XSSAuditor associated with this document parser.
+    XSSAuditor* m_xssAuditor;
+};
+
+}
+
+#endif // ScriptableDocumentParser_h
diff --git a/WebCore/dom/SelectElement.cpp b/WebCore/dom/SelectElement.cpp
index 43e6e28..e9958a2 100644
--- a/WebCore/dom/SelectElement.cpp
+++ b/WebCore/dom/SelectElement.cpp
@@ -534,7 +534,7 @@ static int nextValidIndex(const Vector<Element*>& listItems, int listIndex, Skip
 }
 #endif
 
-void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element* element, Event* event)
+void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
 {
     if (event->type() == eventNames().keydownEvent) {
         if (!element->renderer() || !event->isKeyboardEvent())
@@ -613,6 +613,8 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
                 menuList->showPopup();
             handled = true;
         } else if (keyCode == '\r') {
+            if (htmlForm)
+                htmlForm->submitImplicitly(event, false);
             menuListOnChange(data, element);
             handled = true;
         }
@@ -692,7 +694,7 @@ void SelectElement::updateSelectedState(SelectElementData& data, Element* elemen
     updateListBoxSelection(data, element, !multiSelect);
 }
 
-void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element* element, Event* event)
+void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
 {
     const Vector<Element*>& listItems = data.listItems(element);
 
@@ -758,18 +760,29 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
             listBoxOnChange(data, element);
             event->setDefaultHandled();
         }
+    } else if (event->type() == eventNames().keypressEvent) {
+        if (!event->isKeyboardEvent())
+            return;
+        int keyCode = static_cast<KeyboardEvent*>(event)->keyCode();
+
+        if (keyCode == '\r') {
+            if (htmlForm)
+                htmlForm->submitImplicitly(event, false);
+            event->setDefaultHandled();
+            return;
+        }
     }
 }
 
-void SelectElement::defaultEventHandler(SelectElementData& data, Element* element, Event* event)
+void SelectElement::defaultEventHandler(SelectElementData& data, Element* element, Event* event, HTMLFormElement* htmlForm)
 {
     if (!element->renderer())
         return;
 
     if (data.usesMenuList())
-        menuListDefaultEventHandler(data, element, event);
+        menuListDefaultEventHandler(data, element, event, htmlForm);
     else 
-        listBoxDefaultEventHandler(data, element, event);
+        listBoxDefaultEventHandler(data, element, event, htmlForm);
 
     if (event->defaultHandled())
         return;
diff --git a/WebCore/dom/SelectElement.h b/WebCore/dom/SelectElement.h
index 493bee5..3831ac4 100644
--- a/WebCore/dom/SelectElement.h
+++ b/WebCore/dom/SelectElement.h
@@ -92,7 +92,7 @@ protected:
     static void parseMultipleAttribute(SelectElementData&, Element*, Attribute*);
     static bool appendFormData(SelectElementData&, Element*, FormDataList&);
     static void reset(SelectElementData&, Element*);
-    static void defaultEventHandler(SelectElementData&, Element*, Event*);
+    static void defaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
     static int lastSelectedListIndex(const SelectElementData&, const Element*);
     static void typeAheadFind(SelectElementData&, Element*, KeyboardEvent*);
     static void insertedIntoTree(SelectElementData&, Element*);
@@ -103,8 +103,8 @@ protected:
                                     bool multi, bool shift);
  
 private:
-    static void menuListDefaultEventHandler(SelectElementData&, Element*, Event*);
-    static void listBoxDefaultEventHandler(SelectElementData&, Element*, Event*);
+    static void menuListDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
+    static void listBoxDefaultEventHandler(SelectElementData&, Element*, Event*, HTMLFormElement*);
     static void setOptionsChangedOnRenderer(SelectElementData&, Element*);
 };
 
diff --git a/WebCore/dom/Text.cpp b/WebCore/dom/Text.cpp
index 14da1a4..1589b11 100644
--- a/WebCore/dom/Text.cpp
+++ b/WebCore/dom/Text.cpp
@@ -72,7 +72,7 @@ PassRefPtr<Text> Text::splitText(unsigned offset, ExceptionCode& ec)
         document()->textNodeSplit(this);
 
     if (renderer())
-        toRenderText(renderer())->setText(dataImpl());
+        toRenderText(renderer())->setTextWithOffset(dataImpl(), 0, oldStr->length());
 
     return newText.release();
 }
diff --git a/WebCore/dom/ViewportArguments.cpp b/WebCore/dom/ViewportArguments.cpp
index 23d0297..c507032 100644
--- a/WebCore/dom/ViewportArguments.cpp
+++ b/WebCore/dom/ViewportArguments.cpp
@@ -33,7 +33,7 @@
 #include "Frame.h"
 #include "Page.h"
 #include "PlatformString.h"
-#include "DocumentParser.h"
+#include "ScriptableDocumentParser.h"
 
 namespace WebCore {
 
@@ -103,10 +103,20 @@ static MessageLevel viewportErrorMessageLevel(ViewportErrorCode errorCode)
     return errorCode == UnrecognizedViewportArgumentError || errorCode == MaximumScaleTooLargeError ? ErrorMessageLevel : TipMessageLevel;
 }
 
-void reportViewportWarning(Document* document, ViewportErrorCode errorCode, const String& replacement)
+// FIXME: Why is this different from SVGDocumentExtensions parserLineNumber?
+// FIXME: Callers should probably use ScriptController::eventHandlerLineNumber()
+static int parserLineNumber(Document* document)
 {
-    DocumentParser* parser = document->parser();
+    if (!document)
+        return 0;
+    ScriptableDocumentParser* parser = document->scriptableDocumentParser();
+    if (!parser)
+        return 0;
+    return parser->lineNumber() + 1;
+}
 
+void reportViewportWarning(Document* document, ViewportErrorCode errorCode, const String& replacement)
+{
     Frame* frame = document->frame();
     if (!frame)
         return;
@@ -114,7 +124,7 @@ void reportViewportWarning(Document* document, ViewportErrorCode errorCode, cons
     String message = viewportErrorMessageTemplate(errorCode);
     message.replace("%replacement", replacement);
 
-    frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, viewportErrorMessageLevel(errorCode), message, parser ? parser->lineNumber() + 1 : 0, document->url().string());
+    frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, viewportErrorMessageLevel(errorCode), message, parserLineNumber(document), document->url().string());
 }
 
 } // namespace WebCore
diff --git a/WebCore/dom/XMLDocumentParser.cpp b/WebCore/dom/XMLDocumentParser.cpp
index ab02bb3..3d2f324 100644
--- a/WebCore/dom/XMLDocumentParser.cpp
+++ b/WebCore/dom/XMLDocumentParser.cpp
@@ -116,7 +116,16 @@ void XMLDocumentParser::clearCurrentNodeStack()
     }
 }
 
-void XMLDocumentParser::write(const SegmentedString& s, bool /*appendData*/)
+void XMLDocumentParser::insert(const SegmentedString& source)
+{
+    // FIXME: This is a hack to work around the fact that XMLHttpRequest
+    // responseXML() calls Document::write() which in turn calls insert(). In
+    // HTML, that's correct, as insert() implies a synchronous parse.  For XML,
+    // all parsing is synchronous but document.write shouldn't be supported.
+    append(source);
+}
+
+void XMLDocumentParser::append(const SegmentedString& s)
 {
     String parseString = s.toString();
 
@@ -167,7 +176,7 @@ bool XMLDocumentParser::enterText()
     ASSERT(m_bufferedText.size() == 0);
 #endif
     RefPtr<Node> newNode = Text::create(document(), "");
-    if (!m_currentNode->addChild(newNode.get()))
+    if (!m_currentNode->legacyParserAddChild(newNode.get()))
         return false;
     pushCurrentNode(newNode.get());
     return true;
diff --git a/WebCore/dom/XMLDocumentParser.h b/WebCore/dom/XMLDocumentParser.h
index 7553cea..a6cc9a0 100644
--- a/WebCore/dom/XMLDocumentParser.h
+++ b/WebCore/dom/XMLDocumentParser.h
@@ -136,10 +136,10 @@ bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element* parent
 
 #include "CachedResourceClient.h"
 #include "CachedResourceHandle.h"
+#include "FragmentScriptingPermission.h"
+#include "ScriptableDocumentParser.h"
 #include "SegmentedString.h"
 #include "StringHash.h"
-#include "DocumentParser.h"
-#include "FragmentScriptingPermission.h"
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 
@@ -179,7 +179,7 @@ namespace WebCore {
     };
 #endif
 
-    class XMLDocumentParser : public DocumentParser, public CachedResourceClient {
+    class XMLDocumentParser : public ScriptableDocumentParser, public CachedResourceClient {
     public:
         XMLDocumentParser(Document*, FrameView* = 0);
         XMLDocumentParser(DocumentFragment*, Element*, FragmentScriptingPermission);
@@ -199,9 +199,12 @@ namespace WebCore {
         bool isWMLDocument() const;
 #endif
 
+    static bool parseDocumentFragment(const String&, DocumentFragment*, Element* parent = 0, FragmentScriptingPermission = FragmentScriptingAllowed);
+
     private:
         // From DocumentParser
-        virtual void write(const SegmentedString&, bool appendData);
+        virtual void insert(const SegmentedString&);
+        virtual void append(const SegmentedString&);
         virtual void finish();
         virtual bool finishWasCalled();
         virtual bool isWaitingForScripts() const;
@@ -247,8 +250,6 @@ public:
         void endDocument();
 #endif
     private:
-        friend bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element*, FragmentScriptingPermission);
-
         void initializeParserContext(const char* chunk = 0);
 
         void pushCurrentNode(Node*);
@@ -315,7 +316,6 @@ void* xmlDocPtrForString(DocLoader*, const String& source, const String& url);
 #endif
 
 HashMap<String, String> parseAttributes(const String&, bool& attrsOK);
-bool parseXMLDocumentFragment(const String&, DocumentFragment*, Element* parent = 0, FragmentScriptingPermission = FragmentScriptingAllowed);
 
 } // namespace WebCore
 
diff --git a/WebCore/dom/XMLDocumentParserLibxml2.cpp b/WebCore/dom/XMLDocumentParserLibxml2.cpp
index 33b0a09..a6e9cd0 100644
--- a/WebCore/dom/XMLDocumentParserLibxml2.cpp
+++ b/WebCore/dom/XMLDocumentParserLibxml2.cpp
@@ -523,7 +523,7 @@ PassRefPtr<XMLParserContext> XMLParserContext::createMemoryParser(xmlSAXHandlerP
 // --------------------------------
 
 XMLDocumentParser::XMLDocumentParser(Document* document, FrameView* frameView)
-    : DocumentParser(document)
+    : ScriptableDocumentParser(document)
     , m_view(frameView)
     , m_context(0)
     , m_pendingCallbacks(new PendingCallbacks)
@@ -550,7 +550,7 @@ XMLDocumentParser::XMLDocumentParser(Document* document, FrameView* frameView)
 }
 
 XMLDocumentParser::XMLDocumentParser(DocumentFragment* fragment, Element* parentElement, FragmentScriptingPermission scriptingPermission)
-    : DocumentParser(fragment->document())
+    : ScriptableDocumentParser(fragment->document())
     , m_view(0)
     , m_context(0)
     , m_pendingCallbacks(new PendingCallbacks)
@@ -790,7 +790,7 @@ void XMLDocumentParser::startElementNs(const xmlChar* xmlLocalName, const xmlCha
     if (scriptElement)
         m_scriptStartLine = lineNumber();
 
-    if (!m_currentNode->addChild(newElement.get())) {
+    if (!m_currentNode->legacyParserAddChild(newElement.get())) {
         stopParsing();
         return;
     }
@@ -935,7 +935,7 @@ void XMLDocumentParser::processingInstruction(const xmlChar* target, const xmlCh
 
     pi->setCreatedByParser(true);
 
-    if (!m_currentNode->addChild(pi.get()))
+    if (!m_currentNode->legacyParserAddChild(pi.get()))
         return;
     if (m_view && !pi->attached())
         pi->attach();
@@ -962,7 +962,7 @@ void XMLDocumentParser::cdataBlock(const xmlChar* s, int len)
     exitText();
 
     RefPtr<Node> newNode = CDATASection::create(document(), toString(s, len));
-    if (!m_currentNode->addChild(newNode.get()))
+    if (!m_currentNode->legacyParserAddChild(newNode.get()))
         return;
     if (m_view && !newNode->attached())
         newNode->attach();
@@ -981,7 +981,7 @@ void XMLDocumentParser::comment(const xmlChar* s)
     exitText();
 
     RefPtr<Node> newNode = Comment::create(document(), toString(s));
-    m_currentNode->addChild(newNode.get());
+    m_currentNode->legacyParserAddChild(newNode.get());
     if (m_view && !newNode->attached())
         newNode->attach();
 }
@@ -1045,7 +1045,7 @@ void XMLDocumentParser::internalSubset(const xmlChar* name, const xmlChar* exter
         }
 #endif
 
-        document()->addChild(DocumentType::create(document(), toString(name), toString(externalID), toString(systemID)));
+        document()->legacyParserAddChild(DocumentType::create(document(), toString(name), toString(externalID), toString(systemID)));
     }
 }
 
@@ -1363,7 +1363,7 @@ void XMLDocumentParser::resumeParsing()
     // Then, write any pending data
     SegmentedString rest = m_pendingSrc;
     m_pendingSrc.clear();
-    write(rest, false);
+    append(rest);
 
     // Finally, if finish() has been called and write() didn't result
     // in any further callbacks being queued, call end()
@@ -1373,7 +1373,7 @@ void XMLDocumentParser::resumeParsing()
 
 // FIXME: This method should be possible to implement using the DocumentParser
 // API, instead of needing to grab at libxml2 state directly.
-bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent, FragmentScriptingPermission scriptingPermission)
+bool XMLDocumentParser::parseDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent, FragmentScriptingPermission scriptingPermission)
 {
     if (!chunk.length())
         return true;
diff --git a/WebCore/dom/XMLDocumentParserQt.cpp b/WebCore/dom/XMLDocumentParserQt.cpp
index 3b657f1..c702c09 100644
--- a/WebCore/dom/XMLDocumentParserQt.cpp
+++ b/WebCore/dom/XMLDocumentParserQt.cpp
@@ -44,6 +44,7 @@
 #include "ResourceHandle.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
+#include "ScriptableDocumentParser.h"
 #include "ScriptController.h"
 #include "ScriptElement.h"
 #include "ScriptSourceCode.h"
@@ -78,7 +79,7 @@ QString EntityResolver::resolveUndeclaredEntity(const QString &name)
 // --------------------------------
 
 XMLDocumentParser::XMLDocumentParser(Document* document, FrameView* frameView)
-    : DocumentParser(document)
+    : ScriptableDocumentParser(document)
     , m_view(frameView)
     , m_wroteText(false)
     , m_currentNode(document)
@@ -105,7 +106,7 @@ XMLDocumentParser::XMLDocumentParser(Document* document, FrameView* frameView)
 }
 
 XMLDocumentParser::XMLDocumentParser(DocumentFragment* fragment, Element* parentElement, FragmentScriptingPermission permission)
-    : DocumentParser(fragment->document())
+    : ScriptableDocumentParser(fragment->document())
     , m_view(0)
     , m_wroteText(false)
     , m_currentNode(fragment)
@@ -228,7 +229,7 @@ int XMLDocumentParser::columnNumber() const
 
 void XMLDocumentParser::stopParsing()
 {
-    DocumentParser::stopParsing();
+    ScriptableDocumentParser::stopParsing();
 }
 
 void XMLDocumentParser::resumeParsing()
@@ -245,24 +246,24 @@ void XMLDocumentParser::resumeParsing()
     // Then, write any pending data
     SegmentedString rest = m_pendingSrc;
     m_pendingSrc.clear();
-    write(rest, false);
+    append(rest);
 
-    // Finally, if finish() has been called and write() didn't result
+    // Finally, if finish() has been called and append() didn't result
     // in any further callbacks being queued, call end()
     if (m_finishCalled && !m_parserPaused && !m_pendingScript)
         end();
 }
 
-bool parseXMLDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent, FragmentScriptingPermission scriptingPermission)
+bool XMLDocumentParser::parseDocumentFragment(const String& chunk, DocumentFragment* fragment, Element* parent, FragmentScriptingPermission scriptingPermission)
 {
     if (!chunk.length())
         return true;
 
     XMLDocumentParser parser(fragment, parent, scriptingPermission);
 
-    parser.write(String("<qxmlstreamdummyelement>"), false);
-    parser.write(chunk, false);
-    parser.write(String("</qxmlstreamdummyelement>"), false);
+    parser.append(String("<qxmlstreamdummyelement>"));
+    parser.append(chunk);
+    parser.append(String("</qxmlstreamdummyelement>"));
     parser.finish();
     return !parser.hasError();
 }
@@ -516,7 +517,7 @@ void XMLDocumentParser::parseStartElement()
     if (scriptElement)
         m_scriptStartLine = lineNumber();
 
-    if (!m_currentNode->addChild(newElement.get())) {
+    if (!m_currentNode->legacyParserAddChild(newElement.get())) {
         stopParsing();
         return;
     }
@@ -617,7 +618,7 @@ void XMLDocumentParser::parseProcessingInstruction()
 
     pi->setCreatedByParser(true);
 
-    if (!m_currentNode->addChild(pi.get()))
+    if (!m_currentNode->legacyParserAddChild(pi.get()))
         return;
     if (m_view && !pi->attached())
         pi->attach();
@@ -636,7 +637,7 @@ void XMLDocumentParser::parseCdata()
     exitText();
 
     RefPtr<Node> newNode = CDATASection::create(document(), m_stream.text());
-    if (!m_currentNode->addChild(newNode.get()))
+    if (!m_currentNode->legacyParserAddChild(newNode.get()))
         return;
     if (m_view && !newNode->attached())
         newNode->attach();
@@ -647,7 +648,7 @@ void XMLDocumentParser::parseComment()
     exitText();
 
     RefPtr<Node> newNode = Comment::create(document(), m_stream.text());
-    m_currentNode->addChild(newNode.get());
+    m_currentNode->legacyParserAddChild(newNode.get());
     if (m_view && !newNode->attached())
         newNode->attach();
 }
@@ -706,7 +707,7 @@ void XMLDocumentParser::parseDtd()
         handleError(fatal, "Invalid DTD Public ID", lineNumber(), columnNumber());
 #endif
     if (!m_parsingFragment)
-        document()->addChild(DocumentType::create(document(), name, publicId, systemId));
+        document()->legacyParserAddChild(DocumentType::create(document(), name, publicId, systemId));
 
 }
 }
diff --git a/WebCore/editing/gtk/SelectionControllerGtk.cpp b/WebCore/editing/gtk/SelectionControllerGtk.cpp
index 6a3258a..9d52c1a 100644
--- a/WebCore/editing/gtk/SelectionControllerGtk.cpp
+++ b/WebCore/editing/gtk/SelectionControllerGtk.cpp
@@ -33,6 +33,11 @@ void SelectionController::notifyAccessibilityForSelectionChange()
     if (AXObjectCache::accessibilityEnabled() && m_selection.start().isNotNull() && m_selection.end().isNotNull()) {
         RenderObject* focusedNode = m_selection.end().node()->renderer();
         AccessibilityObject* accessibilityObject = m_frame->document()->axObjectCache()->getOrCreate(focusedNode);
+
+        // need to check this as getOrCreate could return 0
+        if (!accessibilityObject)
+            return;
+
         int offset;
         // Always report the events w.r.t. the non-linked unignored parent. (i.e. ignoreLinks == true)
         AccessibilityObject* object = objectAndOffsetUnignored(accessibilityObject, offset, true);
diff --git a/WebCore/html/HTMLAppletElement.cpp b/WebCore/html/HTMLAppletElement.cpp
index 537d615..d6b7c5a 100644
--- a/WebCore/html/HTMLAppletElement.cpp
+++ b/WebCore/html/HTMLAppletElement.cpp
@@ -168,24 +168,4 @@ void HTMLAppletElement::finishParsingChildren()
         renderer()->setNeedsLayout(true); // This will cause it to create its widget & the Java applet
 }
 
-String HTMLAppletElement::hspace() const
-{
-    return getAttribute(hspaceAttr);
-}
-
-void HTMLAppletElement::setHspace(const String &value)
-{
-    setAttribute(hspaceAttr, value);
-}
-
-String HTMLAppletElement::vspace() const
-{
-    return getAttribute(vspaceAttr);
-}
-
-void HTMLAppletElement::setVspace(const String &value)
-{
-    setAttribute(vspaceAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLAppletElement.h b/WebCore/html/HTMLAppletElement.h
index 1e11b44..e0e4ec9 100644
--- a/WebCore/html/HTMLAppletElement.h
+++ b/WebCore/html/HTMLAppletElement.h
@@ -31,12 +31,6 @@ class HTMLAppletElement : public HTMLPlugInElement {
 public:
     static PassRefPtr<HTMLAppletElement> create(const QualifiedName&, Document*);
 
-    String hspace() const;
-    void setHspace(const String&);
-
-    String vspace() const;
-    void setVspace(const String&);
-
 private:
     HTMLAppletElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLAreaElement.cpp b/WebCore/html/HTMLAreaElement.cpp
index c907f83..2d714ba 100644
--- a/WebCore/html/HTMLAreaElement.cpp
+++ b/WebCore/html/HTMLAreaElement.cpp
@@ -163,21 +163,6 @@ Path HTMLAreaElement::getRegion(const IntSize& size) const
     return path;
 }
 
-KURL HTMLAreaElement::href() const
-{
-    return document()->completeURL(getAttribute(hrefAttr));
-}
-
-bool HTMLAreaElement::noHref() const
-{
-    return !getAttribute(nohrefAttr).isNull();
-}
-
-void HTMLAreaElement::setNoHref(bool noHref)
-{
-    setAttribute(nohrefAttr, noHref ? "" : 0);
-}
-    
 HTMLImageElement* HTMLAreaElement::imageElement() const
 {
     Node* mapElement = parent();
diff --git a/WebCore/html/HTMLAreaElement.h b/WebCore/html/HTMLAreaElement.h
index e6e087f..ce711b2 100644
--- a/WebCore/html/HTMLAreaElement.h
+++ b/WebCore/html/HTMLAreaElement.h
@@ -43,15 +43,10 @@ public:
 
     IntRect getRect(RenderObject*) const;
     Path getPath(RenderObject*) const;
-    
-    // Convenience method to get the parent map's image.
+
+    // The parent map's image.
     HTMLImageElement* imageElement() const;
     
-    KURL href() const;
-
-    bool noHref() const;
-    void setNoHref(bool);
-
 private:
     HTMLAreaElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLAttributeNames.in b/WebCore/html/HTMLAttributeNames.in
index b45ba9e..36770e2 100644
--- a/WebCore/html/HTMLAttributeNames.in
+++ b/WebCore/html/HTMLAttributeNames.in
@@ -145,6 +145,7 @@ onbeforecopy
 onbeforecut
 onbeforeload
 onbeforepaste
+onbeforeprocess
 onbeforeunload
 onblur
 oncanplay
diff --git a/WebCore/html/HTMLBaseFontElement.cpp b/WebCore/html/HTMLBaseFontElement.cpp
index 39a5591..2ab681e 100644
--- a/WebCore/html/HTMLBaseFontElement.cpp
+++ b/WebCore/html/HTMLBaseFontElement.cpp
@@ -40,14 +40,4 @@ PassRefPtr<HTMLBaseFontElement> HTMLBaseFontElement::create(const QualifiedName&
     return adoptRef(new HTMLBaseFontElement(tagName, document));
 }
 
-int HTMLBaseFontElement::size() const
-{
-    return getAttribute(sizeAttr).toInt();
-}
-
-void HTMLBaseFontElement::setSize(int value)
-{
-    setAttribute(sizeAttr, String::number(value));
-}
-
 }
diff --git a/WebCore/html/HTMLBaseFontElement.h b/WebCore/html/HTMLBaseFontElement.h
index 82f9a32..5651a61 100644
--- a/WebCore/html/HTMLBaseFontElement.h
+++ b/WebCore/html/HTMLBaseFontElement.h
@@ -31,9 +31,6 @@ class HTMLBaseFontElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLBaseFontElement> create(const QualifiedName&, Document*);
 
-    int size() const;
-    void setSize(int);
-
 private:
     HTMLBaseFontElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLBaseFontElement.idl b/WebCore/html/HTMLBaseFontElement.idl
index a0ac127..95bc92c 100644
--- a/WebCore/html/HTMLBaseFontElement.idl
+++ b/WebCore/html/HTMLBaseFontElement.idl
@@ -23,7 +23,7 @@ module html {
         attribute [Reflect] DOMString color;
         attribute [Reflect] DOMString face;
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        attribute [ConvertToString] DOMString size; // this changed to a long, but our existing API is a string
+        attribute [Reflect] DOMString size; // this changed to a long, but our existing API is a string
 #else
         attribute [Reflect] long size;
 #endif
diff --git a/WebCore/html/HTMLButtonElement.cpp b/WebCore/html/HTMLButtonElement.cpp
index 9f2cc9d..b4c8ec0 100644
--- a/WebCore/html/HTMLButtonElement.cpp
+++ b/WebCore/html/HTMLButtonElement.cpp
@@ -164,30 +164,15 @@ bool HTMLButtonElement::appendFormData(FormDataList& formData, bool)
 }
 
 void HTMLButtonElement::accessKeyAction(bool sendToAnyElement)
-{   
+{
     focus();
     // send the mouse button events iff the caller specified sendToAnyElement
     dispatchSimulatedClick(0, sendToAnyElement);
 }
 
-String HTMLButtonElement::accessKey() const
-{
-    return getAttribute(accesskeyAttr);
-}
-
-void HTMLButtonElement::setAccessKey(const String &value)
-{
-    setAttribute(accesskeyAttr, value);
-}
-
 String HTMLButtonElement::value() const
 {
     return getAttribute(valueAttr);
 }
 
-void HTMLButtonElement::setValue(const String &value)
-{
-    setAttribute(valueAttr, value);
-}
-    
 } // namespace
diff --git a/WebCore/html/HTMLButtonElement.h b/WebCore/html/HTMLButtonElement.h
index aefb27a..888c0a8 100644
--- a/WebCore/html/HTMLButtonElement.h
+++ b/WebCore/html/HTMLButtonElement.h
@@ -32,11 +32,7 @@ class HTMLButtonElement : public HTMLFormControlElement {
 public:
     static PassRefPtr<HTMLButtonElement> create(const QualifiedName&, Document*, HTMLFormElement*);
 
-    String accessKey() const;
-    void setAccessKey(const String&);
-
     String value() const;
-    void setValue(const String&);
 
 private:
     HTMLButtonElement(const QualifiedName& tagName, Document*, HTMLFormElement*);
diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index c1bf8ec..f8baf20 100644
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2004, 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -209,10 +210,10 @@ void HTMLCanvasElement::reset()
 
     bool ok;
     int w = getAttribute(widthAttr).toInt(&ok);
-    if (!ok)
+    if (!ok || w < 0)
         w = DefaultWidth;
     int h = getAttribute(heightAttr).toInt(&ok);
-    if (!ok)
+    if (!ok || h < 0)
         h = DefaultHeight;
 
     IntSize oldSize = size();
@@ -278,4 +279,15 @@ bool HTMLCanvasElement::is3D() const
 }
 #endif
 
+void HTMLCanvasElement::recalcStyle(StyleChange change)
+{
+    HTMLElement::recalcStyle(change);
+
+    // Update font if needed.
+    if (change == Force && m_context && m_context->is2d()) {
+        CanvasRenderingContext2D* ctx = static_cast<CanvasRenderingContext2D*>(m_context.get());
+        ctx->updateFont();
+    }
+}
+
 }
diff --git a/WebCore/html/HTMLCanvasElement.h b/WebCore/html/HTMLCanvasElement.h
index ebd9378..1337b87 100644
--- a/WebCore/html/HTMLCanvasElement.h
+++ b/WebCore/html/HTMLCanvasElement.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 2004, 2006, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -117,6 +118,8 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
+    virtual void recalcStyle(StyleChange);
+
     void reset();
 
     bool m_rendererIsCanvas;
diff --git a/WebCore/html/HTMLDListElement.cpp b/WebCore/html/HTMLDListElement.cpp
index 1a9d5a2..cc9fabb 100644
--- a/WebCore/html/HTMLDListElement.cpp
+++ b/WebCore/html/HTMLDListElement.cpp
@@ -40,14 +40,4 @@ PassRefPtr<HTMLDListElement> HTMLDListElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLDListElement(tagName, document));
 }
 
-bool HTMLDListElement::compact() const
-{
-    return !getAttribute(compactAttr).isNull();
-}
-
-void HTMLDListElement::setCompact(bool b)
-{
-    setAttribute(compactAttr, b ? "" : 0);
-}
-
 }
diff --git a/WebCore/html/HTMLDListElement.h b/WebCore/html/HTMLDListElement.h
index 906109e..260aa42 100644
--- a/WebCore/html/HTMLDListElement.h
+++ b/WebCore/html/HTMLDListElement.h
@@ -31,9 +31,6 @@ class HTMLDListElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLDListElement> create(const QualifiedName&, Document*);
 
-    bool compact() const;
-    void setCompact(bool);
-
 private:
     HTMLDListElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLDirectoryElement.cpp b/WebCore/html/HTMLDirectoryElement.cpp
index 173969c..64cbef8 100644
--- a/WebCore/html/HTMLDirectoryElement.cpp
+++ b/WebCore/html/HTMLDirectoryElement.cpp
@@ -1,6 +1,7 @@
-/**
+/*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -18,6 +19,7 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #include "config.h"
 #include "HTMLDirectoryElement.h"
 
@@ -27,20 +29,15 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-HTMLDirectoryElement::HTMLDirectoryElement(const QualifiedName& tagName, Document* doc)
-    : HTMLElement(tagName, doc)
+inline HTMLDirectoryElement::HTMLDirectoryElement(const QualifiedName& tagName, Document* document)
+    : HTMLElement(tagName, document)
 {
     ASSERT(hasTagName(dirTag));
 }
 
-bool HTMLDirectoryElement::compact() const
-{
-    return !getAttribute(compactAttr).isNull();
-}
-
-void HTMLDirectoryElement::setCompact(bool b)
+PassRefPtr<HTMLDirectoryElement> HTMLDirectoryElement::create(const QualifiedName& tagName, Document* document)
 {
-    setAttribute(compactAttr, b ? "" : 0);
+    return adoptRef(new HTMLDirectoryElement(tagName, document));
 }
 
 }
diff --git a/WebCore/html/HTMLDirectoryElement.h b/WebCore/html/HTMLDirectoryElement.h
index eead141..0e440d4 100644
--- a/WebCore/html/HTMLDirectoryElement.h
+++ b/WebCore/html/HTMLDirectoryElement.h
@@ -1,6 +1,7 @@
 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -28,13 +29,13 @@ namespace WebCore {
 
 class HTMLDirectoryElement : public HTMLElement {
 public:
+    static PassRefPtr<HTMLDirectoryElement> create(const QualifiedName& tagName, Document*);
+
+private:
     HTMLDirectoryElement(const QualifiedName&, Document*);
 
     virtual HTMLTagStatus endTagRequirement() const { return TagStatusRequired; }
     virtual int tagPriority() const { return 5; }
-
-    bool compact() const;
-    void setCompact(bool);
 };
 
 } //namespace
diff --git a/WebCore/html/HTMLDivElement.cpp b/WebCore/html/HTMLDivElement.cpp
index f35b25b..ca2a914 100644
--- a/WebCore/html/HTMLDivElement.cpp
+++ b/WebCore/html/HTMLDivElement.cpp
@@ -73,14 +73,4 @@ void HTMLDivElement::parseMappedAttribute(Attribute* attr)
         HTMLElement::parseMappedAttribute(attr);
 }
 
-String HTMLDivElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLDivElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLDivElement.h b/WebCore/html/HTMLDivElement.h
index aa60275..30eddf3 100644
--- a/WebCore/html/HTMLDivElement.h
+++ b/WebCore/html/HTMLDivElement.h
@@ -32,9 +32,6 @@ public:
     static PassRefPtr<HTMLDivElement> create(Document*);
     static PassRefPtr<HTMLDivElement> create(const QualifiedName&, Document*);
 
-    String align() const;
-    void setAlign(const String&);
-
 protected:
     HTMLDivElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLDocumentParser.cpp b/WebCore/html/HTMLDocumentParser.cpp
index 31977fe..55facbf 100644
--- a/WebCore/html/HTMLDocumentParser.cpp
+++ b/WebCore/html/HTMLDocumentParser.cpp
@@ -70,7 +70,7 @@ private:
 } // namespace
 
 HTMLDocumentParser::HTMLDocumentParser(HTMLDocument* document, bool reportErrors)
-    : DocumentParser(document)
+    : ScriptableDocumentParser(document)
     , m_tokenizer(new HTMLTokenizer)
     , m_scriptRunner(new HTMLScriptRunner(document, this))
     , m_treeBuilder(new HTMLTreeBuilder(m_tokenizer.get(), document, reportErrors))
@@ -84,7 +84,7 @@ HTMLDocumentParser::HTMLDocumentParser(HTMLDocument* document, bool reportErrors
 // FIXME: Member variables should be grouped into self-initializing structs to
 // minimize code duplication between these constructors.
 HTMLDocumentParser::HTMLDocumentParser(DocumentFragment* fragment, FragmentScriptingPermission scriptingPermission)
-    : DocumentParser(fragment->document())
+    : ScriptableDocumentParser(fragment->document())
     , m_tokenizer(new HTMLTokenizer)
     , m_treeBuilder(new HTMLTreeBuilder(m_tokenizer.get(), fragment, scriptingPermission))
     , m_endWasDelayed(false)
@@ -217,23 +217,44 @@ void HTMLDocumentParser::didPumpLexer()
 #endif
 }
 
-void HTMLDocumentParser::write(const SegmentedString& source, bool isFromNetwork)
+void HTMLDocumentParser::insert(const SegmentedString& source)
 {
     if (m_parserStopped)
         return;
 
+<<<<<<< HEAD
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::ParsingTimeCounter);
 #endif
     NestingLevelIncrementer nestingLevelIncrementer(m_writeNestingLevel);
+=======
+    {
+        NestingLevelIncrementer nestingLevelIncrementer(m_writeNestingLevel);
+
+        SegmentedString excludedLineNumberSource(source);
+        excludedLineNumberSource.setExcludeLineNumbers();
+        m_input.insertAtCurrentInsertionPoint(excludedLineNumberSource);
+        pumpTokenizerIfPossible(ForceSynchronous);
+    }
+
+    endIfDelayed();
+}
+
+void HTMLDocumentParser::append(const SegmentedString& source)
+{
+    if (m_parserStopped)
+        return;
+
+    {
+        NestingLevelIncrementer nestingLevelIncrementer(m_writeNestingLevel);
+>>>>>>> webkit.org at r62496
 
-    if (isFromNetwork) {
         m_input.appendToEnd(source);
         if (m_preloadScanner)
             m_preloadScanner->appendToEnd(source);
 
         if (m_writeNestingLevel > 1) {
-            // We've gotten data off the network in a nested call to write().
+            // We've gotten data off the network in a nested write.
             // We don't want to consume any more of the input stream now.  Do
             // not worry.  We'll consume this data in a less-nested write().
 #ifdef ANDROID_INSTRUMENT
@@ -241,10 +262,10 @@ void HTMLDocumentParser::write(const SegmentedString& source, bool isFromNetwork
 #endif
             return;
         }
-    } else
-        m_input.insertAtCurrentInsertionPoint(source);
 
-    pumpTokenizerIfPossible(isFromNetwork ? AllowYield : ForceSynchronous);
+        pumpTokenizerIfPossible(AllowYield);
+    }
+
     endIfDelayed();
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::record(android::TimeCounter::ParsingTimeCounter, __FUNCTION__);
@@ -267,7 +288,7 @@ void HTMLDocumentParser::attemptToEnd()
     // finish() indicates we will not receive any more data. If we are waiting on
     // an external script to load, we can't finish parsing quite yet.
 
-    if (inWrite() || isWaitingForScripts() || inScriptExecution() || isScheduledForResume()) {
+    if (shouldDelayEnd()) {
         m_endWasDelayed = true;
         return;
     }
@@ -276,9 +297,7 @@ void HTMLDocumentParser::attemptToEnd()
 
 void HTMLDocumentParser::endIfDelayed()
 {
-    // We don't check inWrite() here since inWrite() will be true if this was
-    // called from write().
-    if (!m_endWasDelayed || isWaitingForScripts() || inScriptExecution() || isScheduledForResume())
+    if (!m_endWasDelayed || shouldDelayEnd())
         return;
 
     m_endWasDelayed = false;
@@ -287,15 +306,17 @@ void HTMLDocumentParser::endIfDelayed()
 
 void HTMLDocumentParser::finish()
 {
-    // We're not going to get any more data off the network, so we close the
-    // input stream to indicate EOF.
-    m_input.close();
+    // We're not going to get any more data off the network, so we tell the
+    // input stream we've reached the end of file.  finish() can be called more
+    // than once, if the first time does not call end().
+    if (!m_input.haveSeenEndOfFile())
+        m_input.markEndOfFile();
     attemptToEnd();
 }
 
 bool HTMLDocumentParser::finishWasCalled()
 {
-    return m_input.isClosed();
+    return m_input.haveSeenEndOfFile();
 }
 
 // This function is virtual and just for the DocumentParser interface.
@@ -338,13 +359,15 @@ void HTMLDocumentParser::resumeParsingAfterScriptExecution()
     ASSERT(!m_treeBuilder->isPaused());
 
     pumpTokenizerIfPossible(AllowYield);
-
-    // The document already finished parsing we were just waiting on scripts when finished() was called.
     endIfDelayed();
 }
 
 void HTMLDocumentParser::watchForLoad(CachedResource* cachedScript)
 {
+    ASSERT(!cachedScript->isLoaded());
+    // addClient would call notifyFinished if the load were complete.
+    // Callers do not expect to be re-entered from this call, so they should
+    // not an already-loaded CachedResource.
     cachedScript->addClient(this);
 }
 
@@ -355,22 +378,14 @@ void HTMLDocumentParser::stopWatchingForLoad(CachedResource* cachedScript)
 
 bool HTMLDocumentParser::shouldLoadExternalScriptFromSrc(const AtomicString& srcValue)
 {
-    if (!m_XSSAuditor)
+    if (!xssAuditor())
         return true;
-    return m_XSSAuditor->canLoadExternalScriptFromSrc(srcValue);
+    return xssAuditor()->canLoadExternalScriptFromSrc(srcValue);
 }
 
 void HTMLDocumentParser::notifyFinished(CachedResource* cachedResource)
 {
     ASSERT(m_scriptRunner);
-    // Ignore calls unless we have a script blocking the parser waiting
-    // for its own load.  Otherwise this may be a load callback from
-    // CachedResource::addClient because the script was already in the cache.
-    // HTMLScriptRunner may not be ready to handle running that script yet.
-    if (!m_scriptRunner->hasScriptsWaitingForLoad()) {
-        ASSERT(m_scriptRunner->inScriptExecution());
-        return;
-    }
     ASSERT(!inScriptExecution());
     ASSERT(m_treeBuilder->isPaused());
     // Note: We only ever wait on one script at a time, so we always know this
@@ -411,7 +426,7 @@ ScriptController* HTMLDocumentParser::script() const
 void HTMLDocumentParser::parseDocumentFragment(const String& source, DocumentFragment* fragment, FragmentScriptingPermission scriptingPermission)
 {
     HTMLDocumentParser parser(fragment, scriptingPermission);
-    parser.write(source, false);
+    parser.insert(source); // Use insert() so that the parser will not yield.
     parser.finish();
     ASSERT(!parser.processingData()); // Make sure we're done. <rdar://problem/3963151>
 }
diff --git a/WebCore/html/HTMLDocumentParser.h b/WebCore/html/HTMLDocumentParser.h
index c2e752f..b2a65ca 100644
--- a/WebCore/html/HTMLDocumentParser.h
+++ b/WebCore/html/HTMLDocumentParser.h
@@ -28,11 +28,11 @@
 
 #include "CachedResourceClient.h"
 #include "FragmentScriptingPermission.h"
+#include "HTMLInputStream.h"
 #include "HTMLScriptRunnerHost.h"
 #include "HTMLToken.h"
-#include "HTMLInputStream.h"
+#include "ScriptableDocumentParser.h"
 #include "SegmentedString.h"
-#include "DocumentParser.h"
 #include "Timer.h"
 #include <wtf/OwnPtr.h>
 
@@ -50,7 +50,7 @@ class LegacyHTMLTreeBuilder;
 class ScriptController;
 class ScriptSourceCode;
 
-class HTMLDocumentParser :  public DocumentParser, HTMLScriptRunnerHost, CachedResourceClient {
+class HTMLDocumentParser :  public ScriptableDocumentParser, HTMLScriptRunnerHost, CachedResourceClient {
 public:
     // FIXME: These constructors should be made private and replaced by create() methods.
     HTMLDocumentParser(HTMLDocument*, bool reportErrors);
@@ -64,8 +64,8 @@ public:
 
 private:
     // DocumentParser
-    virtual void begin();
-    virtual void write(const SegmentedString&, bool isFromNetwork);
+    virtual void insert(const SegmentedString&);
+    virtual void append(const SegmentedString&);
     virtual void finish();
     virtual bool finishWasCalled();
     virtual bool processingData() const;
@@ -101,6 +101,7 @@ private:
     bool runScriptsForPausedTreeBuilder();
     void resumeParsingAfterScriptExecution();
 
+    void begin();
     void attemptToEnd();
     void endIfDelayed();
     void end();
@@ -108,6 +109,7 @@ private:
     bool isScheduledForResume() const;
     bool inScriptExecution() const;
     bool inWrite() const { return m_writeNestingLevel > 0; }
+    bool shouldDelayEnd() const { return inWrite() || isWaitingForScripts() || inScriptExecution() || isScheduledForResume(); }
 
     ScriptController* script() const;
 
diff --git a/WebCore/html/HTMLElement.cpp b/WebCore/html/HTMLElement.cpp
index 0726977..8985407 100644
--- a/WebCore/html/HTMLElement.cpp
+++ b/WebCore/html/HTMLElement.cpp
@@ -858,6 +858,7 @@ static HashSet<AtomicStringImpl*>* inlineTagList()
         tagList.add(rubyTag.localName().impl());
         tagList.add(progressTag.localName().impl());
         tagList.add(meterTag.localName().impl());
+        tagList.add(markTag.localName().impl());
     }
     return &tagList;
 }
diff --git a/WebCore/html/HTMLElementStack.cpp b/WebCore/html/HTMLElementStack.cpp
new file mode 100644
index 0000000..2f1b792
--- /dev/null
+++ b/WebCore/html/HTMLElementStack.cpp
@@ -0,0 +1,379 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HTMLElementStack.h"
+
+#include "Element.h"
+#include "HTMLNames.h"
+#include <wtf/PassOwnPtr.h>
+
+#if ENABLE(SVG)
+#include "SVGNames.h"
+#endif
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+namespace {
+
+inline bool isScopeMarker(Element* element)
+{
+    return element->hasTagName(appletTag)
+        || element->hasTagName(buttonTag)
+        || element->hasTagName(captionTag)
+#if ENABLE(SVG_FOREIGN_OBJECT)
+        || element->hasTagName(SVGNames::foreignObjectTag)
+#endif
+        || element->hasTagName(htmlTag)
+        || element->hasTagName(marqueeTag)
+        || element->hasTagName(objectTag)
+        || element->hasTagName(tableTag)
+        || element->hasTagName(tdTag)
+        || element->hasTagName(thTag);
+}
+
+inline bool isListItemScopeMarker(Element* element)
+{
+    return isScopeMarker(element)
+        || element->hasTagName(olTag)
+        || element->hasTagName(ulTag);
+}
+inline bool isTableScopeMarker(Element* element)
+{
+    return element->hasTagName(tableTag)
+        || element->hasTagName(htmlTag);
+}
+
+inline bool isTableBodyScopeMarker(Element* element)
+{
+    return element->hasTagName(tbodyTag)
+        || element->hasTagName(tfootTag)
+        || element->hasTagName(theadTag)
+        || element->hasTagName(htmlTag);
+}
+
+}
+
+HTMLElementStack::ElementRecord::ElementRecord(PassRefPtr<Element> element, PassOwnPtr<ElementRecord> next)
+    : m_element(element)
+    , m_next(next)
+{
+    ASSERT(m_element);
+}
+
+HTMLElementStack::ElementRecord::~ElementRecord()
+{
+}
+
+void HTMLElementStack::ElementRecord::replaceElement(PassRefPtr<Element> element)
+{
+    ASSERT(element);
+    // FIXME: Should this call finishParsingChildren?
+    m_element = element;
+}
+
+bool HTMLElementStack::ElementRecord::isAbove(ElementRecord* other) const
+{
+    for (ElementRecord* below = next(); below; below = below->next()) {
+        if (below == other)
+            return true;
+    }
+    return false;
+}
+
+HTMLElementStack::HTMLElementStack()
+    : m_htmlElement(0)
+    , m_headElement(0)
+    , m_bodyElement(0)
+{
+}
+
+HTMLElementStack::~HTMLElementStack()
+{
+}
+
+void HTMLElementStack::popHTMLHeadElement()
+{
+    ASSERT(top() == m_headElement);
+    m_headElement = 0;
+    popCommon();
+}
+
+void HTMLElementStack::popHTMLBodyElement()
+{
+    ASSERT(top() == m_bodyElement);
+    m_bodyElement = 0;
+    popCommon();
+}
+
+void HTMLElementStack::pop()
+{
+    ASSERT(!top()->hasTagName(HTMLNames::headTag));
+    popCommon();
+}
+
+void HTMLElementStack::popUntil(const AtomicString& tagName)
+{
+    while (!top()->hasLocalName(tagName)) {
+        // pop() will ASSERT at <body> if callers fail to check that there is an
+        // element with localName |tagName| on the stack of open elements.
+        pop();
+    }
+}
+
+void HTMLElementStack::popUntil(Element* element)
+{
+    while (top() != element)
+        pop();
+}
+
+void HTMLElementStack::popUntilTableScopeMarker()
+{
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#clear-the-stack-back-to-a-table-context
+    while (!isTableScopeMarker(top()))
+        pop();
+}
+
+void HTMLElementStack::popUntilTableBodyScopeMarker()
+{
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#clear-the-stack-back-to-a-table-body-context
+    while (!isTableBodyScopeMarker(top()))
+        pop();
+}
+
+void HTMLElementStack::pushHTMLHtmlElement(PassRefPtr<Element> element)
+{
+    ASSERT(!m_top); // <html> should always be the bottom of the stack.
+    ASSERT(element->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!m_htmlElement);
+    m_htmlElement = element.get();
+    pushCommon(element);
+}
+
+void HTMLElementStack::pushHTMLHeadElement(PassRefPtr<Element> element)
+{
+    ASSERT(element->hasTagName(HTMLNames::headTag));
+    ASSERT(!m_headElement);
+    m_headElement = element.get();
+    pushCommon(element);
+}
+
+void HTMLElementStack::pushHTMLBodyElement(PassRefPtr<Element> element)
+{
+    ASSERT(element->hasTagName(HTMLNames::bodyTag));
+    ASSERT(!m_bodyElement);
+    m_bodyElement = element.get();
+    pushCommon(element);
+}
+
+void HTMLElementStack::push(PassRefPtr<Element> element)
+{
+    ASSERT(!element->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!element->hasTagName(HTMLNames::headTag));
+    ASSERT(!element->hasTagName(HTMLNames::bodyTag));
+    ASSERT(m_htmlElement);
+    pushCommon(element);
+}
+
+void HTMLElementStack::insertAbove(PassRefPtr<Element> element, ElementRecord* recordBelow)
+{
+    ASSERT(element);
+    ASSERT(recordBelow);
+    ASSERT(m_top);
+    ASSERT(!element->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!element->hasTagName(HTMLNames::headTag));
+    ASSERT(!element->hasTagName(HTMLNames::bodyTag));
+    ASSERT(m_htmlElement);
+    if (recordBelow == m_top) {
+        push(element);
+        return;
+    }
+
+    for (ElementRecord* recordAbove = m_top.get(); recordAbove; recordAbove = recordAbove->next()) {
+        if (recordAbove->next() != recordBelow)
+            continue;
+
+        recordAbove->setNext(new ElementRecord(element, recordAbove->releaseNext()));
+        recordAbove->next()->element()->beginParsingChildren();
+        return;
+    }
+    ASSERT_NOT_REACHED();
+}
+
+HTMLElementStack::ElementRecord* HTMLElementStack::topRecord() const
+{
+    return m_top.get();
+}
+
+Element* HTMLElementStack::top() const
+{
+    return m_top->element();
+}
+
+Element* HTMLElementStack::bottom() const
+{
+    return htmlElement();
+}
+
+void HTMLElementStack::removeHTMLHeadElement(Element* element)
+{
+    ASSERT(m_headElement == element);
+    if (m_top->element() == element) {
+        popHTMLHeadElement();
+        return;
+    }
+    m_headElement = 0;
+    removeNonTopCommon(element);
+}
+
+void HTMLElementStack::remove(Element* element)
+{
+    ASSERT(!element->hasTagName(HTMLNames::headTag));
+    if (m_top->element() == element) {
+        pop();
+        return;
+    }
+    removeNonTopCommon(element);
+}
+
+HTMLElementStack::ElementRecord* HTMLElementStack::find(Element* element) const
+{
+    for (ElementRecord* pos = m_top.get(); pos; pos = pos->next()) {
+        if (pos->element() == element)
+            return pos;
+    }
+    return 0;
+}
+
+HTMLElementStack::ElementRecord* HTMLElementStack::topmost(const AtomicString& tagName) const
+{
+    for (ElementRecord* pos = m_top.get(); pos; pos = pos->next()) {
+        if (pos->element()->hasLocalName(tagName))
+            return pos;
+    }
+    return 0;
+}
+
+bool HTMLElementStack::contains(Element* element) const
+{
+    return !!find(element);
+}
+
+template <bool isMarker(Element*)>
+bool inScopeCommon(HTMLElementStack::ElementRecord* top, const AtomicString& targetTag)
+{
+    for (HTMLElementStack::ElementRecord* pos = top; pos; pos = pos->next()) {
+        Element* element = pos->element();
+        if (element->hasLocalName(targetTag))
+            return true;
+        if (isMarker(element))
+            return false;
+    }
+    ASSERT_NOT_REACHED(); // <html> is always on the stack and is a scope marker.
+    return false;
+}
+
+bool HTMLElementStack::inScope(Element* targetElement) const
+{
+    for (ElementRecord* pos = m_top.get(); pos; pos = pos->next()) {
+        Element* element = pos->element();
+        if (element == targetElement)
+            return true;
+        if (isScopeMarker(element))
+            return false;
+    }
+    ASSERT_NOT_REACHED(); // <html> is always on the stack and is a scope marker.
+    return false;
+}
+
+bool HTMLElementStack::inScope(const AtomicString& targetTag) const
+{
+    return inScopeCommon<isScopeMarker>(m_top.get(), targetTag);
+}
+
+bool HTMLElementStack::inListItemScope(const AtomicString& targetTag) const
+{
+    return inScopeCommon<isListItemScopeMarker>(m_top.get(), targetTag);
+}
+
+bool HTMLElementStack::inTableScope(const AtomicString& targetTag) const
+{
+    return inScopeCommon<isTableScopeMarker>(m_top.get(), targetTag);
+}
+
+Element* HTMLElementStack::htmlElement() const
+{
+    ASSERT(m_htmlElement);
+    return m_htmlElement;
+}
+
+Element* HTMLElementStack::headElement() const
+{
+    ASSERT(m_headElement);
+    return m_headElement;
+}
+
+Element* HTMLElementStack::bodyElement() const
+{
+    ASSERT(m_bodyElement);
+    return m_bodyElement;
+}
+
+void HTMLElementStack::pushCommon(PassRefPtr<Element> element)
+{
+    ASSERT(m_htmlElement);
+    m_top.set(new ElementRecord(element, m_top.release()));
+    top()->beginParsingChildren();
+}
+
+void HTMLElementStack::popCommon()
+{
+    ASSERT(!top()->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!top()->hasTagName(HTMLNames::headTag) || !m_headElement);
+    ASSERT(!top()->hasTagName(HTMLNames::bodyTag) || !m_bodyElement);
+    top()->finishParsingChildren();
+    m_top = m_top->releaseNext();
+}
+
+void HTMLElementStack::removeNonTopCommon(Element* element)
+{
+    ASSERT(!element->hasTagName(HTMLNames::htmlTag));
+    ASSERT(!element->hasTagName(HTMLNames::bodyTag));
+    ASSERT(top() != element);
+    for (ElementRecord* pos = m_top.get(); pos; pos = pos->next()) {
+        if (pos->next()->element() == element) {
+            // FIXME: Is it OK to call finishParsingChildren()
+            // when the children aren't actually finished?
+            element->finishParsingChildren();
+            pos->setNext(pos->next()->releaseNext());
+            return;
+        }
+    }
+    ASSERT_NOT_REACHED();
+}
+
+}
diff --git a/WebCore/html/HTMLElementStack.h b/WebCore/html/HTMLElementStack.h
new file mode 100644
index 0000000..efc3fd8
--- /dev/null
+++ b/WebCore/html/HTMLElementStack.h
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HTMLElementStack_h
+#define HTMLElementStack_h
+
+#include <wtf/Noncopyable.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class AtomicString;
+class Element;
+
+// NOTE: The HTML5 spec uses a backwards (grows downward) stack.  We're using
+// more standard (grows upwards) stack terminology here.
+class HTMLElementStack : public Noncopyable {
+public:
+    HTMLElementStack();
+    ~HTMLElementStack();
+
+    class ElementRecord : public Noncopyable {
+    public:
+        ~ElementRecord(); // Public for ~PassOwnPtr()
+    
+        Element* element() const { return m_element.get(); }
+        void replaceElement(PassRefPtr<Element>);
+
+        bool isAbove(ElementRecord*) const;
+
+        ElementRecord* next() const { return m_next.get(); }
+
+    private:
+        friend class HTMLElementStack;
+
+        ElementRecord(PassRefPtr<Element>, PassOwnPtr<ElementRecord>);
+
+        PassOwnPtr<ElementRecord> releaseNext() { return m_next.release(); }
+        void setNext(PassOwnPtr<ElementRecord> next) { m_next = next; }
+
+        RefPtr<Element> m_element;
+        OwnPtr<ElementRecord> m_next;
+    };
+    
+    Element* top() const;
+    ElementRecord* topRecord() const;
+    Element* bottom() const;
+    ElementRecord* find(Element*) const;
+    ElementRecord* topmost(const AtomicString& tagName) const;
+
+    void insertAbove(PassRefPtr<Element>, ElementRecord*);
+
+    void push(PassRefPtr<Element>);
+    void pushHTMLHtmlElement(PassRefPtr<Element>);
+    void pushHTMLHeadElement(PassRefPtr<Element>);
+    void pushHTMLBodyElement(PassRefPtr<Element>);
+
+    void pop();
+    void popUntil(const AtomicString& tagName);
+    void popUntil(Element*);
+    void popUntilTableScopeMarker(); // "clear the stack back to a table context" in the spec.
+    void popUntilTableBodyScopeMarker(); // "clear the stack back to a table body context" in the spec.
+    void popHTMLHeadElement();
+    void popHTMLBodyElement();
+
+    void remove(Element*);
+    void removeHTMLHeadElement(Element*);
+
+    bool contains(Element*) const;
+
+    bool inScope(Element*) const;
+    bool inScope(const AtomicString& tagName) const;
+    bool inListItemScope(const AtomicString& tagName) const;
+    bool inTableScope(const AtomicString& tagName) const;
+
+    Element* htmlElement() const;
+    Element* headElement() const;
+    Element* bodyElement() const;
+
+private:
+    void pushCommon(PassRefPtr<Element>);
+    void popCommon();
+    void removeNonTopCommon(Element*);
+
+    OwnPtr<ElementRecord> m_top;
+
+    // We remember <html>, <head> and <body> as they are pushed.  Their
+    // ElementRecords keep them alive.  <html> is never popped.
+    // FIXME: We don't currently require type-specific information about
+    // these elements so we haven't yet bothered to plumb the types all the
+    // way down through createElement, etc.
+    Element* m_htmlElement;
+    Element* m_headElement;
+    Element* m_bodyElement;
+};
+
+} // namespace WebCore
+
+#endif // HTMLElementStack_h
diff --git a/WebCore/html/HTMLElementsAllInOne.cpp b/WebCore/html/HTMLElementsAllInOne.cpp
index f19addf..8411188 100644
--- a/WebCore/html/HTMLElementsAllInOne.cpp
+++ b/WebCore/html/HTMLElementsAllInOne.cpp
@@ -46,6 +46,7 @@
 #include "HTMLDataGridCellElement.cpp"
 #include "HTMLDataGridColElement.cpp"
 #include "HTMLDataGridRowElement.cpp"
+#include "HTMLDataListElement.cpp"
 #include "HTMLDListElement.cpp"
 #include "HTMLDirectoryElement.cpp"
 #include "HTMLDivElement.cpp"
@@ -79,6 +80,7 @@
 #include "HTMLMetaElement.cpp"
 #include "HTMLMeterElement.cpp"
 #include "HTMLModElement.cpp"
+#include "HTMLNoScriptElement.cpp"
 #include "HTMLOListElement.cpp"
 #include "HTMLObjectElement.cpp"
 #include "HTMLOptGroupElement.cpp"
diff --git a/WebCore/html/HTMLEntityParser.cpp b/WebCore/html/HTMLEntityParser.cpp
index 3d8d48d..84b2006 100644
--- a/WebCore/html/HTMLEntityParser.cpp
+++ b/WebCore/html/HTMLEntityParser.cpp
@@ -217,6 +217,14 @@ unsigned consumeHTMLEntity(SegmentedString& source, bool& notEnoughCharacters, U
                         // if the lookhead character is '='.
                         if (additionalAllowedCharacter && cc == '=')
                             break;
+                        // Some entities require a terminating semicolon, whereas other
+                        // entities do not.  The HTML5 spec has a giant list:
+                        //
+                        // http://www.whatwg.org/specs/web-apps/current-work/multipage/named-character-references.html#named-character-references
+                        //
+                        // However, the list seems to boil down to this branch:
+                        if (entity->code > 255)
+                            break;
                         return entity->code;
                     }
                     break;
diff --git a/WebCore/html/HTMLFontElement.cpp b/WebCore/html/HTMLFontElement.cpp
index 74320de..81ae415 100644
--- a/WebCore/html/HTMLFontElement.cpp
+++ b/WebCore/html/HTMLFontElement.cpp
@@ -149,34 +149,4 @@ void HTMLFontElement::parseMappedAttribute(Attribute* attr)
         HTMLElement::parseMappedAttribute(attr);
 }
 
-String HTMLFontElement::color() const
-{
-    return getAttribute(colorAttr);
-}
-
-void HTMLFontElement::setColor(const String& value)
-{
-    setAttribute(colorAttr, value);
-}
-
-String HTMLFontElement::face() const
-{
-    return getAttribute(faceAttr);
-}
-
-void HTMLFontElement::setFace(const String& value)
-{
-    setAttribute(faceAttr, value);
-}
-
-String HTMLFontElement::size() const
-{
-    return getAttribute(sizeAttr);
-}
-
-void HTMLFontElement::setSize(const String& value)
-{
-    setAttribute(sizeAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLFontElement.h b/WebCore/html/HTMLFontElement.h
index cdf7143..f96a50b 100644
--- a/WebCore/html/HTMLFontElement.h
+++ b/WebCore/html/HTMLFontElement.h
@@ -32,15 +32,6 @@ class HTMLFontElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLFontElement> create(const QualifiedName&, Document*);
     
-    String color() const;
-    void setColor(const String&);
-
-    String face() const;
-    void setFace(const String&);
-
-    String size() const;
-    void setSize(const String&);
-    
     static bool cssValueFromFontSizeNumber(const String&, int&);
 
 private:
diff --git a/WebCore/html/HTMLFormControlElement.cpp b/WebCore/html/HTMLFormControlElement.cpp
index 0b1c55a..5103bfa 100644
--- a/WebCore/html/HTMLFormControlElement.cpp
+++ b/WebCore/html/HTMLFormControlElement.cpp
@@ -81,11 +81,6 @@ bool HTMLFormControlElement::formNoValidate() const
     return !getAttribute(formnovalidateAttr).isNull();
 }
 
-void HTMLFormControlElement::setFormNoValidate(bool formnovalidate)
-{
-    setAttribute(formnovalidateAttr, formnovalidate ? "" : 0);
-}
-
 ValidityState* HTMLFormControlElement::validity()
 {
     if (!m_validityState)
@@ -196,7 +191,7 @@ const AtomicString& HTMLFormControlElement::formControlName() const
     return name.isNull() ? emptyAtom : name;
 }
 
-void HTMLFormControlElement::setName(const AtomicString &value)
+void HTMLFormControlElement::setName(const AtomicString& value)
 {
     setAttribute(nameAttr, value);
 }
@@ -211,31 +206,16 @@ void HTMLFormControlElement::setDisabled(bool b)
     setAttribute(disabledAttr, b ? "" : 0);
 }
 
-void HTMLFormControlElement::setReadOnly(bool b)
-{
-    setAttribute(readonlyAttr, b ? "" : 0);
-}
-
 bool HTMLFormControlElement::autofocus() const
 {
     return hasAttribute(autofocusAttr);
 }
 
-void HTMLFormControlElement::setAutofocus(bool b)
-{
-    setAttribute(autofocusAttr, b ? "" : 0);
-}
-
 bool HTMLFormControlElement::required() const
 {
     return m_required;
 }
 
-void HTMLFormControlElement::setRequired(bool b)
-{
-    setAttribute(requiredAttr, b ? "" : 0);
-}
-
 static void updateFromElementCallback(Node* node)
 {
     ASSERT_ARG(node, node->isElementNode());
diff --git a/WebCore/html/HTMLFormControlElement.h b/WebCore/html/HTMLFormControlElement.h
index 87f6376..02ea4e7 100644
--- a/WebCore/html/HTMLFormControlElement.h
+++ b/WebCore/html/HTMLFormControlElement.h
@@ -44,7 +44,6 @@ public:
     ValidityState* validity();
 
     bool formNoValidate() const;
-    void setFormNoValidate(bool);
 
     virtual void reset() { }
 
@@ -59,14 +58,10 @@ public:
     virtual bool isFocusable() const;
     virtual bool isEnumeratable() const { return false; }
 
-    void setReadOnly(bool);
-
-    // Determines whether or not a control will be automatically focused
+    // Determines whether or not a control will be automatically focused.
     virtual bool autofocus() const;
-    void setAutofocus(bool);
 
     bool required() const;
-    void setRequired(bool);
 
     const AtomicString& type() const { return formControlType(); }
     const AtomicString& name() const { return formControlName(); }
diff --git a/WebCore/html/HTMLFormElement.cpp b/WebCore/html/HTMLFormElement.cpp
index 9d58934..2eface2 100644
--- a/WebCore/html/HTMLFormElement.cpp
+++ b/WebCore/html/HTMLFormElement.cpp
@@ -524,26 +524,11 @@ String HTMLFormElement::name() const
     return getAttribute(nameAttr);
 }
 
-void HTMLFormElement::setName(const String &value)
-{
-    setAttribute(nameAttr, value);
-}
-
 bool HTMLFormElement::noValidate() const
 {
     return !getAttribute(novalidateAttr).isNull();
 }
 
-void HTMLFormElement::setNoValidate(bool novalidate)
-{
-    setAttribute(novalidateAttr, novalidate ? "" : 0);
-}
-
-void HTMLFormElement::setAcceptCharset(const String &value)
-{
-    setAttribute(accept_charsetAttr, value);
-}
-
 String HTMLFormElement::action() const
 {
     return getAttribute(actionAttr);
@@ -574,11 +559,6 @@ String HTMLFormElement::target() const
     return getAttribute(targetAttr);
 }
 
-void HTMLFormElement::setTarget(const String &value)
-{
-    setAttribute(targetAttr, value);
-}
-
 HTMLFormControlElement* HTMLFormElement::defaultButton() const
 {
     for (unsigned i = 0; i < m_associatedElements.size(); ++i) {
diff --git a/WebCore/html/HTMLFormElement.h b/WebCore/html/HTMLFormElement.h
index b19ff07..a2a5897 100644
--- a/WebCore/html/HTMLFormElement.h
+++ b/WebCore/html/HTMLFormElement.h
@@ -85,13 +85,10 @@ public:
     bool formWouldHaveSecureSubmission(const String& url);
 
     String name() const;
-    void setName(const String&);
 
     bool noValidate() const;
-    void setNoValidate(bool);
 
     String acceptCharset() const { return m_formDataBuilder.acceptCharset(); }
-    void setAcceptCharset(const String&);
 
     String action() const;
     void setAction(const String&);
@@ -100,7 +97,6 @@ public:
     void setMethod(const String&);
 
     virtual String target() const;
-    void setTarget(const String&);
 
     HTMLFormControlElement* defaultButton() const;
 
diff --git a/WebCore/html/HTMLFormattingElementList.cpp b/WebCore/html/HTMLFormattingElementList.cpp
new file mode 100644
index 0000000..0198261
--- /dev/null
+++ b/WebCore/html/HTMLFormattingElementList.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "HTMLFormattingElementList.h"
+
+#include "Element.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+HTMLFormattingElementList::Entry::Entry(Element* element)
+    : m_element(element)
+{
+    ASSERT(element);
+}
+
+HTMLFormattingElementList::Entry::Entry(MarkerEntryType)
+{
+}
+
+HTMLFormattingElementList::Entry::~Entry()
+{
+}
+
+bool HTMLFormattingElementList::Entry::isMarker() const
+{
+    return !m_element;
+}
+
+Element* HTMLFormattingElementList::Entry::element() const
+{
+    // The fact that !m_element == isMarker() is an implementation detail
+    // callers should check isMarker() before calling element().
+    ASSERT(m_element);
+    return m_element.get();
+}
+
+void HTMLFormattingElementList::Entry::replaceElement(PassRefPtr<Element> element)
+{
+    ASSERT(m_element); // Once a marker, always a marker.
+    m_element = element;
+}
+
+bool HTMLFormattingElementList::Entry::operator==(const Entry& other) const
+{
+    return element() == other.element();
+}
+
+bool HTMLFormattingElementList::Entry::operator!=(const Entry& other) const
+{
+    return element() != other.element();
+}
+
+HTMLFormattingElementList::HTMLFormattingElementList()
+{
+}
+
+HTMLFormattingElementList::~HTMLFormattingElementList()
+{
+}
+
+Element* HTMLFormattingElementList::closestElementInScopeWithName(const AtomicString& targetName)
+{
+    for (unsigned i = 1; i <= m_entries.size(); ++i) {
+        const Entry& entry = m_entries[m_entries.size() - i];
+        if (entry.isMarker())
+            return 0;
+        if (entry.element()->hasLocalName(targetName))
+            return entry.element();
+    }
+    return 0;
+}
+
+bool HTMLFormattingElementList::contains(Element* element)
+{
+    return !!find(element);
+}
+
+HTMLFormattingElementList::Entry* HTMLFormattingElementList::find(Element* element)
+{
+    size_t index = m_entries.find(element);
+    if (index != notFound) {
+        // This is somewhat of a hack, and is why this method can't be const.
+        return &m_entries[index];
+    }
+    return 0;
+}
+
+void HTMLFormattingElementList::append(Element* element)
+{
+    m_entries.append(element);
+}
+
+void HTMLFormattingElementList::remove(Element* element)
+{
+    size_t index = m_entries.find(element);
+    if (index != notFound)
+        m_entries.remove(index);
+}
+
+void HTMLFormattingElementList::appendMarker()
+{
+    m_entries.append(Entry::MarkerEntry);
+}
+
+void HTMLFormattingElementList::clearToLastMarker()
+{
+    while (m_entries.size() && !m_entries.last().isMarker())
+        m_entries.removeLast();
+}
+
+}
diff --git a/WebCore/html/HTMLFormattingElementList.h b/WebCore/html/HTMLFormattingElementList.h
new file mode 100644
index 0000000..da30f75
--- /dev/null
+++ b/WebCore/html/HTMLFormattingElementList.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL GOOGLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef HTMLFormattingElementList_h
+#define HTMLFormattingElementList_h
+
+#include <wtf/Forward.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class AtomicString;
+class Element;
+
+// This may end up merged into HTMLElementStack.
+class HTMLFormattingElementList : public Noncopyable {
+public:
+    HTMLFormattingElementList();
+    ~HTMLFormattingElementList();
+
+    // Ideally Entry would be private, but HTMLTreeBuilder has to coordinate
+    // between the HTMLFormattingElementList and HTMLElementStack and needs
+    // access to Entry::isMarker() and Entry::replaceElement() to do so.
+    class Entry {
+    public:
+        Entry(Element*);
+        enum MarkerEntryType { MarkerEntry };
+        Entry(MarkerEntryType);
+        ~Entry();
+
+        bool isMarker() const;
+
+        Element* element() const;
+        void replaceElement(PassRefPtr<Element>);
+
+        // Needed for use with Vector.
+        bool operator==(const Entry&) const;
+        bool operator!=(const Entry&) const;
+
+    private:
+        RefPtr<Element> m_element;
+    };
+
+    bool isEmpty() const { return !size(); }
+    size_t size() const { return m_entries.size(); }
+
+    Element* closestElementInScopeWithName(const AtomicString&);
+
+    Entry* find(Element*);
+    bool contains(Element*);
+    void append(Element*);
+    void remove(Element*);
+
+    void appendMarker();
+    void clearToLastMarker();
+
+    const Entry& operator[](size_t i) const { return m_entries[i]; }
+    Entry& operator[](size_t i) { return m_entries[i]; }
+
+private:
+    Vector<Entry> m_entries;
+};
+
+}
+
+#endif // HTMLFormattingElementList_h
diff --git a/WebCore/html/HTMLFrameElement.cpp b/WebCore/html/HTMLFrameElement.cpp
index 3ccc87f..71c8f3f 100644
--- a/WebCore/html/HTMLFrameElement.cpp
+++ b/WebCore/html/HTMLFrameElement.cpp
@@ -91,15 +91,8 @@ void HTMLFrameElement::parseMappedAttribute(Attribute* attr)
         // FIXME: If we are already attached, this has no effect.
         // FIXME: Since this does not check attr->isNull(), it can
         // never reset m_noResize to false if the attribute is removed.
-        // FIXME: There seems to be no code that looks at this
-        // value and prevents resizing.
     } else
         HTMLFrameElementBase::parseMappedAttribute(attr);
 }
 
-void HTMLFrameElement::setNoResize(bool noResize)
-{
-    setAttribute(noresizeAttr, noResize ? "" : 0);
-}
-
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameElement.h b/WebCore/html/HTMLFrameElement.h
index 20f298e..3b1b5ad 100644
--- a/WebCore/html/HTMLFrameElement.h
+++ b/WebCore/html/HTMLFrameElement.h
@@ -35,7 +35,6 @@ public:
     bool hasFrameBorder() const { return m_frameBorder; }
 
     bool noResize() const { return m_noResize; }
-    void setNoResize(bool);
 
 private:
     HTMLFrameElement(const QualifiedName&, Document*);
diff --git a/WebCore/html/HTMLFrameElement.idl b/WebCore/html/HTMLFrameElement.idl
index 8f618c6..f1451f5 100644
--- a/WebCore/html/HTMLFrameElement.idl
+++ b/WebCore/html/HTMLFrameElement.idl
@@ -29,7 +29,7 @@ module html {
         attribute [Reflect] DOMString name;
         attribute [Reflect] boolean noResize;
         attribute [Reflect] DOMString scrolling;
-        attribute [ReflectURL, CustomSetter] DOMString src;
+        attribute [ReflectURL] DOMString src;
 
         // Introduced in DOM Level 2:
         readonly attribute [CheckFrameSecurity] Document contentDocument;
diff --git a/WebCore/html/HTMLFrameSetElement.cpp b/WebCore/html/HTMLFrameSetElement.cpp
index 7be3fdd..1b38a1d 100644
--- a/WebCore/html/HTMLFrameSetElement.cpp
+++ b/WebCore/html/HTMLFrameSetElement.cpp
@@ -216,24 +216,4 @@ void HTMLFrameSetElement::recalcStyle(StyleChange ch)
     HTMLElement::recalcStyle(ch);
 }
 
-String HTMLFrameSetElement::cols() const
-{
-    return getAttribute(colsAttr);
-}
-
-void HTMLFrameSetElement::setCols(const String &value)
-{
-    setAttribute(colsAttr, value);
-}
-
-String HTMLFrameSetElement::rows() const
-{
-    return getAttribute(rowsAttr);
-}
-
-void HTMLFrameSetElement::setRows(const String &value)
-{
-    setAttribute(rowsAttr, value);
-}
-
 } // namespace WebCore
diff --git a/WebCore/html/HTMLFrameSetElement.h b/WebCore/html/HTMLFrameSetElement.h
index accfbf8..a79793d 100644
--- a/WebCore/html/HTMLFrameSetElement.h
+++ b/WebCore/html/HTMLFrameSetElement.h
@@ -42,12 +42,6 @@ public:
 
     bool hasBorderColor() const { return m_borderColorSet; }
 
-    String cols() const;
-    void setCols(const String&);
-
-    String rows() const;
-    void setRows(const String&);
-
     const Length* rowLengths() const { return m_rowLengths.get(); }
     const Length* colLengths() const { return m_colLengths.get(); }
 
diff --git a/WebCore/html/HTMLHRElement.cpp b/WebCore/html/HTMLHRElement.cpp
index c4ab28f..44aa052 100644
--- a/WebCore/html/HTMLHRElement.cpp
+++ b/WebCore/html/HTMLHRElement.cpp
@@ -106,44 +106,4 @@ void HTMLHRElement::parseMappedAttribute(Attribute* attr)
         HTMLElement::parseMappedAttribute(attr);
 }
 
-String HTMLHRElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLHRElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
-bool HTMLHRElement::noShade() const
-{
-    return !getAttribute(noshadeAttr).isNull();
-}
-
-void HTMLHRElement::setNoShade(bool noShade)
-{
-    setAttribute(noshadeAttr, noShade ? "" : 0);
-}
-
-String HTMLHRElement::size() const
-{
-    return getAttribute(sizeAttr);
-}
-
-void HTMLHRElement::setSize(const String &value)
-{
-    setAttribute(sizeAttr, value);
-}
-
-String HTMLHRElement::width() const
-{
-    return getAttribute(widthAttr);
-}
-
-void HTMLHRElement::setWidth(const String &value)
-{
-    setAttribute(widthAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLHRElement.h b/WebCore/html/HTMLHRElement.h
index ea10c88..3cfaabf 100644
--- a/WebCore/html/HTMLHRElement.h
+++ b/WebCore/html/HTMLHRElement.h
@@ -31,18 +31,6 @@ class HTMLHRElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLHRElement> create(Document*);
     static PassRefPtr<HTMLHRElement> create(const QualifiedName&, Document*);
-    
-    String align() const;
-    void setAlign(const String&);
-
-    bool noShade() const;
-    void setNoShade(bool);
-
-    String size() const;
-    void setSize(const String&);
-
-    String width() const;
-    void setWidth(const String&);
 
 private:
     HTMLHRElement(const QualifiedName&, Document*);
diff --git a/WebCore/html/HTMLHeadElement.cpp b/WebCore/html/HTMLHeadElement.cpp
index 0fb7a47..c57cc2f 100644
--- a/WebCore/html/HTMLHeadElement.cpp
+++ b/WebCore/html/HTMLHeadElement.cpp
@@ -47,16 +47,6 @@ PassRefPtr<HTMLHeadElement> HTMLHeadElement::create(const QualifiedName& tagName
     return adoptRef(new HTMLHeadElement(tagName, document));
 }
 
-String HTMLHeadElement::profile() const
-{
-    return getAttribute(profileAttr);
-}
-
-void HTMLHeadElement::setProfile(const String &value)
-{
-    setAttribute(profileAttr, value);
-}
-
 bool HTMLHeadElement::childAllowed(Node* newChild)
 {
     // Do not allow non-whitespace text nodes in the head
diff --git a/WebCore/html/HTMLHeadElement.h b/WebCore/html/HTMLHeadElement.h
index a91f5f8..c7cfc00 100644
--- a/WebCore/html/HTMLHeadElement.h
+++ b/WebCore/html/HTMLHeadElement.h
@@ -33,9 +33,6 @@ public:
     static PassRefPtr<HTMLHeadElement> create(Document*);
     static PassRefPtr<HTMLHeadElement> create(const QualifiedName&, Document*);
 
-    String profile() const;
-    void setProfile(const String&);
-
     virtual int tagPriority() const { return 10; }
 
 private:
diff --git a/WebCore/html/HTMLHeadingElement.cpp b/WebCore/html/HTMLHeadingElement.cpp
index 484dea6..e2a0f73 100644
--- a/WebCore/html/HTMLHeadingElement.cpp
+++ b/WebCore/html/HTMLHeadingElement.cpp
@@ -49,14 +49,4 @@ bool HTMLHeadingElement::checkDTD(const Node* newChild)
     return inEitherTagList(newChild);
 }
 
-String HTMLHeadingElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLHeadingElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLHeadingElement.h b/WebCore/html/HTMLHeadingElement.h
index e783360..575a05c 100644
--- a/WebCore/html/HTMLHeadingElement.h
+++ b/WebCore/html/HTMLHeadingElement.h
@@ -31,9 +31,6 @@ class HTMLHeadingElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLHeadingElement> create(const QualifiedName&, Document*);
 
-    String align() const;
-    void setAlign(const String&);
-
 private:
     HTMLHeadingElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLHtmlElement.cpp b/WebCore/html/HTMLHtmlElement.cpp
index 46913a1..93edf6c 100644
--- a/WebCore/html/HTMLHtmlElement.cpp
+++ b/WebCore/html/HTMLHtmlElement.cpp
@@ -50,16 +50,6 @@ PassRefPtr<HTMLHtmlElement> HTMLHtmlElement::create(const QualifiedName& tagName
     return adoptRef(new HTMLHtmlElement(tagName, document));
 }
 
-String HTMLHtmlElement::version() const
-{
-    return getAttribute(versionAttr);
-}
-
-void HTMLHtmlElement::setVersion(const String &value)
-{
-    setAttribute(versionAttr, value);
-}
-
 bool HTMLHtmlElement::checkDTD(const Node* newChild)
 {
     return newChild->hasTagName(headTag) || newChild->hasTagName(bodyTag) ||
diff --git a/WebCore/html/HTMLHtmlElement.h b/WebCore/html/HTMLHtmlElement.h
index ed04703..34879ed 100644
--- a/WebCore/html/HTMLHtmlElement.h
+++ b/WebCore/html/HTMLHtmlElement.h
@@ -33,9 +33,6 @@ public:
     static PassRefPtr<HTMLHtmlElement> create(Document*);
     static PassRefPtr<HTMLHtmlElement> create(const QualifiedName&, Document*);
 
-    String version() const;
-    void setVersion(const String&);
-
 private:
     HTMLHtmlElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLIFrameElement.idl b/WebCore/html/HTMLIFrameElement.idl
index 86abaf5..b21263e 100644
--- a/WebCore/html/HTMLIFrameElement.idl
+++ b/WebCore/html/HTMLIFrameElement.idl
@@ -30,7 +30,7 @@ module html {
         attribute [Reflect] DOMString name;
         attribute [Reflect] DOMString sandbox;
         attribute [Reflect] DOMString scrolling;
-        attribute [CustomSetter, Reflect] DOMString src;
+        attribute [Reflect] DOMString src;
         attribute [Reflect] DOMString width;
 
         // Introduced in DOM Level 2:
diff --git a/WebCore/html/HTMLImageElement.cpp b/WebCore/html/HTMLImageElement.cpp
index 5d5923d..82eeab1 100644
--- a/WebCore/html/HTMLImageElement.cpp
+++ b/WebCore/html/HTMLImageElement.cpp
@@ -342,47 +342,6 @@ void HTMLImageElement::setHeight(int value)
     setAttribute(heightAttr, String::number(value));
 }
 
-int HTMLImageElement::hspace() const
-{
-    // ### return actual value
-    return getAttribute(hspaceAttr).toInt();
-}
-
-void HTMLImageElement::setHspace(int value)
-{
-    setAttribute(hspaceAttr, String::number(value));
-}
-
-bool HTMLImageElement::isMap() const
-{
-    return !getAttribute(ismapAttr).isNull();
-}
-
-void HTMLImageElement::setIsMap(bool isMap)
-{
-    setAttribute(ismapAttr, isMap ? "" : 0);
-}
-
-KURL HTMLImageElement::longDesc() const
-{
-    return document()->completeURL(getAttribute(longdescAttr));
-}
-
-void HTMLImageElement::setLongDesc(const String& value)
-{
-    setAttribute(longdescAttr, value);
-}
-
-KURL HTMLImageElement::lowsrc() const
-{
-    return document()->completeURL(getAttribute(lowsrcAttr));
-}
-
-void HTMLImageElement::setLowsrc(const String& value)
-{
-    setAttribute(lowsrcAttr, value);
-}
-
 KURL HTMLImageElement::src() const
 {
     return document()->completeURL(getAttribute(srcAttr));
@@ -393,17 +352,6 @@ void HTMLImageElement::setSrc(const String& value)
     setAttribute(srcAttr, value);
 }
 
-int HTMLImageElement::vspace() const
-{
-    // ### return actual vspace
-    return getAttribute(vspaceAttr).toInt();
-}
-
-void HTMLImageElement::setVspace(int value)
-{
-    setAttribute(vspaceAttr, String::number(value));
-}
-
 void HTMLImageElement::setWidth(int value)
 {
     setAttribute(widthAttr, String::number(value));
diff --git a/WebCore/html/HTMLImageElement.h b/WebCore/html/HTMLImageElement.h
index 62d315c..2b29570 100644
--- a/WebCore/html/HTMLImageElement.h
+++ b/WebCore/html/HTMLImageElement.h
@@ -62,24 +62,9 @@ public:
 
     void setHeight(int);
 
-    int hspace() const;
-    void setHspace(int);
-
-    bool isMap() const;
-    void setIsMap(bool);
-
-    KURL longDesc() const;
-    void setLongDesc(const String&);
-
-    KURL lowsrc() const;
-    void setLowsrc(const String&);
-
     KURL src() const;
     void setSrc(const String&);
 
-    int vspace() const;
-    void setVspace(int);
-
     void setWidth(int);
 
     int x() const;
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index 5e27449..d6136d8 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -2427,11 +2427,6 @@ bool HTMLInputElement::defaultChecked() const
     return !getAttribute(checkedAttr).isNull();
 }
 
-void HTMLInputElement::setDefaultChecked(bool defaultChecked)
-{
-    setAttribute(checkedAttr, defaultChecked ? "" : 0);
-}
-
 void HTMLInputElement::setDefaultName(const AtomicString& name)
 {
     m_data.setName(name);
@@ -2442,41 +2437,11 @@ String HTMLInputElement::accept() const
     return getAttribute(acceptAttr);
 }
 
-void HTMLInputElement::setAccept(const String &value)
-{
-    setAttribute(acceptAttr, value);
-}
-
-String HTMLInputElement::accessKey() const
-{
-    return getAttribute(accesskeyAttr);
-}
-
-void HTMLInputElement::setAccessKey(const String &value)
-{
-    setAttribute(accesskeyAttr, value);
-}
-
-String HTMLInputElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLInputElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
 String HTMLInputElement::alt() const
 {
     return getAttribute(altAttr);
 }
 
-void HTMLInputElement::setAlt(const String &value)
-{
-    setAttribute(altAttr, value);
-}
-
 int HTMLInputElement::maxLength() const
 {
     return m_data.maxLength();
@@ -2495,11 +2460,6 @@ bool HTMLInputElement::multiple() const
     return !getAttribute(multipleAttr).isNull();
 }
 
-void HTMLInputElement::setMultiple(bool multiple)
-{
-    setAttribute(multipleAttr, multiple ? "" : 0);
-}
-    
 void HTMLInputElement::setSize(unsigned size)
 {
     setAttribute(sizeAttr, String::number(size));
@@ -2510,21 +2470,6 @@ KURL HTMLInputElement::src() const
     return document()->completeURL(getAttribute(srcAttr));
 }
 
-void HTMLInputElement::setSrc(const String &value)
-{
-    setAttribute(srcAttr, value);
-}
-
-String HTMLInputElement::useMap() const
-{
-    return getAttribute(usemapAttr);
-}
-
-void HTMLInputElement::setUseMap(const String &value)
-{
-    setAttribute(usemapAttr, value);
-}
-
 void HTMLInputElement::setAutofilled(bool b)
 {
     if (b == m_autofilled)
@@ -2730,6 +2675,7 @@ bool HTMLInputElement::parseToDateComponents(InputType type, const String& formS
 }
 
 #if ENABLE(DATALIST)
+
 HTMLElement* HTMLInputElement::list() const
 {
     return dataList();
@@ -2794,6 +2740,7 @@ HTMLOptionElement* HTMLInputElement::selectedOption() const
     }
     return 0;
 }
+
 #endif // ENABLE(DATALIST)
 
 void HTMLInputElement::stepUpFromRenderer(int n)
diff --git a/WebCore/html/HTMLInputElement.h b/WebCore/html/HTMLInputElement.h
index 5bcf01f..6791fa2 100644
--- a/WebCore/html/HTMLInputElement.h
+++ b/WebCore/html/HTMLInputElement.h
@@ -162,35 +162,20 @@ public:
     void setDefaultValue(const String&);
     
     bool defaultChecked() const;
-    void setDefaultChecked(bool);
 
     void setDefaultName(const AtomicString&);
 
     String accept() const;
-    void setAccept(const String&);
-
-    String accessKey() const;
-    void setAccessKey(const String&);
-
-    String align() const;
-    void setAlign(const String&);
-
     String alt() const;
-    void setAlt(const String&);
 
     void setSize(unsigned);
 
     KURL src() const;
-    void setSrc(const String&);
 
     int maxLength() const;
     void setMaxLength(int, ExceptionCode&);
 
     bool multiple() const;
-    void setMultiple(bool);
-
-    String useMap() const;
-    void setUseMap(const String&);
 
     virtual bool isAutofilled() const { return m_autofilled; }
     void setAutofilled(bool value = true);
diff --git a/WebCore/html/HTMLInputStream.h b/WebCore/html/HTMLInputStream.h
index 9620388..d7c1c9c 100644
--- a/WebCore/html/HTMLInputStream.h
+++ b/WebCore/html/HTMLInputStream.h
@@ -64,8 +64,19 @@ public:
         m_first.append(string);
     }
 
-    void close() { m_last->close(); }
-    bool isClosed() { return m_last->isClosed(); }
+    void markEndOfFile()
+    {
+        // FIXME: This should use InputStreamPreprocessor::endOfFileMarker
+        // once InputStreamPreprocessor is split off into its own header.
+        static const UChar endOfFileMarker = 0;
+        m_last->append(SegmentedString(String(&endOfFileMarker, 1)));
+        m_last->close();
+    }
+
+    bool haveSeenEndOfFile()
+    {
+        return m_last->isClosed();
+    }
 
     SegmentedString& current() { return m_first; }
 
diff --git a/WebCore/html/HTMLIsIndexElement.cpp b/WebCore/html/HTMLIsIndexElement.cpp
index dce67f6..a23a353 100644
--- a/WebCore/html/HTMLIsIndexElement.cpp
+++ b/WebCore/html/HTMLIsIndexElement.cpp
@@ -61,14 +61,4 @@ void HTMLIsIndexElement::parseMappedAttribute(Attribute* attr)
         HTMLFormControlElement::parseMappedAttribute(attr);
 }
 
-String HTMLIsIndexElement::prompt() const
-{
-    return getAttribute(promptAttr);
-}
-
-void HTMLIsIndexElement::setPrompt(const String &value)
-{
-    setAttribute(promptAttr, value);
-}
-
 } // namespace
diff --git a/WebCore/html/HTMLIsIndexElement.h b/WebCore/html/HTMLIsIndexElement.h
index 528f3e2..8c33d71 100644
--- a/WebCore/html/HTMLIsIndexElement.h
+++ b/WebCore/html/HTMLIsIndexElement.h
@@ -33,9 +33,6 @@ public:
     static PassRefPtr<HTMLIsIndexElement> create(Document*, HTMLFormElement*);
     static PassRefPtr<HTMLIsIndexElement> create(const QualifiedName&, Document*, HTMLFormElement*);
 
-    String prompt() const;
-    void setPrompt(const String&);
-
 private:
     HTMLIsIndexElement(const QualifiedName&, Document*, HTMLFormElement*);
 
diff --git a/WebCore/html/HTMLKeygenElement.cpp b/WebCore/html/HTMLKeygenElement.cpp
index 74b3a0f..5185f51 100644
--- a/WebCore/html/HTMLKeygenElement.cpp
+++ b/WebCore/html/HTMLKeygenElement.cpp
@@ -50,8 +50,8 @@ inline HTMLKeygenElement::HTMLKeygenElement(const QualifiedName& tagName, Docume
     getSupportedKeySizes(keys);
     for (size_t i = 0; i < keys.size(); ++i) {
         RefPtr<HTMLOptionElement> option = HTMLOptionElement::create(document, this->form());
-        addChild(option);
-        option->addChild(Text::create(document, keys[i]));
+        legacyParserAddChild(option);
+        option->legacyParserAddChild(Text::create(document, keys[i]));
     }
 }
 
diff --git a/WebCore/html/HTMLLIElement.cpp b/WebCore/html/HTMLLIElement.cpp
index ae96cc3..9abea9f 100644
--- a/WebCore/html/HTMLLIElement.cpp
+++ b/WebCore/html/HTMLLIElement.cpp
@@ -116,24 +116,4 @@ void HTMLLIElement::attach()
     }
 }
 
-String HTMLLIElement::type() const
-{
-    return getAttribute(typeAttr);
-}
-
-void HTMLLIElement::setType(const String& value)
-{
-    setAttribute(typeAttr, value);
-}
-
-int HTMLLIElement::value() const
-{
-    return getAttribute(valueAttr).toInt();
-}
-
-void HTMLLIElement::setValue(int value)
-{
-    setAttribute(valueAttr, String::number(value));
-}
-
 }
diff --git a/WebCore/html/HTMLLIElement.h b/WebCore/html/HTMLLIElement.h
index 5ce00f2..418f7a4 100644
--- a/WebCore/html/HTMLLIElement.h
+++ b/WebCore/html/HTMLLIElement.h
@@ -32,12 +32,6 @@ public:
     static PassRefPtr<HTMLLIElement> create(Document*);
     static PassRefPtr<HTMLLIElement> create(const QualifiedName&, Document*);
 
-    String type() const;
-    void setType(const String&);
-
-    int value() const;
-    void setValue(int);
-
 private:
     HTMLLIElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLLabelElement.cpp b/WebCore/html/HTMLLabelElement.cpp
index 6b3069a..1e44e2a 100644
--- a/WebCore/html/HTMLLabelElement.cpp
+++ b/WebCore/html/HTMLLabelElement.cpp
@@ -154,26 +154,6 @@ void HTMLLabelElement::accessKeyAction(bool sendToAnyElement)
         HTMLElement::accessKeyAction(sendToAnyElement);
 }
 
-String HTMLLabelElement::accessKey() const
-{
-    return getAttribute(accesskeyAttr);
-}
-
-void HTMLLabelElement::setAccessKey(const String &value)
-{
-    setAttribute(accesskeyAttr, value);
-}
-
-String HTMLLabelElement::htmlFor() const
-{
-    return getAttribute(forAttr);
-}
-
-void HTMLLabelElement::setHtmlFor(const String &value)
-{
-    setAttribute(forAttr, value);
-}
-
 void HTMLLabelElement::parseMappedAttribute(Attribute* attribute)
 {
     if (attribute->name() == forAttr) {
diff --git a/WebCore/html/HTMLLabelElement.h b/WebCore/html/HTMLLabelElement.h
index 759ffcd..7964ade 100644
--- a/WebCore/html/HTMLLabelElement.h
+++ b/WebCore/html/HTMLLabelElement.h
@@ -35,12 +35,6 @@ public:
 
     HTMLFormControlElement* control();
 
-    String accessKey() const;
-    void setAccessKey(const String&);
-    
-    String htmlFor() const;
-    void setHtmlFor(const String&);
-
 private:
     HTMLLabelElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLLegendElement.cpp b/WebCore/html/HTMLLegendElement.cpp
index 4249fb1..acc4a59 100644
--- a/WebCore/html/HTMLLegendElement.cpp
+++ b/WebCore/html/HTMLLegendElement.cpp
@@ -54,26 +54,6 @@ const AtomicString& HTMLLegendElement::formControlType() const
     return legend;
 }
 
-String HTMLLegendElement::accessKey() const
-{
-    return getAttribute(accesskeyAttr);
-}
-
-void HTMLLegendElement::setAccessKey(const String &value)
-{
-    setAttribute(accesskeyAttr, value);
-}
-
-String HTMLLegendElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLLegendElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
 HTMLFormControlElement* HTMLLegendElement::associatedControl()
 {
     // Check if there's a fieldset belonging to this legend.
diff --git a/WebCore/html/HTMLLegendElement.h b/WebCore/html/HTMLLegendElement.h
index fa2aa2b..732ef33 100644
--- a/WebCore/html/HTMLLegendElement.h
+++ b/WebCore/html/HTMLLegendElement.h
@@ -32,12 +32,6 @@ class HTMLLegendElement : public HTMLFormControlElement {
 public:
     static PassRefPtr<HTMLLegendElement> create(const QualifiedName&, Document*, HTMLFormElement*);
 
-    String accessKey() const;
-    void setAccessKey(const String&);
-
-    String align() const;
-    void setAlign(const String&);
-    
 private:
     HTMLLegendElement(const QualifiedName&, Document*, HTMLFormElement*);
 
diff --git a/WebCore/html/HTMLLinkElement.cpp b/WebCore/html/HTMLLinkElement.cpp
index 13e43fd..64a52cc 100644
--- a/WebCore/html/HTMLLinkElement.cpp
+++ b/WebCore/html/HTMLLinkElement.cpp
@@ -420,96 +420,26 @@ bool HTMLLinkElement::isURLAttribute(Attribute *attr) const
     return attr->name() == hrefAttr;
 }
 
-bool HTMLLinkElement::disabled() const
-{
-    return !getAttribute(disabledAttr).isNull();
-}
-
-void HTMLLinkElement::setDisabled(bool disabled)
-{
-    setAttribute(disabledAttr, disabled ? "" : 0);
-}
-
-String HTMLLinkElement::charset() const
-{
-    return getAttribute(charsetAttr);
-}
-
-void HTMLLinkElement::setCharset(const String& value)
-{
-    setAttribute(charsetAttr, value);
-}
-
 KURL HTMLLinkElement::href() const
 {
     return document()->completeURL(getAttribute(hrefAttr));
 }
 
-void HTMLLinkElement::setHref(const String& value)
-{
-    setAttribute(hrefAttr, value);
-}
-
-String HTMLLinkElement::hreflang() const
-{
-    return getAttribute(hreflangAttr);
-}
-
-void HTMLLinkElement::setHreflang(const String& value)
-{
-    setAttribute(hreflangAttr, value);
-}
-
-String HTMLLinkElement::media() const
-{
-    return getAttribute(mediaAttr);
-}
-
-void HTMLLinkElement::setMedia(const String& value)
-{
-    setAttribute(mediaAttr, value);
-}
-
 String HTMLLinkElement::rel() const
 {
     return getAttribute(relAttr);
 }
 
-void HTMLLinkElement::setRel(const String& value)
-{
-    setAttribute(relAttr, value);
-}
-
-String HTMLLinkElement::rev() const
-{
-    return getAttribute(revAttr);
-}
-
-void HTMLLinkElement::setRev(const String& value)
-{
-    setAttribute(revAttr, value);
-}
-
 String HTMLLinkElement::target() const
 {
     return getAttribute(targetAttr);
 }
 
-void HTMLLinkElement::setTarget(const String& value)
-{
-    setAttribute(targetAttr, value);
-}
-
 String HTMLLinkElement::type() const
 {
     return getAttribute(typeAttr);
 }
 
-void HTMLLinkElement::setType(const String& value)
-{
-    setAttribute(typeAttr, value);
-}
-
 void HTMLLinkElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLElement::addSubresourceAttributeURLs(urls);
diff --git a/WebCore/html/HTMLLinkElement.h b/WebCore/html/HTMLLinkElement.h
index bd1642b..a2d88c2 100644
--- a/WebCore/html/HTMLLinkElement.h
+++ b/WebCore/html/HTMLLinkElement.h
@@ -67,32 +67,12 @@ public:
     static PassRefPtr<HTMLLinkElement> create(const QualifiedName&, Document*, bool createdByParser);
     virtual ~HTMLLinkElement();
 
-    bool disabled() const;
-    void setDisabled(bool);
-
-    String charset() const;
-    void setCharset(const String&);
-
     KURL href() const;
-    void setHref(const String&);
-
-    String hreflang() const;
-    void setHreflang(const String&);
-
-    String media() const;
-    void setMedia(const String&);
-
     String rel() const;
-    void setRel(const String&);
-
-    String rev() const;
-    void setRev(const String&);
 
     virtual String target() const;
-    void setTarget(const String&);
 
     String type() const;
-    void setType(const String&);
 
     StyleSheet* sheet() const;
 
diff --git a/WebCore/html/HTMLMapElement.cpp b/WebCore/html/HTMLMapElement.cpp
index 14c0feb..eba23ca 100644
--- a/WebCore/html/HTMLMapElement.cpp
+++ b/WebCore/html/HTMLMapElement.cpp
@@ -137,16 +137,6 @@ PassRefPtr<HTMLCollection> HTMLMapElement::areas()
     return HTMLCollection::create(this, MapAreas);
 }
 
-String HTMLMapElement::name() const
-{
-    return getAttribute(nameAttr);
-}
-
-void HTMLMapElement::setName(const String& value)
-{
-    setAttribute(nameAttr, value);
-}
-
 void HTMLMapElement::insertedIntoDocument()
 {
     document()->addImageMap(this);
diff --git a/WebCore/html/HTMLMapElement.h b/WebCore/html/HTMLMapElement.h
index 483f17b..1394c95 100644
--- a/WebCore/html/HTMLMapElement.h
+++ b/WebCore/html/HTMLMapElement.h
@@ -44,9 +44,6 @@ public:
     HTMLImageElement* imageElement() const;
     PassRefPtr<HTMLCollection> areas();
 
-    String name() const;
-    void setName(const String&);
-
 private:
     HTMLMapElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLMenuElement.cpp b/WebCore/html/HTMLMenuElement.cpp
index 7acef0f..9f706ef 100644
--- a/WebCore/html/HTMLMenuElement.cpp
+++ b/WebCore/html/HTMLMenuElement.cpp
@@ -40,14 +40,4 @@ PassRefPtr<HTMLMenuElement> HTMLMenuElement::create(const QualifiedName& tagName
     return adoptRef(new HTMLMenuElement(tagName, document));
 }
 
-bool HTMLMenuElement::compact() const
-{
-    return !getAttribute(compactAttr).isNull();
-}
-
-void HTMLMenuElement::setCompact(bool b)
-{
-    setAttribute(compactAttr, b ? "" : 0);
-}
-
 }
diff --git a/WebCore/html/HTMLMenuElement.h b/WebCore/html/HTMLMenuElement.h
index 7534e81..002df00 100644
--- a/WebCore/html/HTMLMenuElement.h
+++ b/WebCore/html/HTMLMenuElement.h
@@ -31,9 +31,6 @@ class HTMLMenuElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLMenuElement> create(const QualifiedName&, Document*);
     
-    bool compact() const;
-    void setCompact(bool);
-
 private:
     HTMLMenuElement(const QualifiedName&, Document*);
     
diff --git a/WebCore/html/HTMLMetaElement.cpp b/WebCore/html/HTMLMetaElement.cpp
index a7f2978..cdb9950 100644
--- a/WebCore/html/HTMLMetaElement.cpp
+++ b/WebCore/html/HTMLMetaElement.cpp
@@ -123,39 +123,14 @@ String HTMLMetaElement::content() const
     return getAttribute(contentAttr);
 }
 
-void HTMLMetaElement::setContent(const String& value)
-{
-    setAttribute(contentAttr, value);
-}
-
 String HTMLMetaElement::httpEquiv() const
 {
     return getAttribute(http_equivAttr);
 }
 
-void HTMLMetaElement::setHttpEquiv(const String& value)
-{
-    setAttribute(http_equivAttr, value);
-}
-
 String HTMLMetaElement::name() const
 {
     return getAttribute(nameAttr);
 }
 
-void HTMLMetaElement::setName(const String& value)
-{
-    setAttribute(nameAttr, value);
-}
-
-String HTMLMetaElement::scheme() const
-{
-    return getAttribute(schemeAttr);
-}
-
-void HTMLMetaElement::setScheme(const String &value)
-{
-    setAttribute(schemeAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLMetaElement.h b/WebCore/html/HTMLMetaElement.h
index 7708a50..6af7483 100644
--- a/WebCore/html/HTMLMetaElement.h
+++ b/WebCore/html/HTMLMetaElement.h
@@ -32,16 +32,8 @@ public:
     static PassRefPtr<HTMLMetaElement> create(const QualifiedName&, Document*);
 
     String content() const;
-    void setContent(const String&);
-
     String httpEquiv() const;
-    void setHttpEquiv(const String&);
-
     String name() const;
-    void setName(const String&);
-
-    String scheme() const;
-    void setScheme(const String&);
 
 private:
     HTMLMetaElement(const QualifiedName&, Document*);
diff --git a/WebCore/html/HTMLModElement.cpp b/WebCore/html/HTMLModElement.cpp
index cb6da83..ab161d9 100644
--- a/WebCore/html/HTMLModElement.cpp
+++ b/WebCore/html/HTMLModElement.cpp
@@ -39,24 +39,4 @@ PassRefPtr<HTMLModElement> HTMLModElement::create(const QualifiedName& tagName,
     return adoptRef(new HTMLModElement(tagName, document));
 }
 
-String HTMLModElement::cite() const
-{
-    return getAttribute(citeAttr);
-}
-
-void HTMLModElement::setCite(const String& value)
-{
-    setAttribute(citeAttr, value);
-}
-
-String HTMLModElement::dateTime() const
-{
-    return getAttribute(datetimeAttr);
-}
-
-void HTMLModElement::setDateTime(const String& value)
-{
-    setAttribute(datetimeAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLModElement.h b/WebCore/html/HTMLModElement.h
index af003d7..7370320 100644
--- a/WebCore/html/HTMLModElement.h
+++ b/WebCore/html/HTMLModElement.h
@@ -32,12 +32,6 @@ class HTMLModElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLModElement> create(const QualifiedName&, Document*);
 
-    String cite() const;
-    void setCite(const String&);
-
-    String dateTime() const;
-    void setDateTime(const String&);
-
 private:
     HTMLModElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLOListElement.cpp b/WebCore/html/HTMLOListElement.cpp
index c40f216..4c1d5a7 100644
--- a/WebCore/html/HTMLOListElement.cpp
+++ b/WebCore/html/HTMLOListElement.cpp
@@ -89,29 +89,9 @@ void HTMLOListElement::parseMappedAttribute(Attribute* attr)
         HTMLElement::parseMappedAttribute(attr);
 }
 
-bool HTMLOListElement::compact() const
-{
-    return !getAttribute(compactAttr).isNull();
-}
-
-void HTMLOListElement::setCompact(bool b)
-{
-    setAttribute(compactAttr, b ? "" : 0);
-}
-
 void HTMLOListElement::setStart(int start)
 {
     setAttribute(startAttr, String::number(start));
 }
 
-String HTMLOListElement::type() const
-{
-    return getAttribute(typeAttr);
-}
-
-void HTMLOListElement::setType(const String& value)
-{
-    setAttribute(typeAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLOListElement.h b/WebCore/html/HTMLOListElement.h
index 871c34c..3067138 100644
--- a/WebCore/html/HTMLOListElement.h
+++ b/WebCore/html/HTMLOListElement.h
@@ -32,15 +32,9 @@ public:
     static PassRefPtr<HTMLOListElement> create(Document*);
     static PassRefPtr<HTMLOListElement> create(const QualifiedName&, Document*);
 
-    bool compact() const;
-    void setCompact(bool);
-
     int start() const { return m_start; }
     void setStart(int);
 
-    String type() const;
-    void setType(const String&);
-
 private:
     HTMLOListElement(const QualifiedName&, Document*);
         
diff --git a/WebCore/html/HTMLObjectElement.cpp b/WebCore/html/HTMLObjectElement.cpp
index 45586d1..0724ce6 100644
--- a/WebCore/html/HTMLObjectElement.cpp
+++ b/WebCore/html/HTMLObjectElement.cpp
@@ -301,36 +301,6 @@ void HTMLObjectElement::updateDocNamedItem()
     m_docNamedItem = isNamedItem;
 }
 
-bool HTMLObjectElement::declare() const
-{
-    return !getAttribute(declareAttr).isNull();
-}
-
-void HTMLObjectElement::setDeclare(bool declare)
-{
-    setAttribute(declareAttr, declare ? "" : 0);
-}
-
-int HTMLObjectElement::hspace() const
-{
-    return getAttribute(hspaceAttr).toInt();
-}
-
-void HTMLObjectElement::setHspace(int value)
-{
-    setAttribute(hspaceAttr, String::number(value));
-}
-
-int HTMLObjectElement::vspace() const
-{
-    return getAttribute(vspaceAttr).toInt();
-}
-
-void HTMLObjectElement::setVspace(int value)
-{
-    setAttribute(vspaceAttr, String::number(value));
-}
-
 bool HTMLObjectElement::containsJavaApplet() const
 {
     if (MIMETypeRegistry::isJavaAppletMIMEType(getAttribute(typeAttr)))
diff --git a/WebCore/html/HTMLObjectElement.h b/WebCore/html/HTMLObjectElement.h
index 4a22ea3..c904c74 100644
--- a/WebCore/html/HTMLObjectElement.h
+++ b/WebCore/html/HTMLObjectElement.h
@@ -35,15 +35,6 @@ public:
 
     void renderFallbackContent();
 
-    bool declare() const;
-    void setDeclare(bool);
-
-    int hspace() const;
-    void setHspace(int);
-
-    int vspace() const;
-    void setVspace(int);
-
     bool isDocNamedItem() const { return m_docNamedItem; }
 
     const String& classId() const { return m_classId; }
diff --git a/WebCore/html/HTMLOptGroupElement.cpp b/WebCore/html/HTMLOptGroupElement.cpp
index 27bc40e..7db0924 100644
--- a/WebCore/html/HTMLOptGroupElement.cpp
+++ b/WebCore/html/HTMLOptGroupElement.cpp
@@ -86,16 +86,6 @@ void HTMLOptGroupElement::recalcSelectOptions()
         static_cast<HTMLSelectElement*>(select)->setRecalcListItems();
 }
 
-String HTMLOptGroupElement::label() const
-{
-    return getAttribute(labelAttr);
-}
-
-void HTMLOptGroupElement::setLabel(const String &value)
-{
-    setAttribute(labelAttr, value);
-}
-
 bool HTMLOptGroupElement::checkDTD(const Node* newChild)
 {
     // Make sure to keep this in sync with <select> (other than not allowing an optgroup).
diff --git a/WebCore/html/HTMLOptGroupElement.h b/WebCore/html/HTMLOptGroupElement.h
index 394fdca..095b9d2 100644
--- a/WebCore/html/HTMLOptGroupElement.h
+++ b/WebCore/html/HTMLOptGroupElement.h
@@ -35,9 +35,6 @@ class HTMLOptGroupElement : public HTMLFormControlElement, public OptionGroupEle
 public:
     static PassRefPtr<HTMLOptGroupElement> create(const QualifiedName&, Document*, HTMLFormElement*);
 
-    String label() const;
-    void setLabel(const String&);
-    
     HTMLSelectElement* ownerSelectElement() const;
     
     virtual String groupLabelText() const;
diff --git a/WebCore/html/HTMLOptionElement.cpp b/WebCore/html/HTMLOptionElement.cpp
index dfee748..19f40be 100644
--- a/WebCore/html/HTMLOptionElement.cpp
+++ b/WebCore/html/HTMLOptionElement.cpp
@@ -223,11 +223,6 @@ String HTMLOptionElement::label() const
     return m_data.label();
 }
 
-void HTMLOptionElement::setLabel(const String& value)
-{
-    setAttribute(labelAttr, value);
-}
-
 void HTMLOptionElement::setRenderStyle(PassRefPtr<RenderStyle> newStyle)
 {
     m_style = newStyle;
diff --git a/WebCore/html/HTMLOptionElement.h b/WebCore/html/HTMLOptionElement.h
index b82bfae..d0ff23b 100644
--- a/WebCore/html/HTMLOptionElement.h
+++ b/WebCore/html/HTMLOptionElement.h
@@ -70,7 +70,6 @@ public:
     void setDefaultSelected(bool);
 
     String label() const;
-    void setLabel(const String&);
 
     bool ownElementDisabled() const { return HTMLFormControlElement::disabled(); }
 
diff --git a/WebCore/html/HTMLParagraphElement.cpp b/WebCore/html/HTMLParagraphElement.cpp
index 4afa9f8..4af5b77 100644
--- a/WebCore/html/HTMLParagraphElement.cpp
+++ b/WebCore/html/HTMLParagraphElement.cpp
@@ -74,14 +74,4 @@ void HTMLParagraphElement::parseMappedAttribute(Attribute* attr)
         HTMLElement::parseMappedAttribute(attr);
 }
 
-String HTMLParagraphElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLParagraphElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLParagraphElement.h b/WebCore/html/HTMLParagraphElement.h
index 26e34a7..0a31a1c 100644
--- a/WebCore/html/HTMLParagraphElement.h
+++ b/WebCore/html/HTMLParagraphElement.h
@@ -31,9 +31,6 @@ class HTMLParagraphElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLParagraphElement> create(const QualifiedName&, Document*);
 
-    String align() const;
-    void setAlign(const String&);
-
 private:
     HTMLParagraphElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLParamElement.cpp b/WebCore/html/HTMLParamElement.cpp
index 13a37d6..2dc9d1d 100644
--- a/WebCore/html/HTMLParamElement.cpp
+++ b/WebCore/html/HTMLParamElement.cpp
@@ -71,36 +71,6 @@ bool HTMLParamElement::isURLAttribute(Attribute* attr) const
     return false;
 }
 
-void HTMLParamElement::setName(const String& value)
-{
-    setAttribute(nameAttr, value);
-}
-
-String HTMLParamElement::type() const
-{
-    return getAttribute(typeAttr);
-}
-
-void HTMLParamElement::setType(const String& value)
-{
-    setAttribute(typeAttr, value);
-}
-
-void HTMLParamElement::setValue(const String& value)
-{
-    setAttribute(valueAttr, value);
-}
-
-String HTMLParamElement::valueType() const
-{
-    return getAttribute(valuetypeAttr);
-}
-
-void HTMLParamElement::setValueType(const String& value)
-{
-    setAttribute(valuetypeAttr, value);
-}
-
 void HTMLParamElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLElement::addSubresourceAttributeURLs(urls);
diff --git a/WebCore/html/HTMLParamElement.h b/WebCore/html/HTMLParamElement.h
index a782353..a787927 100644
--- a/WebCore/html/HTMLParamElement.h
+++ b/WebCore/html/HTMLParamElement.h
@@ -32,16 +32,7 @@ public:
     static PassRefPtr<HTMLParamElement> create(const QualifiedName&, Document*);
 
     String name() const { return m_name; }
-    void setName(const String&);
-
-    String type() const;
-    void setType(const String&);
-
     String value() const { return m_value; }
-    void setValue(const String&);
-
-    String valueType() const;
-    void setValueType(const String&);
 
 private:
     HTMLParamElement(const QualifiedName&, Document*);
diff --git a/WebCore/html/HTMLPlugInElement.cpp b/WebCore/html/HTMLPlugInElement.cpp
index 18b1c6a..ffc6b64 100644
--- a/WebCore/html/HTMLPlugInElement.cpp
+++ b/WebCore/html/HTMLPlugInElement.cpp
@@ -24,6 +24,8 @@
 #include "HTMLPlugInElement.h"
 
 #include "Attribute.h"
+#include "Chrome.h"
+#include "ChromeClient.h"
 #include "CSSPropertyNames.h"
 #include "Document.h"
 #include "Frame.h"
@@ -31,6 +33,7 @@
 #include "FrameTree.h"
 #include "HTMLNames.h"
 #include "Page.h"
+#include "RenderEmbeddedObject.h"
 #include "RenderWidget.h"
 #include "ScriptController.h"
 #include "Settings.h"
@@ -88,26 +91,6 @@ PassScriptInstance HTMLPlugInElement::getInstance() const
     return m_instance;
 }
 
-String HTMLPlugInElement::height() const
-{
-    return getAttribute(heightAttr);
-}
-
-void HTMLPlugInElement::setHeight(const String& value)
-{
-    setAttribute(heightAttr, value);
-}
-
-String HTMLPlugInElement::width() const
-{
-    return getAttribute(widthAttr);
-}
-
-void HTMLPlugInElement::setWidth(const String& value)
-{
-    setAttribute(widthAttr, value);
-}
-
 bool HTMLPlugInElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
 {
     if (attrName == widthAttr ||
@@ -158,6 +141,18 @@ void HTMLPlugInElement::defaultEventHandler(Event* event)
     // FIXME: Mouse down and scroll events are passed down to plug-in via custom code in EventHandler; these code paths should be united.
 
     RenderObject* r = renderer();
+    if (r && r->isEmbeddedObject() && toRenderEmbeddedObject(r)->showsMissingPluginIndicator()) {
+        if (event->type() != eventNames().clickEvent)
+            return;
+
+        Page* page = document()->page();
+        if (!page)
+            return;
+
+        page->chrome()->client()->missingPluginButtonClicked(this);
+        return;
+    }
+
     if (!r || !r->isWidget())
         return;
     Widget* widget = toRenderWidget(r)->widget();
diff --git a/WebCore/html/HTMLPlugInElement.h b/WebCore/html/HTMLPlugInElement.h
index e9cd9d0..525dc40 100644
--- a/WebCore/html/HTMLPlugInElement.h
+++ b/WebCore/html/HTMLPlugInElement.h
@@ -38,12 +38,6 @@ class HTMLPlugInElement : public HTMLFrameOwnerElement {
 public:
     virtual ~HTMLPlugInElement();
 
-    String height() const;
-    void setHeight(const String&);
-    
-    String width() const;
-    void setWidth(const String&);
-
     PassScriptInstance getInstance() const;
 
 #if ENABLE(NETSCAPE_PLUGIN_API)
diff --git a/WebCore/html/HTMLPreElement.cpp b/WebCore/html/HTMLPreElement.cpp
index b13c801..fc67aca 100644
--- a/WebCore/html/HTMLPreElement.cpp
+++ b/WebCore/html/HTMLPreElement.cpp
@@ -65,24 +65,4 @@ void HTMLPreElement::parseMappedAttribute(Attribute* attr)
         return HTMLElement::parseMappedAttribute(attr);
 }
 
-int HTMLPreElement::width() const
-{
-    return getAttribute(widthAttr).toInt();
-}
-
-void HTMLPreElement::setWidth(int width)
-{
-    setAttribute(widthAttr, String::number(width));
-}
-
-bool HTMLPreElement::wrap() const
-{
-    return !getAttribute(wrapAttr).isNull();
-}
-
-void HTMLPreElement::setWrap(bool wrap)
-{
-    setAttribute(wrapAttr, wrap ? "" : 0);
-}
-
 }
diff --git a/WebCore/html/HTMLPreElement.h b/WebCore/html/HTMLPreElement.h
index 0975c0f..1a67c65 100644
--- a/WebCore/html/HTMLPreElement.h
+++ b/WebCore/html/HTMLPreElement.h
@@ -31,12 +31,6 @@ class HTMLPreElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLPreElement> create(const QualifiedName&, Document*);
 
-    int width() const;
-    void setWidth(int);
-
-    bool wrap() const;
-    void setWrap(bool);
-
 private:
     HTMLPreElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLQuoteElement.cpp b/WebCore/html/HTMLQuoteElement.cpp
index 2d0013a..2a2440a 100644
--- a/WebCore/html/HTMLQuoteElement.cpp
+++ b/WebCore/html/HTMLQuoteElement.cpp
@@ -48,14 +48,4 @@ void HTMLQuoteElement::insertedIntoDocument()
     HTMLElement::insertedIntoDocument();
 }
 
-String HTMLQuoteElement::cite() const
-{
-    return getAttribute(citeAttr);
-}
-
-void HTMLQuoteElement::setCite(const String &value)
-{
-    setAttribute(citeAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLQuoteElement.h b/WebCore/html/HTMLQuoteElement.h
index fa21d2d..df47e73 100644
--- a/WebCore/html/HTMLQuoteElement.h
+++ b/WebCore/html/HTMLQuoteElement.h
@@ -34,9 +34,6 @@ class HTMLQuoteElement : public HTMLElement {
 public:
     static PassRefPtr<HTMLQuoteElement> create(const QualifiedName&, Document*);
 
-    String cite() const;
-    void setCite(const String&);
-
 private:
     HTMLQuoteElement(const QualifiedName&, Document*);
     
diff --git a/WebCore/html/HTMLScriptElement.cpp b/WebCore/html/HTMLScriptElement.cpp
index 48da4b9..9e776e6 100644
--- a/WebCore/html/HTMLScriptElement.cpp
+++ b/WebCore/html/HTMLScriptElement.cpp
@@ -74,6 +74,8 @@ void HTMLScriptElement::parseMappedAttribute(Attribute* attr)
         setAttributeEventListener(eventNames().loadEvent, createAttributeEventListener(this, attr));
     else if (attrName == onbeforeloadAttr)
         setAttributeEventListener(eventNames().beforeloadEvent, createAttributeEventListener(this, attr));
+    else if (attrName == onbeforeprocessAttr)
+        setAttributeEventListener(eventNames().beforeprocessEvent, createAttributeEventListener(this, attr));
     else
         HTMLElement::parseMappedAttribute(attr);
 }
@@ -117,78 +119,11 @@ void HTMLScriptElement::setText(const String &value)
     appendChild(document()->createTextNode(value.impl()), ec);
 }
 
-String HTMLScriptElement::htmlFor() const
-{
-    // DOM Level 1 says: reserved for future use.
-    return String();
-}
-
-void HTMLScriptElement::setHtmlFor(const String&)
-{
-    // DOM Level 1 says: reserved for future use.
-}
-
-String HTMLScriptElement::event() const
-{
-    // DOM Level 1 says: reserved for future use.
-    return String();
-}
-
-void HTMLScriptElement::setEvent(const String&)
-{
-    // DOM Level 1 says: reserved for future use.
-}
-
-String HTMLScriptElement::charset() const
-{
-    return charsetAttributeValue();
-}
-
-void HTMLScriptElement::setCharset(const String &value)
-{
-    setAttribute(charsetAttr, value);
-}
-
-bool HTMLScriptElement::async() const
-{
-    return asyncAttributeValue();
-}
-
-void HTMLScriptElement::setAsync(bool async)
-{
-    setAttribute(asyncAttr, async ? "" : 0);
-}
-
-bool HTMLScriptElement::defer() const
-{
-    return deferAttributeValue();
-}
-
-void HTMLScriptElement::setDefer(bool defer)
-{
-    setAttribute(deferAttr, defer ? "" : 0);
-}
-
 KURL HTMLScriptElement::src() const
 {
     return document()->completeURL(sourceAttributeValue());
 }
 
-void HTMLScriptElement::setSrc(const String &value)
-{
-    setAttribute(srcAttr, value);
-}
-
-String HTMLScriptElement::type() const
-{
-    return typeAttributeValue();
-}
-
-void HTMLScriptElement::setType(const String &value)
-{
-    setAttribute(typeAttr, value);
-}
-
 String HTMLScriptElement::scriptCharset() const
 {
     return m_data.scriptCharset();
diff --git a/WebCore/html/HTMLScriptElement.h b/WebCore/html/HTMLScriptElement.h
index 3c8e8ce..b18278d 100644
--- a/WebCore/html/HTMLScriptElement.h
+++ b/WebCore/html/HTMLScriptElement.h
@@ -38,26 +38,7 @@ public:
     String text() const;
     void setText(const String&);
 
-    String htmlFor() const;
-    void setHtmlFor(const String&);
-
-    String event() const;
-    void setEvent(const String&);
-
-    String charset() const;
-    void setCharset(const String&);
-
-    bool async() const;
-    void setAsync(bool);
-
-    bool defer() const;
-    void setDefer(bool);
-
     KURL src() const;
-    void setSrc(const String&);
-
-    String type() const;
-    void setType(const String&);
 
     virtual String scriptCharset() const;
     
diff --git a/WebCore/html/HTMLScriptRunner.cpp b/WebCore/html/HTMLScriptRunner.cpp
index ab35449..29790c0 100644
--- a/WebCore/html/HTMLScriptRunner.cpp
+++ b/WebCore/html/HTMLScriptRunner.cpp
@@ -74,7 +74,7 @@ HTMLScriptRunner::HTMLScriptRunner(Document* document, HTMLScriptRunnerHost* hos
 HTMLScriptRunner::~HTMLScriptRunner()
 {
     // FIXME: Should we be passed a "done loading/parsing" callback sooner than destruction?
-    if (m_parsingBlockingScript.cachedScript && m_parsingBlockingScript.watchingForLoad())
+    if (m_parsingBlockingScript.cachedScript() && m_parsingBlockingScript.watchingForLoad())
         stopWatchingForLoad(m_parsingBlockingScript);
 }
 
@@ -99,10 +99,10 @@ inline PassRefPtr<Event> createScriptErrorEvent()
 
 ScriptSourceCode HTMLScriptRunner::sourceFromPendingScript(const PendingScript& script, bool& errorOccurred)
 {
-    if (script.cachedScript) {
-        errorOccurred = script.cachedScript->errorOccurred();
-        ASSERT(script.cachedScript->isLoaded());
-        return ScriptSourceCode(script.cachedScript.get());
+    if (script.cachedScript()) {
+        errorOccurred = script.cachedScript()->errorOccurred();
+        ASSERT(script.cachedScript()->isLoaded());
+        return ScriptSourceCode(script.cachedScript());
     }
     errorOccurred = false;
     return ScriptSourceCode(script.element->textContent(), documentURLForScriptExecution(m_document), script.startingLineNumber);
@@ -113,7 +113,7 @@ bool HTMLScriptRunner::isPendingScriptReady(const PendingScript& script)
     m_hasScriptsWaitingForStylesheets = !m_document->haveStylesheetsLoaded();
     if (m_hasScriptsWaitingForStylesheets)
         return false;
-    if (script.cachedScript && !script.cachedScript->isLoaded())
+    if (script.cachedScript() && !script.cachedScript()->isLoaded())
         return false;
     return true;
 }
@@ -127,12 +127,11 @@ void HTMLScriptRunner::executePendingScript()
     ScriptSourceCode sourceCode = sourceFromPendingScript(m_parsingBlockingScript, errorOccurred);
 
     // Stop watching loads before executeScript to prevent recursion if the script reloads itself.
-    if (m_parsingBlockingScript.cachedScript && m_parsingBlockingScript.watchingForLoad())
+    if (m_parsingBlockingScript.cachedScript() && m_parsingBlockingScript.watchingForLoad())
         stopWatchingForLoad(m_parsingBlockingScript);
 
     // Clear the pending script before possible rentrancy from executeScript()
-    RefPtr<Element> scriptElement = m_parsingBlockingScript.element.release();
-    m_parsingBlockingScript = PendingScript();
+    RefPtr<Element> scriptElement = m_parsingBlockingScript.releaseElementAndClear();
     {
         NestScript nestingLevel(m_scriptNestingLevel, m_host->inputStream());
         if (errorOccurred)
@@ -161,30 +160,18 @@ void HTMLScriptRunner::executeScript(Element* element, const ScriptSourceCode& s
     m_document->frame()->script()->executeScript(sourceCode);
 }
 
-bool HTMLScriptRunner::hasScriptsWaitingForLoad() const
-{
-    // We're only actually waiting for a load.  This allows us to ignore load
-    // callbacks when CachedResource::addClient calls notifyFinished because
-    // of a cache hit (not because of a load we were set up to wait for).
-    return m_parsingBlockingScript.watchingForLoadState == PendingScript::WatchingForLoad;
-}
-
 void HTMLScriptRunner::watchForLoad(PendingScript& pendingScript)
 {
     ASSERT(!pendingScript.watchingForLoad());
-    // CachedResource::addClient will call notifyFinished if the load is already
-    // complete.  We set watchingForLoadState to RegisteringForWatch so that we
-    // know to ignore any notifyFinished call during addClient.
-    pendingScript.watchingForLoadState = PendingScript::RegisteringForWatch;
-    m_host->watchForLoad(pendingScript.cachedScript.get());
-    pendingScript.watchingForLoadState = PendingScript::WatchingForLoad;
+    m_host->watchForLoad(pendingScript.cachedScript());
+    pendingScript.setWatchingForLoad(true);
 }
 
 void HTMLScriptRunner::stopWatchingForLoad(PendingScript& pendingScript)
 {
     ASSERT(pendingScript.watchingForLoad());
-    m_host->stopWatchingForLoad(pendingScript.cachedScript.get());
-    pendingScript.watchingForLoadState = PendingScript::NotWatchingForLoad;
+    m_host->stopWatchingForLoad(pendingScript.cachedScript());
+    pendingScript.setWatchingForLoad(false);
 }
 
 // This function should match 10.2.5.11 "An end tag whose tag name is 'script'"
@@ -224,14 +211,10 @@ bool HTMLScriptRunner::executeParsingBlockingScripts()
 
 bool HTMLScriptRunner::executeScriptsWaitingForLoad(CachedResource* cachedScript)
 {
-    // Callers should check hasScriptsWaitingForLoad() before calling
-    // to prevent parser or script re-entry during due to
-    // CachedResource::addClient calling notifyFinished on cache-hits.
-    ASSERT(hasScriptsWaitingForLoad());
     ASSERT(!m_scriptNestingLevel);
     ASSERT(haveParsingBlockingScript());
-    ASSERT_UNUSED(cachedScript, m_parsingBlockingScript.cachedScript == cachedScript);
-    ASSERT(m_parsingBlockingScript.cachedScript->isLoaded());
+    ASSERT_UNUSED(cachedScript, m_parsingBlockingScript.cachedScript() == cachedScript);
+    ASSERT(m_parsingBlockingScript.cachedScript()->isLoaded());
     return executeParsingBlockingScripts();
 }
 
@@ -262,16 +245,14 @@ void HTMLScriptRunner::requestScript(Element* script)
         notImplemented(); // Dispatch error event.
         return;
     }
-    m_parsingBlockingScript.cachedScript = cachedScript;
-
-    // Always call watchForLoad, even if the script is already loaded.
-    // CachedResource may purge its data if it has no clients, which would cause
-    // later script execution to fail.  watchForLoad sets m_parsingBlockingScript
-    // to the RegisteringForWatch state so we know to ignore any
-    // executeScriptsWaitingForLoad callbacks during the watchForLoad call.
-    watchForLoad(m_parsingBlockingScript);
-    // Callers will attempt to run the m_parsingBlockingScript if possible
-    // before returning control to the parser.
+
+    m_parsingBlockingScript.setCachedScript(cachedScript);
+
+    // We only care about a load callback if cachedScript is not already
+    // in the cache.  Callers will attempt to run the m_parsingBlockingScript
+    // if possible before returning control to the parser.
+    if (!m_parsingBlockingScript.cachedScript()->isLoaded())
+        watchForLoad(m_parsingBlockingScript);
 }
 
 // This method is meant to match the HTML5 definition of "running a script"
@@ -297,4 +278,34 @@ void HTMLScriptRunner::runScript(Element* script, int startingLineNumber)
     }
 }
 
+HTMLScriptRunner::PendingScript::~PendingScript()
+{
+    if (m_cachedScript)
+        m_cachedScript->removeClient(this);
+}
+
+PassRefPtr<Element> HTMLScriptRunner::PendingScript::releaseElementAndClear()
+{
+    setCachedScript(0);
+    startingLineNumber = 0;
+    m_watchingForLoad = false;
+    return element.release();
+}
+
+void HTMLScriptRunner::PendingScript::setCachedScript(CachedScript* cachedScript)
+{
+    if (m_cachedScript == cachedScript)
+        return;
+    if (m_cachedScript)
+        m_cachedScript->removeClient(this);
+    m_cachedScript = cachedScript;
+    if (m_cachedScript)
+        m_cachedScript->addClient(this);
+}
+
+CachedScript* HTMLScriptRunner::PendingScript::cachedScript() const
+{
+    return m_cachedScript.get();
+}
+
 }
diff --git a/WebCore/html/HTMLScriptRunner.h b/WebCore/html/HTMLScriptRunner.h
index 7260007..f93ae10 100644
--- a/WebCore/html/HTMLScriptRunner.h
+++ b/WebCore/html/HTMLScriptRunner.h
@@ -49,42 +49,50 @@ public:
     // Processes the passed in script and any pending scripts if possible.
     bool execute(PassRefPtr<Element> scriptToProcess, int scriptStartLine);
 
-    bool hasScriptsWaitingForLoad() const;
     bool executeScriptsWaitingForLoad(CachedResource*);
-
     bool hasScriptsWaitingForStylesheets() const { return m_hasScriptsWaitingForStylesheets; }
     bool executeScriptsWaitingForStylesheets();
 
     bool inScriptExecution() { return !!m_scriptNestingLevel; }
 
 private:
-    struct PendingScript {
-        // This state controls whether we need to do anything with this script
-        // when we get a executeScriptsWaitingForLoad callback.
-        // We ignore callbacks during RegisteringForWatch.
-        enum WatchingForLoadState {
-            NotWatchingForLoad,
-            RegisteringForWatch,
-            WatchingForLoad,
-        };
-
+    // A container for an external script which may be loaded and executed.
+    //
+    // A CachedResourceHandle alone does not prevent the underlying CachedResource
+    // from purging its data buffer. This class holds a dummy client open for its
+    // lifetime in order to guarantee that the data buffer will not be purged.
+    //
+    // FIXME: Finish turning this into a proper class.
+    class PendingScript : public CachedResourceClient, Noncopyable {
+    public:
         PendingScript()
-            : watchingForLoadState(NotWatchingForLoad)
-            , startingLineNumber(0)
+            : startingLineNumber(0)
+            , m_watchingForLoad(false)
         {
         }
 
-        bool watchingForLoad()
+        ~PendingScript();
+
+        PassRefPtr<Element> releaseElementAndClear();
+
+        bool watchingForLoad() const { return m_watchingForLoad; }
+        void setWatchingForLoad(bool b) { m_watchingForLoad = b; }
+
+        CachedScript* cachedScript() const;
+        void setCachedScript(CachedScript*);
+
+        virtual void notifyFinished(CachedResource*)
         {
-            return watchingForLoadState != NotWatchingForLoad;
         }
 
         RefPtr<Element> element;
-        CachedResourceHandle<CachedScript> cachedScript;
-        WatchingForLoadState watchingForLoadState;
         int startingLineNumber; // Only used for inline script tags.
         // HTML5 has an isReady parameter, however isReady ends up equivalent to
         // m_document->haveStylesheetsLoaded() && cachedScript->isLoaded()
+
+    private:
+        bool m_watchingForLoad;
+        CachedResourceHandle<CachedScript> m_cachedScript;
     };
 
     Frame* frame() const;
diff --git a/WebCore/html/HTMLScriptRunnerHost.h b/WebCore/html/HTMLScriptRunnerHost.h
index 82ad70d..a129520 100644
--- a/WebCore/html/HTMLScriptRunnerHost.h
+++ b/WebCore/html/HTMLScriptRunnerHost.h
@@ -38,7 +38,7 @@ class HTMLScriptRunnerHost {
 public:
     virtual ~HTMLScriptRunnerHost() { }
 
-    // Implementors must call cachedResource->addClient() immediately.
+    // Implementors should call cachedResource->addClient() here or soon after.
     virtual void watchForLoad(CachedResource*) = 0;
     // Implementors must call cachedResource->removeClient() immediately.
     virtual void stopWatchingForLoad(CachedResource*) = 0;
diff --git a/WebCore/html/HTMLSelectElement.cpp b/WebCore/html/HTMLSelectElement.cpp
index 2dcac59..6ddcc2d 100644
--- a/WebCore/html/HTMLSelectElement.cpp
+++ b/WebCore/html/HTMLSelectElement.cpp
@@ -329,7 +329,7 @@ void HTMLSelectElement::dispatchBlurEvent()
 
 void HTMLSelectElement::defaultEventHandler(Event* event)
 {
-    SelectElement::defaultEventHandler(m_data, this, event);
+    SelectElement::defaultEventHandler(m_data, this, event, form());
     if (event->defaultHandled())
         return;
     HTMLFormControlElementWithState::defaultEventHandler(event);
diff --git a/WebCore/html/HTMLSelectElement.idl b/WebCore/html/HTMLSelectElement.idl
index 3303272..2e53bca 100644
--- a/WebCore/html/HTMLSelectElement.idl
+++ b/WebCore/html/HTMLSelectElement.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Computer, Inc.
+ * Copyright (C) 2006, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Samuel Weinig <sam.weinig@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
@@ -24,51 +24,48 @@ module html {
         HasIndexGetter,
         HasCustomIndexSetter
     ] HTMLSelectElement : HTMLElement {
-
-        readonly attribute DOMString       type;
-                 attribute long            selectedIndex;
-                 attribute [ConvertNullToNullString] DOMString       value;
+        readonly attribute DOMString type;
+        attribute long selectedIndex;
+        attribute [ConvertNullToNullString] DOMString value;
         
         // Modified in DOM Level 2:
 #if defined(LANGUAGE_OBJECTIVE_C) && LANGUAGE_OBJECTIVE_C
-        readonly attribute long            length;
+        readonly attribute long length;
 #else
-                 attribute unsigned long   length
-                    setter raises (DOMException);
+        attribute unsigned long length setter raises (DOMException);
 #endif
 
         readonly attribute HTMLFormElement form;
-        readonly attribute ValidityState   validity;
-        readonly attribute boolean         willValidate;
-        readonly attribute DOMString       validationMessage;
-        boolean            checkValidity();
-        void               setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
+        readonly attribute ValidityState validity;
+        readonly attribute boolean willValidate;
+        readonly attribute DOMString validationMessage;
+        boolean checkValidity();
+        void setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
 
         // Modified in DOM Level 2:
         readonly attribute HTMLOptionsCollection options;
 
-                 attribute boolean         disabled;
-                 attribute boolean         autofocus;
-                 attribute boolean         multiple;
-                 attribute [ConvertNullToNullString] DOMString       name;
-                 attribute long            size;
+        attribute [Reflect] boolean disabled;
+        attribute [Reflect] boolean autofocus;
+        attribute boolean multiple;
+        attribute [ConvertNullToNullString] DOMString name;
+        attribute long size;
         
-        [OldStyleObjC] void add(in HTMLElement element, 
-                               in HTMLElement before)
-            raises(DOMException);
+        [OldStyleObjC] void add(in HTMLElement element, in HTMLElement before) raises(DOMException);
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
-        // In JS, we support both options index and options object parameters - this cannot be autogenerated now.
-        [Custom] void      remove(/* 1 */);
+        // In JavaScript, we support both option index and option object parameters.
+        // As of this writing this cannot be auto-generated.
+        [Custom] void remove(/* indexOrOption */);
 #else
-        void               remove(in long index);
+        void remove(in long index);
 #endif
 
         // These methods are not in DOM Level 2 IDL, but are mentioned in the standard:
         // "The contained options can be directly accessed through the select element as a collection."
         Node item(in [IsIndex] unsigned long index);
         Node namedItem(in DOMString name);
-        readonly attribute NodeList        labels;
+        readonly attribute NodeList labels;
     };
 
 }
diff --git a/WebCore/html/HTMLStyleElement.cpp b/WebCore/html/HTMLStyleElement.cpp
index a8ea42e..79bafe6 100644
--- a/WebCore/html/HTMLStyleElement.cpp
+++ b/WebCore/html/HTMLStyleElement.cpp
@@ -27,6 +27,7 @@
 #include "Attribute.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "ScriptEventListener.h"
 
 namespace WebCore {
 
@@ -45,14 +46,13 @@ PassRefPtr<HTMLStyleElement> HTMLStyleElement::create(const QualifiedName& tagNa
     return adoptRef(new HTMLStyleElement(tagName, document, createdByParser));
 }
 
-// other stuff...
 void HTMLStyleElement::parseMappedAttribute(Attribute* attr)
 {
-    if (attr->name() == mediaAttr)
-        m_media = attr->value().string().lower();
-    else if (attr->name() == titleAttr && m_sheet)
+    if (attr->name() == titleAttr && m_sheet)
         m_sheet->setTitle(attr->value());
-     else
+    else if (attr->name() == onbeforeprocessAttr)
+        setAttributeEventListener(eventNames().beforeprocessEvent, createAttributeEventListener(this, attr));
+    else
         HTMLElement::parseMappedAttribute(attr);
 }
 
@@ -110,36 +110,16 @@ bool HTMLStyleElement::sheetLoaded()
     return false;
 }
 
-bool HTMLStyleElement::disabled() const
-{
-    return !getAttribute(disabledAttr).isNull();
-}
-
-void HTMLStyleElement::setDisabled(bool disabled)
-{
-    setAttribute(disabledAttr, disabled ? "" : 0);
-}
-
 const AtomicString& HTMLStyleElement::media() const
 {
     return getAttribute(mediaAttr);
 }
 
-void HTMLStyleElement::setMedia(const AtomicString &value)
-{
-    setAttribute(mediaAttr, value);
-}
-
 const AtomicString& HTMLStyleElement::type() const
 {
     return getAttribute(typeAttr);
 }
 
-void HTMLStyleElement::setType(const AtomicString &value)
-{
-    setAttribute(typeAttr, value);
-}
-
 void HTMLStyleElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {    
     HTMLElement::addSubresourceAttributeURLs(urls);
diff --git a/WebCore/html/HTMLStyleElement.h b/WebCore/html/HTMLStyleElement.h
index 58dce14..0f8a83b 100644
--- a/WebCore/html/HTMLStyleElement.h
+++ b/WebCore/html/HTMLStyleElement.h
@@ -19,6 +19,7 @@
  * Boston, MA 02110-1301, USA.
  *
  */
+
 #ifndef HTMLStyleElement_h
 #define HTMLStyleElement_h
 
@@ -29,17 +30,10 @@ namespace WebCore {
 
 class StyleSheet;
 
-class HTMLStyleElement : public HTMLElement, public StyleElement {
+class HTMLStyleElement : public HTMLElement, private StyleElement {
 public:
     static PassRefPtr<HTMLStyleElement> create(const QualifiedName&, Document*, bool createdByParser);
 
-    bool disabled() const;
-    void setDisabled(bool);
-
-    virtual const AtomicString& media() const;
-    void setMedia(const AtomicString&);
-
-    virtual const AtomicString& type() const;
     void setType(const AtomicString&);
 
     StyleSheet* sheet();
@@ -66,7 +60,9 @@ private:
 
     virtual void addSubresourceAttributeURLs(ListHashSet<KURL>&) const;
 
-    String m_media;
+    virtual const AtomicString& media() const;
+    virtual const AtomicString& type() const;
+
     bool m_loading;
     bool m_createdByParser;
 };
diff --git a/WebCore/html/HTMLStyleElement.idl b/WebCore/html/HTMLStyleElement.idl
index c98629c..29a8924 100644
--- a/WebCore/html/HTMLStyleElement.idl
+++ b/WebCore/html/HTMLStyleElement.idl
@@ -21,7 +21,7 @@
 module html {
 
     interface HTMLStyleElement : HTMLElement {
-        attribute boolean disabled;
+        attribute [Reflect] boolean disabled;
         attribute [Reflect] DOMString media;
         attribute [Reflect] DOMString type;
 
diff --git a/WebCore/html/HTMLTableCaptionElement.cpp b/WebCore/html/HTMLTableCaptionElement.cpp
index 40f2ab6..b726df6 100644
--- a/WebCore/html/HTMLTableCaptionElement.cpp
+++ b/WebCore/html/HTMLTableCaptionElement.cpp
@@ -63,14 +63,4 @@ void HTMLTableCaptionElement::parseMappedAttribute(Attribute* attr)
         HTMLElement::parseMappedAttribute(attr);
 }
 
-String HTMLTableCaptionElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLTableCaptionElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLTableCaptionElement.h b/WebCore/html/HTMLTableCaptionElement.h
index e97b03f..d19c7ce 100644
--- a/WebCore/html/HTMLTableCaptionElement.h
+++ b/WebCore/html/HTMLTableCaptionElement.h
@@ -34,9 +34,6 @@ class HTMLTableCaptionElement : public HTMLTablePartElement {
 public:
     static PassRefPtr<HTMLTableCaptionElement> create(const QualifiedName&, Document*);
 
-    String align() const;
-    void setAlign(const String&);
-
 private:
     HTMLTableCaptionElement(const QualifiedName&, Document*);
     
diff --git a/WebCore/html/HTMLTableCellElement.cpp b/WebCore/html/HTMLTableCellElement.cpp
index e102d0b..d90b125 100644
--- a/WebCore/html/HTMLTableCellElement.cpp
+++ b/WebCore/html/HTMLTableCellElement.cpp
@@ -141,61 +141,11 @@ String HTMLTableCellElement::abbr() const
     return getAttribute(abbrAttr);
 }
 
-void HTMLTableCellElement::setAbbr(const String &value)
-{
-    setAttribute(abbrAttr, value);
-}
-
-String HTMLTableCellElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLTableCellElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
 String HTMLTableCellElement::axis() const
 {
     return getAttribute(axisAttr);
 }
 
-void HTMLTableCellElement::setAxis(const String &value)
-{
-    setAttribute(axisAttr, value);
-}
-
-String HTMLTableCellElement::bgColor() const
-{
-    return getAttribute(bgcolorAttr);
-}
-
-void HTMLTableCellElement::setBgColor(const String &value)
-{
-    setAttribute(bgcolorAttr, value);
-}
-
-String HTMLTableCellElement::ch() const
-{
-    return getAttribute(charAttr);
-}
-
-void HTMLTableCellElement::setCh(const String &value)
-{
-    setAttribute(charAttr, value);
-}
-
-String HTMLTableCellElement::chOff() const
-{
-    return getAttribute(charoffAttr);
-}
-
-void HTMLTableCellElement::setChOff(const String &value)
-{
-    setAttribute(charoffAttr, value);
-}
-
 void HTMLTableCellElement::setColSpan(int n)
 {
     setAttribute(colspanAttr, String::number(n));
@@ -206,31 +156,6 @@ String HTMLTableCellElement::headers() const
     return getAttribute(headersAttr);
 }
 
-void HTMLTableCellElement::setHeaders(const String &value)
-{
-    setAttribute(headersAttr, value);
-}
-
-String HTMLTableCellElement::height() const
-{
-    return getAttribute(heightAttr);
-}
-
-void HTMLTableCellElement::setHeight(const String &value)
-{
-    setAttribute(heightAttr, value);
-}
-
-bool HTMLTableCellElement::noWrap() const
-{
-    return !getAttribute(nowrapAttr).isNull();
-}
-
-void HTMLTableCellElement::setNoWrap(bool b)
-{
-    setAttribute(nowrapAttr, b ? "" : 0);
-}
-
 void HTMLTableCellElement::setRowSpan(int n)
 {
     setAttribute(rowspanAttr, String::number(n));
@@ -241,31 +166,6 @@ String HTMLTableCellElement::scope() const
     return getAttribute(scopeAttr);
 }
 
-void HTMLTableCellElement::setScope(const String &value)
-{
-    setAttribute(scopeAttr, value);
-}
-
-String HTMLTableCellElement::vAlign() const
-{
-    return getAttribute(valignAttr);
-}
-
-void HTMLTableCellElement::setVAlign(const String &value)
-{
-    setAttribute(valignAttr, value);
-}
-
-String HTMLTableCellElement::width() const
-{
-    return getAttribute(widthAttr);
-}
-
-void HTMLTableCellElement::setWidth(const String &value)
-{
-    setAttribute(widthAttr, value);
-}
-
 void HTMLTableCellElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLTablePartElement::addSubresourceAttributeURLs(urls);
diff --git a/WebCore/html/HTMLTableCellElement.h b/WebCore/html/HTMLTableCellElement.h
index 6a514ec..a70bdcd 100644
--- a/WebCore/html/HTMLTableCellElement.h
+++ b/WebCore/html/HTMLTableCellElement.h
@@ -47,44 +47,11 @@ public:
     void setCellIndex(int);
 
     String abbr() const;
-    void setAbbr(const String&);
-
-    String align() const;
-    void setAlign(const String&);
-
     String axis() const;
-    void setAxis(const String&);
-
-    String bgColor() const;
-    void setBgColor(const String&);
-
-    String ch() const;
-    void setCh(const String&);
-
-    String chOff() const;
-    void setChOff(const String&);
-
     void setColSpan(int);
-
     String headers() const;
-    void setHeaders(const String&);
-
-    String height() const;
-    void setHeight(const String&);
-
-    bool noWrap() const;
-    void setNoWrap(bool);
-
     void setRowSpan(int);
-
     String scope() const;
-    void setScope(const String&);
-
-    String vAlign() const;
-    void setVAlign(const String&);
-
-    String width() const;
-    void setWidth(const String&);
 
 private:
     HTMLTableCellElement(const QualifiedName&, Document*);
diff --git a/WebCore/html/HTMLTableCellElement.idl b/WebCore/html/HTMLTableCellElement.idl
index 037581f..ae286f4 100644
--- a/WebCore/html/HTMLTableCellElement.idl
+++ b/WebCore/html/HTMLTableCellElement.idl
@@ -31,7 +31,7 @@ module html {
         attribute long colSpan;
         attribute [Reflect] DOMString headers;
         attribute [Reflect] DOMString height;
-        attribute boolean noWrap;
+        attribute [Reflect] boolean noWrap;
         attribute long rowSpan;
         attribute [Reflect] DOMString scope;
         attribute [Reflect] DOMString vAlign;
diff --git a/WebCore/html/HTMLTableColElement.cpp b/WebCore/html/HTMLTableColElement.cpp
index 5269aaa..6c2f1fe 100644
--- a/WebCore/html/HTMLTableColElement.cpp
+++ b/WebCore/html/HTMLTableColElement.cpp
@@ -110,59 +110,14 @@ void HTMLTableColElement::additionalAttributeStyleDecls(Vector<CSSMutableStyleDe
     static_cast<HTMLTableElement*>(p)->addSharedGroupDecls(false, results);
 }
 
-String HTMLTableColElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLTableColElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
-String HTMLTableColElement::ch() const
-{
-    return getAttribute(charAttr);
-}
-
-void HTMLTableColElement::setCh(const String &value)
-{
-    setAttribute(charAttr, value);
-}
-
-String HTMLTableColElement::chOff() const
-{
-    return getAttribute(charoffAttr);
-}
-
-void HTMLTableColElement::setChOff(const String &value)
-{
-    setAttribute(charoffAttr, value);
-}
-
 void HTMLTableColElement::setSpan(int n)
 {
     setAttribute(spanAttr, String::number(n));
 }
 
-String HTMLTableColElement::vAlign() const
-{
-    return getAttribute(valignAttr);
-}
-
-void HTMLTableColElement::setVAlign(const String &value)
-{
-    setAttribute(valignAttr, value);
-}
-
 String HTMLTableColElement::width() const
 {
     return getAttribute(widthAttr);
 }
 
-void HTMLTableColElement::setWidth(const String &value)
-{
-    setAttribute(widthAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLTableColElement.h b/WebCore/html/HTMLTableColElement.h
index 07b0ae8..4a219c1 100644
--- a/WebCore/html/HTMLTableColElement.h
+++ b/WebCore/html/HTMLTableColElement.h
@@ -35,23 +35,9 @@ public:
     static PassRefPtr<HTMLTableColElement> create(const QualifiedName& tagName, Document*);
 
     int span() const { return m_span; }
-
-    String align() const;
-    void setAlign(const String&);
-
-    String ch() const;
-    void setCh(const String&);
-
-    String chOff() const;
-    void setChOff(const String&);
-
     void setSpan(int);
 
-    String vAlign() const;
-    void setVAlign(const String&);
-
     String width() const;
-    void setWidth(const String&);
 
 private:
     HTMLTableColElement(const QualifiedName& tagName, Document*);
diff --git a/WebCore/html/HTMLTableElement.cpp b/WebCore/html/HTMLTableElement.cpp
index 0cb33e1..56cb32a 100644
--- a/WebCore/html/HTMLTableElement.cpp
+++ b/WebCore/html/HTMLTableElement.cpp
@@ -251,18 +251,18 @@ void HTMLTableElement::deleteRow(int index, ExceptionCode& ec)
     row->remove(ec);
 }
 
-ContainerNode* HTMLTableElement::addChild(PassRefPtr<Node> child)
+ContainerNode* HTMLTableElement::legacyParserAddChild(PassRefPtr<Node> child)
 {
     if (child->hasTagName(formTag)) {
         // First add the child.
-        HTMLElement::addChild(child);
+        HTMLElement::legacyParserAddChild(child);
 
         // Now simply return ourselves as the container to insert into.
         // This has the effect of demoting the form to a leaf and moving it safely out of the way.
         return this;
     }
 
-    return HTMLElement::addChild(child.get());
+    return HTMLElement::legacyParserAddChild(child.get());
 }
 
 bool HTMLTableElement::mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const
@@ -669,96 +669,16 @@ PassRefPtr<HTMLCollection> HTMLTableElement::tBodies()
     return HTMLCollection::create(this, TableTBodies);
 }
 
-String HTMLTableElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLTableElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
-String HTMLTableElement::bgColor() const
-{
-    return getAttribute(bgcolorAttr);
-}
-
-void HTMLTableElement::setBgColor(const String &value)
-{
-    setAttribute(bgcolorAttr, value);
-}
-
-String HTMLTableElement::border() const
-{
-    return getAttribute(borderAttr);
-}
-
-void HTMLTableElement::setBorder(const String &value)
-{
-    setAttribute(borderAttr, value);
-}
-
-String HTMLTableElement::cellPadding() const
-{
-    return getAttribute(cellpaddingAttr);
-}
-
-void HTMLTableElement::setCellPadding(const String &value)
-{
-    setAttribute(cellpaddingAttr, value);
-}
-
-String HTMLTableElement::cellSpacing() const
-{
-    return getAttribute(cellspacingAttr);
-}
-
-void HTMLTableElement::setCellSpacing(const String &value)
-{
-    setAttribute(cellspacingAttr, value);
-}
-
-String HTMLTableElement::frame() const
-{
-    return getAttribute(frameAttr);
-}
-
-void HTMLTableElement::setFrame(const String &value)
-{
-    setAttribute(frameAttr, value);
-}
-
 String HTMLTableElement::rules() const
 {
     return getAttribute(rulesAttr);
 }
 
-void HTMLTableElement::setRules(const String &value)
-{
-    setAttribute(rulesAttr, value);
-}
-
 String HTMLTableElement::summary() const
 {
     return getAttribute(summaryAttr);
 }
 
-void HTMLTableElement::setSummary(const String &value)
-{
-    setAttribute(summaryAttr, value);
-}
-
-String HTMLTableElement::width() const
-{
-    return getAttribute(widthAttr);
-}
-
-void HTMLTableElement::setWidth(const String &value)
-{
-    setAttribute(widthAttr, value);
-}
-
 void HTMLTableElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) const
 {
     HTMLElement::addSubresourceAttributeURLs(urls);
diff --git a/WebCore/html/HTMLTableElement.h b/WebCore/html/HTMLTableElement.h
index 0189ce4..c48fee5 100644
--- a/WebCore/html/HTMLTableElement.h
+++ b/WebCore/html/HTMLTableElement.h
@@ -60,34 +60,10 @@ public:
     PassRefPtr<HTMLCollection> rows();
     PassRefPtr<HTMLCollection> tBodies();
 
-    String align() const;
-    void setAlign(const String&);
-
-    String bgColor() const;
-    void setBgColor(const String&);
-
-    String border() const;
-    void setBorder(const String&);
-
-    String cellPadding() const;
-    void setCellPadding(const String&);
-
-    String cellSpacing() const;
-    void setCellSpacing(const String&);
-
-    String frame() const;
-    void setFrame(const String&);
-
     String rules() const;
-    void setRules(const String&);
-
     String summary() const;
-    void setSummary(const String&);
-
-    String width() const;
-    void setWidth(const String&);
 
-    virtual ContainerNode* addChild(PassRefPtr<Node>);
+    virtual ContainerNode* legacyParserAddChild(PassRefPtr<Node>);
 
     virtual void attach();
 
diff --git a/WebCore/html/HTMLTableRowElement.cpp b/WebCore/html/HTMLTableRowElement.cpp
index cba2d48..0bafb12 100644
--- a/WebCore/html/HTMLTableRowElement.cpp
+++ b/WebCore/html/HTMLTableRowElement.cpp
@@ -62,18 +62,18 @@ bool HTMLTableRowElement::checkDTD(const Node* newChild)
            newChild->hasTagName(formTag) || newChild->hasTagName(scriptTag);
 }
 
-ContainerNode* HTMLTableRowElement::addChild(PassRefPtr<Node> child)
+ContainerNode* HTMLTableRowElement::legacyParserAddChild(PassRefPtr<Node> child)
 {
     if (child->hasTagName(formTag)) {
         // First add the child.
-        HTMLTablePartElement::addChild(child);
+        HTMLTablePartElement::legacyParserAddChild(child);
 
         // Now simply return ourselves as the container to insert into.
         // This has the effect of demoting the form to a leaf and moving it safely out of the way.
         return this;
     }
 
-    return HTMLTablePartElement::addChild(child);
+    return HTMLTablePartElement::legacyParserAddChild(child);
 }
 
 int HTMLTableRowElement::rowIndex() const
@@ -181,59 +181,9 @@ PassRefPtr<HTMLCollection> HTMLTableRowElement::cells()
     return HTMLCollection::create(this, TRCells);
 }
 
-void HTMLTableRowElement::setCells(HTMLCollection *, ExceptionCode& ec)
+void HTMLTableRowElement::setCells(HTMLCollection*, ExceptionCode& ec)
 {
     ec = NO_MODIFICATION_ALLOWED_ERR;
 }
 
-String HTMLTableRowElement::align() const
-{
-    return getAttribute(alignAttr);
-}
-
-void HTMLTableRowElement::setAlign(const String &value)
-{
-    setAttribute(alignAttr, value);
-}
-
-String HTMLTableRowElement::bgColor() const
-{
-    return getAttribute(bgcolorAttr);
-}
-
-void HTMLTableRowElement::setBgColor(const String &value)
-{
-    setAttribute(bgcolorAttr, value);
-}
-
-String HTMLTableRowElement::ch() const
-{
-    return getAttribute(charAttr);
-}
-
-void HTMLTableRowElement::setCh(const String &value)
-{
-    setAttribute(charAttr, value);
-}
-
-String HTMLTableRowElement::chOff() const
-{
-    return getAttribute(charoffAttr);
-}
-
-void HTMLTableRowElement::setChOff(const String &value)
-{
-    setAttribute(charoffAttr, value);
-}
-
-String HTMLTableRowElement::vAlign() const
-{
-    return getAttribute(valignAttr);
-}
-
-void HTMLTableRowElement::setVAlign(const String &value)
-{
-    setAttribute(valignAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLTableRowElement.h b/WebCore/html/HTMLTableRowElement.h
index b47edc2..825d763 100644
--- a/WebCore/html/HTMLTableRowElement.h
+++ b/WebCore/html/HTMLTableRowElement.h
@@ -35,7 +35,7 @@ public:
     static PassRefPtr<HTMLTableRowElement> create(Document*);
     static PassRefPtr<HTMLTableRowElement> create(const QualifiedName&, Document*);
 
-    virtual ContainerNode* addChild(PassRefPtr<Node>);
+    virtual ContainerNode* legacyParserAddChild(PassRefPtr<Node>);
 
     int rowIndex() const;
     void setRowIndex(int);
@@ -49,21 +49,6 @@ public:
     PassRefPtr<HTMLCollection> cells();
     void setCells(HTMLCollection *, ExceptionCode&);
 
-    String align() const;
-    void setAlign(const String&);
-
-    String bgColor() const;
-    void setBgColor(const String&);
-
-    String ch() const;
-    void setCh(const String&);
-
-    String chOff() const;
-    void setChOff(const String&);
-
-    String vAlign() const;
-    void setVAlign(const String&);
-
 private:
     HTMLTableRowElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLTableSectionElement.cpp b/WebCore/html/HTMLTableSectionElement.cpp
index 122af8a..93bfef2 100644
--- a/WebCore/html/HTMLTableSectionElement.cpp
+++ b/WebCore/html/HTMLTableSectionElement.cpp
@@ -55,18 +55,18 @@ bool HTMLTableSectionElement::checkDTD(const Node* newChild)
            newChild->hasTagName(scriptTag);
 }
 
-ContainerNode* HTMLTableSectionElement::addChild(PassRefPtr<Node> child)
+ContainerNode* HTMLTableSectionElement::legacyParserAddChild(PassRefPtr<Node> child)
 {
     if (child->hasTagName(formTag)) {
         // First add the child.
-        HTMLTablePartElement::addChild(child);
+        HTMLTablePartElement::legacyParserAddChild(child);
 
         // Now simply return ourselves as the container to insert into.
         // This has the effect of demoting the form to a leaf and moving it safely out of the way.
         return this;
     }
 
-    return HTMLTablePartElement::addChild(child);
+    return HTMLTablePartElement::legacyParserAddChild(child);
 }
 
 // used by table row groups to share style decls created by the enclosing table.
diff --git a/WebCore/html/HTMLTableSectionElement.h b/WebCore/html/HTMLTableSectionElement.h
index f7c1d8a..3e356da 100644
--- a/WebCore/html/HTMLTableSectionElement.h
+++ b/WebCore/html/HTMLTableSectionElement.h
@@ -34,7 +34,7 @@ class HTMLTableSectionElement : public HTMLTablePartElement {
 public:
     static PassRefPtr<HTMLTableSectionElement> create(const QualifiedName&, Document*);
 
-    virtual ContainerNode* addChild(PassRefPtr<Node>);
+    virtual ContainerNode* legacyParserAddChild(PassRefPtr<Node>);
 
     PassRefPtr<HTMLElement> insertRow(int index, ExceptionCode&);
     void deleteRow(int index, ExceptionCode&);
diff --git a/WebCore/html/HTMLTagNames.in b/WebCore/html/HTMLTagNames.in
index 8e67cba..9c66a95 100644
--- a/WebCore/html/HTMLTagNames.in
+++ b/WebCore/html/HTMLTagNames.in
@@ -74,6 +74,7 @@ li interfaceName=HTMLLIElement
 link constructorNeedsCreatedByParser
 listing interfaceName=HTMLPreElement
 map
+mark interfaceName=HTMLElement
 marquee
 menu
 meta
@@ -131,3 +132,4 @@ noscript interfaceName=HTMLNoScriptElement
 #else
 noscript interfaceName=HTMLElement
 #endif
+
diff --git a/WebCore/html/HTMLTextAreaElement.cpp b/WebCore/html/HTMLTextAreaElement.cpp
index 47acc54..b528c19 100644
--- a/WebCore/html/HTMLTextAreaElement.cpp
+++ b/WebCore/html/HTMLTextAreaElement.cpp
@@ -407,16 +407,6 @@ void HTMLTextAreaElement::accessKeyAction(bool)
     focus();
 }
 
-const AtomicString& HTMLTextAreaElement::accessKey() const
-{
-    return getAttribute(accesskeyAttr);
-}
-
-void HTMLTextAreaElement::setAccessKey(const String& value)
-{
-    setAttribute(accesskeyAttr, value);
-}
-
 void HTMLTextAreaElement::setCols(int cols)
 {
     setAttribute(colsAttr, String::number(cols));
diff --git a/WebCore/html/HTMLTextAreaElement.h b/WebCore/html/HTMLTextAreaElement.h
index af233ae..43fe493 100644
--- a/WebCore/html/HTMLTextAreaElement.h
+++ b/WebCore/html/HTMLTextAreaElement.h
@@ -51,9 +51,6 @@ public:
     
     void rendererWillBeDestroyed();
     
-    const AtomicString& accessKey() const;
-    void setAccessKey(const String&);
-
     void setCols(int);
     void setRows(int);
     
diff --git a/WebCore/html/HTMLTextAreaElement.idl b/WebCore/html/HTMLTextAreaElement.idl
index 4229450..0f0c9fc 100644
--- a/WebCore/html/HTMLTextAreaElement.idl
+++ b/WebCore/html/HTMLTextAreaElement.idl
@@ -26,13 +26,13 @@ module html {
         readonly attribute ValidityState validity;
         attribute [Reflect] DOMString accessKey;
         attribute long cols;
-        attribute boolean disabled;
-        attribute boolean autofocus;
+        attribute [Reflect] boolean disabled;
+        attribute [Reflect] boolean autofocus;
         attribute long maxLength setter raises(DOMException);
         attribute [ConvertNullToNullString] DOMString name;
         attribute [Reflect] DOMString placeholder;
-        attribute boolean readOnly;
-        attribute boolean required;
+        attribute [Reflect] boolean readOnly;
+        attribute [Reflect] boolean required;
         attribute long rows;
         readonly attribute DOMString type;
         attribute [ConvertNullToNullString] DOMString value;
diff --git a/WebCore/html/HTMLToken.h b/WebCore/html/HTMLToken.h
index 321b103..741f5cd 100644
--- a/WebCore/html/HTMLToken.h
+++ b/WebCore/html/HTMLToken.h
@@ -60,8 +60,15 @@ public:
         m_type = Uninitialized;
     }
 
+    void makeEndOfFile()
+    {
+        ASSERT(m_type == Uninitialized);
+        m_type = EndOfFile;
+    }
+
     void beginStartTag(UChar character)
     {
+        ASSERT(character);
         ASSERT(m_type == Uninitialized);
         m_type = StartTag;
         m_data.clear();
@@ -87,6 +94,7 @@ public:
 
     void beginCharacter(UChar character)
     {
+        ASSERT(character);
         ASSERT(m_type == Uninitialized);
         m_type = Character;
         m_data.clear();
@@ -110,12 +118,14 @@ public:
 
     void beginDOCTYPE(UChar character)
     {
+        ASSERT(character);
         beginDOCTYPE();
         m_data.append(character);
     }
 
     void appendToName(UChar character)
     {
+        ASSERT(character);
         ASSERT(m_type == StartTag || m_type == EndTag || m_type == DOCTYPE);
         m_data.append(character);
     }
@@ -129,6 +139,7 @@ public:
 
     void appendToComment(UChar character)
     {
+        ASSERT(character);
         ASSERT(m_type == Comment);
         m_data.append(character);
     }
@@ -142,12 +153,14 @@ public:
 
     void appendToAttributeName(UChar character)
     {
+        ASSERT(character);
         ASSERT(m_type == StartTag || m_type == EndTag);
         m_currentAttribute->m_name.append(character);
     }
 
     void appendToAttributeValue(UChar character)
     {
+        ASSERT(character);
         ASSERT(m_type == StartTag || m_type == EndTag);
         m_currentAttribute->m_value.append(character);
     }
@@ -226,6 +239,7 @@ public:
 
     void appendToPublicIdentifier(UChar character)
     {
+        ASSERT(character);
         ASSERT(m_type == DOCTYPE);
         ASSERT(m_doctypeData->m_hasPublicIdentifier);
         m_doctypeData->m_publicIdentifier.append(character);
@@ -233,6 +247,7 @@ public:
 
     void appendToSystemIdentifier(UChar character)
     {
+        ASSERT(character);
         ASSERT(m_type == DOCTYPE);
         ASSERT(m_doctypeData->m_hasSystemIdentifier);
         m_doctypeData->m_systemIdentifier.append(character);
@@ -336,6 +351,12 @@ public:
         return m_name;
     }
 
+    void setName(const AtomicString& name)
+    {
+        ASSERT(m_type == HTMLToken::StartTag || m_type == HTMLToken::EndTag || m_type == HTMLToken::DOCTYPE);
+        m_name = name;
+    }
+
     bool selfClosing() const
     {
         ASSERT(m_type == HTMLToken::StartTag || m_type == HTMLToken::EndTag);
@@ -361,14 +382,14 @@ public:
     }
 
     // FIXME: Distinguish between a missing public identifer and an empty one.
-    const WTF::Vector<UChar>& publicIdentifier() const
+    WTF::Vector<UChar>& publicIdentifier() const
     {
         ASSERT(m_type == HTMLToken::DOCTYPE);
         return m_doctypeData->m_publicIdentifier;
     }
 
     // FIXME: Distinguish between a missing system identifer and an empty one.
-    const WTF::Vector<UChar>& systemIdentifier() const
+    WTF::Vector<UChar>& systemIdentifier() const
     {
         ASSERT(m_type == HTMLToken::DOCTYPE);
         return m_doctypeData->m_systemIdentifier;
diff --git a/WebCore/html/HTMLTokenizer.cpp b/WebCore/html/HTMLTokenizer.cpp
index 84894ff..54e604a 100644
--- a/WebCore/html/HTMLTokenizer.cpp
+++ b/WebCore/html/HTMLTokenizer.cpp
@@ -33,6 +33,7 @@
 #include "HTMLToken.h"
 #include "HTMLNames.h"
 #include "NotImplemented.h"
+#include <wtf/ASCIICType.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
@@ -44,15 +45,22 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+const UChar HTMLTokenizer::InputStreamPreprocessor::endOfFileMarker = 0;
+
 namespace {
 
 inline UChar toLowerCase(UChar cc)
 {
-    ASSERT(cc >= 'A' && cc <= 'Z');
+    ASSERT(isASCIIUpper(cc));
     const int lowerCaseOffset = 0x20;
     return cc + lowerCaseOffset;
 }
 
+inline bool isTokenizerWhitespace(UChar cc)
+{
+    return cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ';
+}
+
 inline void advanceStringAndASSERTIgnoringCase(SegmentedString& source, const char* expectedCharacters)
 {
     while (*expectedCharacters)
@@ -113,9 +121,9 @@ inline bool HTMLTokenizer::processEntity(SegmentedString& source)
     if (notEnoughCharacters)
         return false;
     if (!value)
-        emitCharacter('&');
+        bufferCharacter('&');
     else
-        emitCodePoint(value);
+        bufferCodePoint(value);
     return true;
 }
 
@@ -160,33 +168,63 @@ inline bool HTMLTokenizer::processEntity(SegmentedString& source)
         goto stateName;                                                    \
     } while (false)
 
-// We use this macro when the HTML5 spec says "Emit the current <mumble>
+
+inline void HTMLTokenizer::saveEndTagNameIfNeeded()
+{
+    ASSERT(m_token->type() != HTMLToken::Uninitialized);
+    if (m_token->type() == HTMLToken::StartTag)
+        m_appropriateEndTagName = m_token->name();
+}
+
+// We use this function when the HTML5 spec says "Emit the current <mumble>
 // token. Switch to the <mumble> state."  We use the word "resume" instead of
 // switch to indicate that this macro actually returns and that we'll end up
 // in the state when we "resume" (i.e., are called again).
-#define EMIT_AND_RESUME_IN(stateName)                                      \
-    do {                                                                   \
-        m_state = stateName;                                               \
-        source.advance(m_lineNumber);                                      \
-        emitCurrentToken();                                                \
-        return true;                                                       \
-    } while (false)
+bool HTMLTokenizer::emitAndResumeIn(SegmentedString& source, State state)
+{
+    m_state = state;
+    source.advance(m_lineNumber);
+    saveEndTagNameIfNeeded();
+    return true;
+}
 
-#define _FLUSH_BUFFERED_END_TAG()                                          \
-    do {                                                                   \
-        ASSERT(m_token->type() == HTMLToken::Character ||                  \
-               m_token->type() == HTMLToken::Uninitialized);               \
-        source.advance(m_lineNumber);                                      \
-        if (m_token->type() == HTMLToken::Character)                       \
-            return true;                                                   \
-        m_token->beginEndTag(m_bufferedEndTagName);                        \
-        m_bufferedEndTagName.clear();                                      \
-    } while (false)
+// Identical to emitAndResumeIn, except does not advance.
+bool HTMLTokenizer::emitAndReconsumeIn(SegmentedString&, State state)
+{
+    m_state = state;
+    saveEndTagNameIfNeeded();
+    return true;
+}
+
+// Used to emit the EndOfFile token.
+// Check if we have buffered characters to emit first before emitting the EOF.
+bool HTMLTokenizer::emitEndOfFile(SegmentedString& source)
+{
+    if (shouldEmitBufferedCharacterToken(source))
+        return true;
+    m_state = DataState;
+    source.advance(m_lineNumber);
+    m_token->clear();
+    m_token->makeEndOfFile();
+    return true;
+}
+
+bool HTMLTokenizer::flushBufferedEndTag(SegmentedString& source)
+{
+    ASSERT(m_token->type() == HTMLToken::Character || m_token->type() == HTMLToken::Uninitialized);
+    source.advance(m_lineNumber);
+    if (m_token->type() == HTMLToken::Character)
+        return true;
+    m_token->beginEndTag(m_bufferedEndTagName);
+    m_bufferedEndTagName.clear();
+    return false;
+}
 
 #define FLUSH_AND_ADVANCE_TO(stateName)                                    \
     do {                                                                   \
         m_state = stateName;                                               \
-        _FLUSH_BUFFERED_END_TAG();                                         \
+        if (flushBufferedEndTag(source))                                   \
+            return true;                                                   \
         if (source.isEmpty()                                               \
             || !m_inputStreamPreprocessor.peek(source, m_lineNumber))      \
             return shouldEmitBufferedCharacterToken(source);               \
@@ -194,12 +232,12 @@ inline bool HTMLTokenizer::processEntity(SegmentedString& source)
         goto stateName;                                                    \
     } while (false)
 
-#define FLUSH_EMIT_AND_RESUME_IN(stateName)                                \
-    do {                                                                   \
-        m_state = stateName;                                               \
-        _FLUSH_BUFFERED_END_TAG();                                         \
-        return true;                                                       \
-    } while (false)
+bool HTMLTokenizer::flushEmitAndResumeIn(SegmentedString& source, State state)
+{
+    m_state = state;
+    flushBufferedEndTag(source);
+    return true;
+}
 
 bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
 {
@@ -252,8 +290,10 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
                 return true;
             }
             ADVANCE_TO(TagOpenState);
-        } else {
-            emitCharacter(cc);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker)
+            return emitEndOfFile(source);
+        else {
+            bufferCharacter(cc);
             ADVANCE_TO(DataState);
         }
     }
@@ -271,8 +311,10 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
             ADVANCE_TO(CharacterReferenceInRCDATAState);
         else if (cc == '<')
             ADVANCE_TO(RCDATALessThanSignState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker)
+            return emitEndOfFile(source);
         else {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(RCDATAState);
         }
     }
@@ -288,8 +330,10 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
     BEGIN_STATE(RAWTEXTState) {
         if (cc == '<')
             ADVANCE_TO(RAWTEXTLessThanSignState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker)
+            return emitEndOfFile(source);
         else {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(RAWTEXTState);
         }
     }
@@ -298,15 +342,20 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
     BEGIN_STATE(ScriptDataState) {
         if (cc == '<')
             ADVANCE_TO(ScriptDataLessThanSignState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker)
+            return emitEndOfFile(source);
         else {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataState);
         }
     }
     END_STATE()
 
     BEGIN_STATE(PLAINTEXTState) {
-        emitCharacter(cc);
+        if (cc == InputStreamPreprocessor::endOfFileMarker)
+            return emitEndOfFile(source);
+        else
+            bufferCharacter(cc);
         ADVANCE_TO(PLAINTEXTState);
     }
     END_STATE()
@@ -316,59 +365,65 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
             ADVANCE_TO(MarkupDeclarationOpenState);
         else if (cc == '/')
             ADVANCE_TO(EndTagOpenState);
-        else if (cc >= 'A' && cc <= 'Z') {
+        else if (isASCIIUpper(cc)) {
             m_token->beginStartTag(toLowerCase(cc));
             ADVANCE_TO(TagNameState);
-        } else if (cc >= 'a' && cc <= 'z') {
+        } else if (isASCIILower(cc)) {
             m_token->beginStartTag(cc);
             ADVANCE_TO(TagNameState);
         } else if (cc == '?') {
-            emitParseError();
+            parseError();
             // The spec consumes the current character before switching
             // to the bogus comment state, but it's easier to implement
             // if we reconsume the current character.
             RECONSUME_IN(BogusCommentState);
         } else {
-            emitParseError();
-            emitCharacter('<');
+            parseError();
+            bufferCharacter('<');
             RECONSUME_IN(DataState);
         }
     }
     END_STATE()
 
     BEGIN_STATE(EndTagOpenState) {
-        if (cc >= 'A' && cc <= 'Z') {
+        if (isASCIIUpper(cc)) {
             m_token->beginEndTag(toLowerCase(cc));
             ADVANCE_TO(TagNameState);
-        } else if (cc >= 'a' && cc <= 'z') {
+        } else if (isASCIILower(cc)) {
             m_token->beginEndTag(cc);
             ADVANCE_TO(TagNameState);
         } else if (cc == '>') {
-            emitParseError();
+            parseError();
             ADVANCE_TO(DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            bufferCharacter('<');
+            bufferCharacter('/');
+            RECONSUME_IN(DataState);
         } else {
-            emitParseError();
+            parseError();
             RECONSUME_IN(BogusCommentState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(TagNameState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeAttributeNameState);
         else if (cc == '/')
             ADVANCE_TO(SelfClosingStartTagState);
         else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else if (cc >= 'A' && cc <= 'Z') {
+            return emitAndResumeIn(source, DataState);
+        else if (isASCIIUpper(cc)) {
             m_token->appendToName(toLowerCase(cc));
             ADVANCE_TO(TagNameState);
+        } if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
             m_token->appendToName(cc);
             ADVANCE_TO(TagNameState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -378,40 +433,40 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
             ASSERT(m_bufferedEndTagName.isEmpty());
             ADVANCE_TO(RCDATAEndTagOpenState);
         } else {
-            emitCharacter('<');
+            bufferCharacter('<');
             RECONSUME_IN(RCDATAState);
         }
     }
     END_STATE()
 
     BEGIN_STATE(RCDATAEndTagOpenState) {
-        if (cc >= 'A' && cc <= 'Z') {
+        if (isASCIIUpper(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(toLowerCase(cc));
             ADVANCE_TO(RCDATAEndTagNameState);
-        } else if (cc >= 'a' && cc <= 'z') {
+        } else if (isASCIILower(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(cc);
             ADVANCE_TO(RCDATAEndTagNameState);
         } else {
-            emitCharacter('<');
-            emitCharacter('/');
+            bufferCharacter('<');
+            bufferCharacter('/');
             RECONSUME_IN(RCDATAState);
         }
     }
     END_STATE()
 
     BEGIN_STATE(RCDATAEndTagNameState) {
-        if (cc >= 'A' && cc <= 'Z') {
+        if (isASCIIUpper(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(toLowerCase(cc));
             ADVANCE_TO(RCDATAEndTagNameState);
-        } else if (cc >= 'a' && cc <= 'z') {
+        } else if (isASCIILower(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(cc);
             ADVANCE_TO(RCDATAEndTagNameState);
         } else {
-            if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ') {
+            if (isTokenizerWhitespace(cc)) {
                 if (isAppropriateEndTag())
                     FLUSH_AND_ADVANCE_TO(BeforeAttributeNameState);
             } else if (cc == '/') {
@@ -419,10 +474,10 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
                     FLUSH_AND_ADVANCE_TO(SelfClosingStartTagState);
             } else if (cc == '>') {
                 if (isAppropriateEndTag())
-                    FLUSH_EMIT_AND_RESUME_IN(DataState);
+                    return flushEmitAndResumeIn(source, DataState);
             }
-            emitCharacter('<');
-            emitCharacter('/');
+            bufferCharacter('<');
+            bufferCharacter('/');
             m_token->appendToCharacter(m_temporaryBuffer);
             m_bufferedEndTagName.clear();
             RECONSUME_IN(RCDATAState);
@@ -436,40 +491,40 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
             ASSERT(m_bufferedEndTagName.isEmpty());
             ADVANCE_TO(RAWTEXTEndTagOpenState);
         } else {
-            emitCharacter('<');
+            bufferCharacter('<');
             RECONSUME_IN(RAWTEXTState);
         }
     }
     END_STATE()
 
     BEGIN_STATE(RAWTEXTEndTagOpenState) {
-        if (cc >= 'A' && cc <= 'Z') {
+        if (isASCIIUpper(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(toLowerCase(cc));
             ADVANCE_TO(RAWTEXTEndTagNameState);
-        } else if (cc >= 'a' && cc <= 'z') {
+        } else if (isASCIILower(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(cc);
             ADVANCE_TO(RAWTEXTEndTagNameState);
         } else {
-            emitCharacter('<');
-            emitCharacter('/');
+            bufferCharacter('<');
+            bufferCharacter('/');
             RECONSUME_IN(RAWTEXTState);
         }
     }
     END_STATE()
 
     BEGIN_STATE(RAWTEXTEndTagNameState) {
-        if (cc >= 'A' && cc <= 'Z') {
+        if (isASCIIUpper(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(toLowerCase(cc));
             ADVANCE_TO(RAWTEXTEndTagNameState);
-        } else if (cc >= 'a' && cc <= 'z') {
+        } else if (isASCIILower(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(cc);
             ADVANCE_TO(RAWTEXTEndTagNameState);
         } else {
-            if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ') {
+            if (isTokenizerWhitespace(cc)) {
                 if (isAppropriateEndTag())
                     FLUSH_AND_ADVANCE_TO(BeforeAttributeNameState);
             } else if (cc == '/') {
@@ -477,10 +532,10 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
                     FLUSH_AND_ADVANCE_TO(SelfClosingStartTagState);
             } else if (cc == '>') {
                 if (isAppropriateEndTag())
-                    FLUSH_EMIT_AND_RESUME_IN(DataState);
+                    return flushEmitAndResumeIn(source, DataState);
             }
-            emitCharacter('<');
-            emitCharacter('/');
+            bufferCharacter('<');
+            bufferCharacter('/');
             m_token->appendToCharacter(m_temporaryBuffer);
             m_bufferedEndTagName.clear();
             RECONSUME_IN(RAWTEXTState);
@@ -494,44 +549,44 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
             ASSERT(m_bufferedEndTagName.isEmpty());
             ADVANCE_TO(ScriptDataEndTagOpenState);
         } else if (cc == '!') {
-            emitCharacter('<');
-            emitCharacter('!');
+            bufferCharacter('<');
+            bufferCharacter('!');
             ADVANCE_TO(ScriptDataEscapeStartState);
         } else {
-            emitCharacter('<');
+            bufferCharacter('<');
             RECONSUME_IN(ScriptDataState);
         }
     }
     END_STATE()
 
     BEGIN_STATE(ScriptDataEndTagOpenState) {
-        if (cc >= 'A' && cc <= 'Z') {
+        if (isASCIIUpper(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(toLowerCase(cc));
             ADVANCE_TO(ScriptDataEndTagNameState);
-        } else if (cc >= 'a' && cc <= 'z') {
+        } else if (isASCIILower(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(cc);
             ADVANCE_TO(ScriptDataEndTagNameState);
         } else {
-            emitCharacter('<');
-            emitCharacter('/');
+            bufferCharacter('<');
+            bufferCharacter('/');
             RECONSUME_IN(ScriptDataState);
         }
     }
     END_STATE()
 
     BEGIN_STATE(ScriptDataEndTagNameState) {
-        if (cc >= 'A' && cc <= 'Z') {
+        if (isASCIIUpper(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(toLowerCase(cc));
             ADVANCE_TO(ScriptDataEndTagNameState);
-        } else if (cc >= 'a' && cc <= 'z') {
+        } else if (isASCIILower(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(cc);
             ADVANCE_TO(ScriptDataEndTagNameState);
         } else {
-            if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ') {
+            if (isTokenizerWhitespace(cc)) {
                 if (isAppropriateEndTag())
                     FLUSH_AND_ADVANCE_TO(BeforeAttributeNameState);
             } else if (cc == '/') {
@@ -539,10 +594,10 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
                     FLUSH_AND_ADVANCE_TO(SelfClosingStartTagState);
             } else if (cc == '>') {
                 if (isAppropriateEndTag())
-                    FLUSH_EMIT_AND_RESUME_IN(DataState);
+                    return flushEmitAndResumeIn(source, DataState);
             }
-            emitCharacter('<');
-            emitCharacter('/');
+            bufferCharacter('<');
+            bufferCharacter('/');
             m_token->appendToCharacter(m_temporaryBuffer);
             m_bufferedEndTagName.clear();
             RECONSUME_IN(ScriptDataState);
@@ -552,7 +607,7 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
 
     BEGIN_STATE(ScriptDataEscapeStartState) {
         if (cc == '-') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataEscapeStartDashState);
         } else
             RECONSUME_IN(ScriptDataState);
@@ -561,7 +616,7 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
 
     BEGIN_STATE(ScriptDataEscapeStartDashState) {
         if (cc == '-') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataEscapedDashDashState);
         } else
             RECONSUME_IN(ScriptDataState);
@@ -570,46 +625,52 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
 
     BEGIN_STATE(ScriptDataEscapedState) {
         if (cc == '-') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataEscapedDashState);
         } else if (cc == '<')
             ADVANCE_TO(ScriptDataEscapedLessThanSignState);
-        else {
-            emitCharacter(cc);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
+        } else {
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataEscapedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(ScriptDataEscapedDashState) {
         if (cc == '-') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataEscapedDashDashState);
         } else if (cc == '<')
             ADVANCE_TO(ScriptDataEscapedLessThanSignState);
-        else {
-            emitCharacter(cc);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
+        } else {
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataEscapedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(ScriptDataEscapedDashDashState) {
         if (cc == '-') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataEscapedDashDashState);
         } else if (cc == '<')
             ADVANCE_TO(ScriptDataEscapedLessThanSignState);
         else if (cc == '>') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataState);
+        } if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataEscapedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -618,53 +679,53 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
             m_temporaryBuffer.clear();
             ASSERT(m_bufferedEndTagName.isEmpty());
             ADVANCE_TO(ScriptDataEscapedEndTagOpenState);
-        } else if (cc >= 'A' && cc <= 'Z') {
-            emitCharacter('<');
-            emitCharacter(cc);
+        } else if (isASCIIUpper(cc)) {
+            bufferCharacter('<');
+            bufferCharacter(cc);
             m_temporaryBuffer.clear();
             m_temporaryBuffer.append(toLowerCase(cc));
             ADVANCE_TO(ScriptDataDoubleEscapeStartState);
-        } else if (cc >= 'a' && cc <= 'z') {
-            emitCharacter('<');
-            emitCharacter(cc);
+        } else if (isASCIILower(cc)) {
+            bufferCharacter('<');
+            bufferCharacter(cc);
             m_temporaryBuffer.clear();
             m_temporaryBuffer.append(cc);
             ADVANCE_TO(ScriptDataDoubleEscapeStartState);
         } else {
-            emitCharacter('<');
+            bufferCharacter('<');
             RECONSUME_IN(ScriptDataEscapedState);
         }
     }
     END_STATE()
 
     BEGIN_STATE(ScriptDataEscapedEndTagOpenState) {
-        if (cc >= 'A' && cc <= 'Z') {
+        if (isASCIIUpper(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(toLowerCase(cc));
             ADVANCE_TO(ScriptDataEscapedEndTagNameState);
-        } else if (cc >= 'a' && cc <= 'z') {
+        } else if (isASCIILower(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(cc);
             ADVANCE_TO(ScriptDataEscapedEndTagNameState);
         } else {
-            emitCharacter('<');
-            emitCharacter('/');
+            bufferCharacter('<');
+            bufferCharacter('/');
             RECONSUME_IN(ScriptDataEscapedState);
         }
     }
     END_STATE()
 
     BEGIN_STATE(ScriptDataEscapedEndTagNameState) {
-        if (cc >= 'A' && cc <= 'Z') {
+        if (isASCIIUpper(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(toLowerCase(cc));
             ADVANCE_TO(ScriptDataEscapedEndTagNameState);
-        } else if (cc >= 'a' && cc <= 'z') {
+        } else if (isASCIILower(cc)) {
             m_temporaryBuffer.append(cc);
             addToPossibleEndTag(cc);
             ADVANCE_TO(ScriptDataEscapedEndTagNameState);
         } else {
-            if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ') {
+            if (isTokenizerWhitespace(cc)) {
                 if (isAppropriateEndTag())
                     FLUSH_AND_ADVANCE_TO(BeforeAttributeNameState);
             } else if (cc == '/') {
@@ -672,10 +733,10 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
                     FLUSH_AND_ADVANCE_TO(SelfClosingStartTagState);
             } else if (cc == '>') {
                 if (isAppropriateEndTag())
-                    FLUSH_EMIT_AND_RESUME_IN(DataState);
+                    return flushEmitAndResumeIn(source, DataState);
             }
-            emitCharacter('<');
-            emitCharacter('/');
+            bufferCharacter('<');
+            bufferCharacter('/');
             m_token->appendToCharacter(m_temporaryBuffer);
             m_bufferedEndTagName.clear();
             RECONSUME_IN(ScriptDataEscapedState);
@@ -684,18 +745,18 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
     END_STATE()
 
     BEGIN_STATE(ScriptDataDoubleEscapeStartState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ' || cc == '/' || cc == '>') {
-            emitCharacter(cc);
+        if (isTokenizerWhitespace(cc) || cc == '/' || cc == '>') {
+            bufferCharacter(cc);
             if (temporaryBufferIs(scriptTag.localName()))
                 ADVANCE_TO(ScriptDataDoubleEscapedState);
             else
                 ADVANCE_TO(ScriptDataEscapedState);
-        } else if (cc >= 'A' && cc <= 'Z') {
-            emitCharacter(cc);
+        } else if (isASCIIUpper(cc)) {
+            bufferCharacter(cc);
             m_temporaryBuffer.append(toLowerCase(cc));
             ADVANCE_TO(ScriptDataDoubleEscapeStartState);
-        } else if (cc >= 'a' && cc <= 'z') {
-            emitCharacter(cc);
+        } else if (isASCIILower(cc)) {
+            bufferCharacter(cc);
             m_temporaryBuffer.append(cc);
             ADVANCE_TO(ScriptDataDoubleEscapeStartState);
         } else
@@ -705,55 +766,61 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
 
     BEGIN_STATE(ScriptDataDoubleEscapedState) {
         if (cc == '-') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataDoubleEscapedDashState);
         } else if (cc == '<') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataDoubleEscapedLessThanSignState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataDoubleEscapedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(ScriptDataDoubleEscapedDashState) {
         if (cc == '-') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataDoubleEscapedDashDashState);
         } else if (cc == '<') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataDoubleEscapedLessThanSignState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataDoubleEscapedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(ScriptDataDoubleEscapedDashDashState) {
         if (cc == '-') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataDoubleEscapedDashDashState);
         } else if (cc == '<') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataDoubleEscapedLessThanSignState);
         } else if (cc == '>') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             ADVANCE_TO(ScriptDataDoubleEscapedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(ScriptDataDoubleEscapedLessThanSignState) {
         if (cc == '/') {
-            emitCharacter(cc);
+            bufferCharacter(cc);
             m_temporaryBuffer.clear();
             ADVANCE_TO(ScriptDataDoubleEscapeEndState);
         } else
@@ -762,18 +829,18 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
     END_STATE()
 
     BEGIN_STATE(ScriptDataDoubleEscapeEndState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ' || cc == '/' || cc == '>') {
-            emitCharacter(cc);
+        if (isTokenizerWhitespace(cc) || cc == '/' || cc == '>') {
+            bufferCharacter(cc);
             if (temporaryBufferIs(scriptTag.localName()))
                 ADVANCE_TO(ScriptDataEscapedState);
             else
                 ADVANCE_TO(ScriptDataDoubleEscapedState);
-        } else if (cc >= 'A' && cc <= 'Z') {
-            emitCharacter(cc);
+        } else if (isASCIIUpper(cc)) {
+            bufferCharacter(cc);
             m_temporaryBuffer.append(toLowerCase(cc));
             ADVANCE_TO(ScriptDataDoubleEscapeEndState);
-        } else if (cc >= 'a' && cc <= 'z') {
-            emitCharacter(cc);
+        } else if (isASCIILower(cc)) {
+            bufferCharacter(cc);
             m_temporaryBuffer.append(cc);
             ADVANCE_TO(ScriptDataDoubleEscapeEndState);
         } else
@@ -782,75 +849,81 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
     END_STATE()
 
     BEGIN_STATE(BeforeAttributeNameState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeAttributeNameState);
         else if (cc == '/')
             ADVANCE_TO(SelfClosingStartTagState);
         else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else if (cc >= 'A' && cc <= 'Z') {
+            return emitAndResumeIn(source, DataState);
+        else if (isASCIIUpper(cc)) {
             m_token->addNewAttribute();
             m_token->appendToAttributeName(toLowerCase(cc));
             ADVANCE_TO(AttributeNameState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
             if (cc == '"' || cc == '\'' || cc == '<' || cc == '=')
-                emitParseError();
+                parseError();
             m_token->addNewAttribute();
             m_token->appendToAttributeName(cc);
             ADVANCE_TO(AttributeNameState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(AttributeNameState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(AfterAttributeNameState);
         else if (cc == '/')
             ADVANCE_TO(SelfClosingStartTagState);
         else if (cc == '=')
             ADVANCE_TO(BeforeAttributeValueState);
         else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else if (cc >= 'A' && cc <= 'Z') {
+            return emitAndResumeIn(source, DataState);
+        else if (isASCIIUpper(cc)) {
             m_token->appendToAttributeName(toLowerCase(cc));
             ADVANCE_TO(AttributeNameState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
             if (cc == '"' || cc == '\'' || cc == '<' || cc == '=')
-                emitParseError();
+                parseError();
             m_token->appendToAttributeName(cc);
             ADVANCE_TO(AttributeNameState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(AfterAttributeNameState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(AfterAttributeNameState);
         else if (cc == '/')
             ADVANCE_TO(SelfClosingStartTagState);
         else if (cc == '=')
             ADVANCE_TO(BeforeAttributeValueState);
         else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else if (cc >= 'A' && cc <= 'Z') {
+            return emitAndResumeIn(source, DataState);
+        else if (isASCIIUpper(cc)) {
             m_token->addNewAttribute();
             m_token->appendToAttributeName(toLowerCase(cc));
             ADVANCE_TO(AttributeNameState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
             if (cc == '"' || cc == '\'' || cc == '<')
-                emitParseError();
+                parseError();
             m_token->addNewAttribute();
             m_token->appendToAttributeName(cc);
             ADVANCE_TO(AttributeNameState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(BeforeAttributeValueState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeAttributeValueState);
         else if (cc == '"')
             ADVANCE_TO(AttributeValueDoubleQuotedState);
@@ -859,11 +932,14 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         else if (cc == '\'')
             ADVANCE_TO(AttributeValueSingleQuotedState);
         else if (cc == '>') {
-            emitParseError();
-            EMIT_AND_RESUME_IN(DataState);
+            parseError();
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
             if (cc == '<' || cc == '=' || cc == '`')
-                emitParseError();
+                parseError();
             m_token->appendToAttributeValue(cc);
             ADVANCE_TO(AttributeValueUnquotedState);
         }
@@ -876,11 +952,13 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         else if (cc == '&') {
             m_additionalAllowedCharacter = '"';
             ADVANCE_TO(CharacterReferenceInAttributeValueState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
             m_token->appendToAttributeValue(cc);
             ADVANCE_TO(AttributeValueDoubleQuotedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -890,29 +968,33 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         else if (cc == '&') {
             m_additionalAllowedCharacter = '\'';
             ADVANCE_TO(CharacterReferenceInAttributeValueState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
             m_token->appendToAttributeValue(cc);
             ADVANCE_TO(AttributeValueSingleQuotedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(AttributeValueUnquotedState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeAttributeNameState);
         else if (cc == '&') {
             m_additionalAllowedCharacter = '>';
             ADVANCE_TO(CharacterReferenceInAttributeValueState);
         } else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else {
+            return emitAndResumeIn(source, DataState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
+        } else {
             if (cc == '"' || cc == '\'' || cc == '<' || cc == '=' || cc == '`')
-                emitParseError();
+                parseError();
             m_token->appendToAttributeValue(cc);
             ADVANCE_TO(AttributeValueUnquotedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -945,48 +1027,51 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
     END_STATE()
 
     BEGIN_STATE(AfterAttributeValueQuotedState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeAttributeNameState);
         else if (cc == '/')
             ADVANCE_TO(SelfClosingStartTagState);
         else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else {
-            emitParseError();
+            return emitAndResumeIn(source, DataState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
+        } else {
+            parseError();
             RECONSUME_IN(BeforeAttributeNameState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(SelfClosingStartTagState) {
         if (cc == '>') {
             notImplemented();
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            RECONSUME_IN(DataState);
         } else {
-            emitParseError();
+            parseError();
             RECONSUME_IN(BeforeAttributeNameState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(BogusCommentState) {
-        // FIXME: This state isn't correct because we'll terminate the
-        // comment early if we don't have the whole input stream available.
         m_token->beginComment();
-        while (!source.isEmpty()) {
-            cc = m_inputStreamPreprocessor.nextInputCharacter();
-            if (cc == '>')
-                EMIT_AND_RESUME_IN(DataState);
+        RECONSUME_IN(ContinueBogusCommentState);
+    }
+    END_STATE()
+
+    BEGIN_STATE(ContinueBogusCommentState) {
+        if (cc == '>')
+            return emitAndResumeIn(source, DataState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker)
+            return emitAndReconsumeIn(source, DataState);
+        else {
             m_token->appendToComment(cc);
-            m_inputStreamPreprocessor.advance(source, m_lineNumber);
-            // We ignore the return value (which indicates that |source| is
-            // empty) because it's checked by the loop condition above.
+            ADVANCE_TO(ContinueBogusCommentState);
         }
-        m_state = DataState;
-        return true;
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -1013,7 +1098,7 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         notImplemented();
         // FIXME: We're still missing the bits about the insertion mode being in foreign content:
         // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#markup-declaration-open-state
-        emitParseError();
+        parseError();
         RECONSUME_IN(BogusCommentState);
     }
     END_STATE()
@@ -1022,13 +1107,15 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         if (cc == '-')
             ADVANCE_TO(CommentStartDashState);
         else if (cc == '>') {
-            emitParseError();
-            EMIT_AND_RESUME_IN(DataState);
+            parseError();
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            return emitAndReconsumeIn(source, DataState);
         } else {
             m_token->appendToComment(cc);
             ADVANCE_TO(CommentState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -1036,65 +1123,72 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         if (cc == '-')
             ADVANCE_TO(CommentEndState);
         else if (cc == '>') {
-            emitParseError();
-            EMIT_AND_RESUME_IN(DataState);
+            parseError();
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            return emitAndReconsumeIn(source, DataState);
         } else {
             m_token->appendToComment('-');
             m_token->appendToComment(cc);
             ADVANCE_TO(CommentState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(CommentState) {
         if (cc == '-')
             ADVANCE_TO(CommentEndDashState);
-        else {
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            return emitAndReconsumeIn(source, DataState);
+        } else {
             m_token->appendToComment(cc);
             ADVANCE_TO(CommentState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(CommentEndDashState) {
         if (cc == '-')
             ADVANCE_TO(CommentEndState);
-        else {
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            return emitAndReconsumeIn(source, DataState);
+        } else {
             m_token->appendToComment('-');
             m_token->appendToComment(cc);
             ADVANCE_TO(CommentState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(CommentEndState) {
         if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ') {
-            emitParseError();
+            return emitAndResumeIn(source, DataState);
+        else if (isTokenizerWhitespace(cc)) {
+            parseError();
             m_token->appendToComment('-');
             m_token->appendToComment('-');
             m_token->appendToComment(cc);
             ADVANCE_TO(CommentEndSpaceState);
         } else if (cc == '!') {
-            emitParseError();
+            parseError();
             ADVANCE_TO(CommentEndBangState);
         } else if (cc == '-') {
-            emitParseError();
+            parseError();
             m_token->appendToComment('-');
-            m_token->appendToComment(cc);
             ADVANCE_TO(CommentEndState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            return emitAndReconsumeIn(source, DataState);
         } else {
-            emitParseError();
+            parseError();
             m_token->appendToComment('-');
             m_token->appendToComment('-');
             m_token->appendToComment(cc);
             ADVANCE_TO(CommentState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -1105,86 +1199,105 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
             m_token->appendToComment('!');
             ADVANCE_TO(CommentEndDashState);
         } else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else {
+            return emitAndResumeIn(source, DataState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            return emitAndReconsumeIn(source, DataState);
+        } else {
             m_token->appendToComment('-');
             m_token->appendToComment('-');
             m_token->appendToComment('!');
             m_token->appendToComment(cc);
             ADVANCE_TO(CommentState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(CommentEndSpaceState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ') {
+        if (isTokenizerWhitespace(cc)) {
             m_token->appendToComment(cc);
             ADVANCE_TO(CommentEndSpaceState);
         } else if (cc == '-')
             ADVANCE_TO(CommentEndDashState);
         else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else {
+            return emitAndResumeIn(source, DataState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            return emitAndReconsumeIn(source, DataState);
+        } else {
             m_token->appendToComment(cc);
             ADVANCE_TO(CommentState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(DOCTYPEState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeDOCTYPENameState);
-        else {
-            emitParseError();
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            m_token->beginDOCTYPE();
+            m_token->setForceQuirks();
+            return emitAndReconsumeIn(source, DataState);
+        } else {
+            parseError();
             RECONSUME_IN(BeforeDOCTYPENameState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(BeforeDOCTYPENameState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeDOCTYPENameState);
-        else if (cc >= 'A' && cc <= 'Z') {
+        else if (isASCIIUpper(cc)) {
             m_token->beginDOCTYPE(toLowerCase(cc));
             ADVANCE_TO(DOCTYPENameState);
         } else if (cc == '>') {
-            emitParseError();
+            parseError();
+            m_token->beginDOCTYPE();
+            m_token->setForceQuirks();
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
             m_token->beginDOCTYPE();
             m_token->setForceQuirks();
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndReconsumeIn(source, DataState);
         } else {
             m_token->beginDOCTYPE(cc);
             ADVANCE_TO(DOCTYPENameState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(DOCTYPENameState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(AfterDOCTYPENameState);
         else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else if (cc >= 'A' && cc <= 'Z') {
+            return emitAndResumeIn(source, DataState);
+        else if (isASCIIUpper(cc)) {
             m_token->appendToName(toLowerCase(cc));
             ADVANCE_TO(DOCTYPENameState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndReconsumeIn(source, DataState);
         } else {
             m_token->appendToName(cc);
             ADVANCE_TO(DOCTYPENameState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(AfterDOCTYPENameState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(AfterDOCTYPENameState);
         if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else {
+            return emitAndResumeIn(source, DataState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndReconsumeIn(source, DataState);
+        } else {
             DEFINE_STATIC_LOCAL(String, publicString, ("public"));
             DEFINE_STATIC_LOCAL(String, systemString, ("system"));
             if (cc == 'P' || cc == 'p') {
@@ -1202,40 +1315,42 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
                 } else if (result == SegmentedString::NotEnoughCharacters)
                     return shouldEmitBufferedCharacterToken(source);
             }
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
             ADVANCE_TO(BogusDOCTYPEState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(AfterDOCTYPEPublicKeywordState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeDOCTYPEPublicIdentifierState);
         else if (cc == '"') {
-            emitParseError();
+            parseError();
             m_token->setPublicIdentifierToEmptyString();
             ADVANCE_TO(DOCTYPEPublicIdentifierDoubleQuotedState);
         } else if (cc == '\'') {
-            emitParseError();
+            parseError();
             m_token->setPublicIdentifierToEmptyString();
             ADVANCE_TO(DOCTYPEPublicIdentifierSingleQuotedState);
         } else if (cc == '>') {
-            emitParseError();
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
             m_token->setForceQuirks();
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndReconsumeIn(source, DataState);
         } else {
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
             ADVANCE_TO(BogusDOCTYPEState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(BeforeDOCTYPEPublicIdentifierState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeDOCTYPEPublicIdentifierState);
         else if (cc == '"') {
             m_token->setPublicIdentifierToEmptyString();
@@ -1244,15 +1359,18 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
             m_token->setPublicIdentifierToEmptyString();
             ADVANCE_TO(DOCTYPEPublicIdentifierSingleQuotedState);
         } else if (cc == '>') {
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndReconsumeIn(source, DataState);
         } else {
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
             ADVANCE_TO(BogusDOCTYPEState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -1260,14 +1378,17 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         if (cc == '"')
             ADVANCE_TO(AfterDOCTYPEPublicIdentifierState);
         else if (cc == '>') {
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndReconsumeIn(source, DataState);
         } else {
             m_token->appendToPublicIdentifier(cc);
             ADVANCE_TO(DOCTYPEPublicIdentifierDoubleQuotedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -1275,85 +1396,97 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         if (cc == '\'')
             ADVANCE_TO(AfterDOCTYPEPublicIdentifierState);
         else if (cc == '>') {
-            emitParseError();
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
             m_token->setForceQuirks();
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndReconsumeIn(source, DataState);
         } else {
             m_token->appendToPublicIdentifier(cc);
             ADVANCE_TO(DOCTYPEPublicIdentifierSingleQuotedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(AfterDOCTYPEPublicIdentifierState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BetweenDOCTYPEPublicAndSystemIdentifiersState);
         else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndResumeIn(source, DataState);
         else if (cc == '"') {
-            emitParseError();
+            parseError();
             m_token->setSystemIdentifierToEmptyString();
             ADVANCE_TO(DOCTYPESystemIdentifierDoubleQuotedState);
         } else if (cc == '\'') {
-            emitParseError();
+            parseError();
             m_token->setSystemIdentifierToEmptyString();
             ADVANCE_TO(DOCTYPESystemIdentifierSingleQuotedState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndReconsumeIn(source, DataState);
         } else {
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
             ADVANCE_TO(BogusDOCTYPEState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(BetweenDOCTYPEPublicAndSystemIdentifiersState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BetweenDOCTYPEPublicAndSystemIdentifiersState);
         else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndResumeIn(source, DataState);
         else if (cc == '"') {
             m_token->setSystemIdentifierToEmptyString();
             ADVANCE_TO(DOCTYPESystemIdentifierDoubleQuotedState);
         } else if (cc == '\'') {
             m_token->setSystemIdentifierToEmptyString();
             ADVANCE_TO(DOCTYPESystemIdentifierSingleQuotedState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndReconsumeIn(source, DataState);
         } else {
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
             ADVANCE_TO(BogusDOCTYPEState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(AfterDOCTYPESystemKeywordState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeDOCTYPESystemIdentifierState);
         else if (cc == '"') {
-            emitParseError();
+            parseError();
             m_token->setSystemIdentifierToEmptyString();
             ADVANCE_TO(DOCTYPESystemIdentifierDoubleQuotedState);
         } else if (cc == '\'') {
-            emitParseError();
+            parseError();
             m_token->setSystemIdentifierToEmptyString();
             ADVANCE_TO(DOCTYPESystemIdentifierSingleQuotedState);
         } else if (cc == '>') {
-            emitParseError();
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
             m_token->setForceQuirks();
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndReconsumeIn(source, DataState);
         } else {
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
             ADVANCE_TO(BogusDOCTYPEState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(BeforeDOCTYPESystemIdentifierState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(BeforeDOCTYPESystemIdentifierState);
         if (cc == '"') {
             m_token->setSystemIdentifierToEmptyString();
@@ -1362,15 +1495,18 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
             m_token->setSystemIdentifierToEmptyString();
             ADVANCE_TO(DOCTYPESystemIdentifierSingleQuotedState);
         } else if (cc == '>') {
-            emitParseError();
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
             m_token->setForceQuirks();
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndReconsumeIn(source, DataState);
         } else {
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
             ADVANCE_TO(BogusDOCTYPEState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -1378,14 +1514,17 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         if (cc == '"')
             ADVANCE_TO(AfterDOCTYPESystemIdentifierState);
         else if (cc == '>') {
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndReconsumeIn(source, DataState);
         } else {
             m_token->appendToSystemIdentifier(cc);
             ADVANCE_TO(DOCTYPESystemIdentifierDoubleQuotedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -1393,41 +1532,49 @@ bool HTMLTokenizer::nextToken(SegmentedString& source, HTMLToken& token)
         if (cc == '\'')
             ADVANCE_TO(AfterDOCTYPESystemIdentifierState);
         else if (cc == '>') {
-            emitParseError();
+            parseError();
             m_token->setForceQuirks();
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndResumeIn(source, DataState);
+        } else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndReconsumeIn(source, DataState);
         } else {
             m_token->appendToSystemIdentifier(cc);
             ADVANCE_TO(DOCTYPESystemIdentifierSingleQuotedState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(AfterDOCTYPESystemIdentifierState) {
-        if (cc == '\x09' || cc == '\x0A' || cc == '\x0C' || cc == ' ')
+        if (isTokenizerWhitespace(cc))
             ADVANCE_TO(AfterDOCTYPESystemIdentifierState);
         else if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
-        else {
-            emitParseError();
+            return emitAndResumeIn(source, DataState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker) {
+            parseError();
+            m_token->setForceQuirks();
+            return emitAndReconsumeIn(source, DataState);
+        } else {
+            parseError();
             ADVANCE_TO(BogusDOCTYPEState);
         }
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(BogusDOCTYPEState) {
         if (cc == '>')
-            EMIT_AND_RESUME_IN(DataState);
+            return emitAndResumeIn(source, DataState);
+        else if (cc == InputStreamPreprocessor::endOfFileMarker)
+            return emitAndReconsumeIn(source, DataState);
         ADVANCE_TO(BogusDOCTYPEState);
-        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
     BEGIN_STATE(CDATASectionState) {
         notImplemented();
         ADVANCE_TO(CDATASectionState);
+        // FIXME: Handle EOF properly.
     }
     END_STATE()
 
@@ -1453,8 +1600,9 @@ inline bool HTMLTokenizer::isAppropriateEndTag()
     return m_bufferedEndTagName == m_appropriateEndTagName;
 }
 
-inline void HTMLTokenizer::emitCharacter(UChar character)
+inline void HTMLTokenizer::bufferCharacter(UChar character)
 {
+    ASSERT(character != InputStreamPreprocessor::endOfFileMarker);
     if (m_token->type() != HTMLToken::Character) {
         m_token->beginCharacter(character);
         return;
@@ -1462,28 +1610,21 @@ inline void HTMLTokenizer::emitCharacter(UChar character)
     m_token->appendToCharacter(character);
 }
 
-inline void HTMLTokenizer::emitCodePoint(unsigned value)
+inline void HTMLTokenizer::bufferCodePoint(unsigned value)
 {
     if (value < 0xFFFF) {
-        emitCharacter(value);
+        bufferCharacter(value);
         return;
     }
-    emitCharacter(U16_LEAD(value));
-    emitCharacter(U16_TRAIL(value));
+    bufferCharacter(U16_LEAD(value));
+    bufferCharacter(U16_TRAIL(value));
 }
 
-inline void HTMLTokenizer::emitParseError()
+inline void HTMLTokenizer::parseError()
 {
     notImplemented();
 }
 
-inline void HTMLTokenizer::emitCurrentToken()
-{
-    ASSERT(m_token->type() != HTMLToken::Uninitialized);
-    if (m_token->type() == HTMLToken::StartTag)
-        m_appropriateEndTagName = m_token->name();
-}
-
 inline bool HTMLTokenizer::shouldEmitBufferedCharacterToken(const SegmentedString& source)
 {
     return source.isClosed() && m_token->type() == HTMLToken::Character;
diff --git a/WebCore/html/HTMLTokenizer.h b/WebCore/html/HTMLTokenizer.h
index c2e52ab..96c2d7c 100644
--- a/WebCore/html/HTMLTokenizer.h
+++ b/WebCore/html/HTMLTokenizer.h
@@ -83,6 +83,10 @@ public:
         AfterAttributeValueQuotedState,
         SelfClosingStartTagState,
         BogusCommentState,
+        // The ContinueBogusCommentState is not in the HTML5 spec, but we use
+        // it internally to keep track of whether we've started the bogus
+        // comment token yet.
+        ContinueBogusCommentState,
         MarkupDeclarationOpenState,
         CommentStartState,
         CommentStartDashState,
@@ -164,7 +168,7 @@ private:
                 // a number of specific character values are parse errors and should be replaced
                 // by the replacement character. We suspect this is a problem with the spec as doing
                 // that filtering breaks surrogate pair handling and causes us not to match Minefield.
-                if (m_nextInputCharacter == '\0')
+                if (m_nextInputCharacter == '\0' && !shouldTreatNullAsEndOfFileMarker(source))
                     m_nextInputCharacter = 0xFFFD;
             }
             return true;
@@ -179,25 +183,40 @@ private:
             return peek(source, lineNumber);
         }
 
+        static const UChar endOfFileMarker;
+
     private:
+        bool shouldTreatNullAsEndOfFileMarker(SegmentedString& source) const
+        {
+            return source.isClosed() && source.length() == 1;
+        }
+
         // http://www.whatwg.org/specs/web-apps/current-work/#next-input-character
         UChar m_nextInputCharacter;
         bool m_skipNextNewLine;
     };
 
-    inline void emitCharacter(UChar);
-    inline void emitParseError();
-    inline void emitCurrentToken();
-    inline void emitCodePoint(unsigned);
+    inline bool processEntity(SegmentedString&);
+
+    inline void parseError();
+    inline void bufferCharacter(UChar);
+    inline void bufferCodePoint(unsigned);
 
-    inline bool processEntity(SegmentedString& source);
+    inline bool emitAndResumeIn(SegmentedString&, State);
+    inline bool emitAndReconsumeIn(SegmentedString&, State);
+    inline bool emitEndOfFile(SegmentedString&);
+    inline bool flushEmitAndResumeIn(SegmentedString&, State);
 
+    // Return whether we need to emit a character token before dealing with
+    // the buffered end tag.
+    inline bool flushBufferedEndTag(SegmentedString&);
     inline bool temporaryBufferIs(const String&);
 
     // Sometimes we speculatively consume input characters and we don't
     // know whether they represent end tags or RCDATA, etc.  These
     // functions help manage these state.
     inline void addToPossibleEndTag(UChar cc);
+    inline void saveEndTagNameIfNeeded();
     inline bool isAppropriateEndTag();
 
     inline bool shouldEmitBufferedCharacterToken(const SegmentedString&);
diff --git a/WebCore/html/HTMLTreeBuilder.cpp b/WebCore/html/HTMLTreeBuilder.cpp
index 6e40fd7..b4e7ce1 100644
--- a/WebCore/html/HTMLTreeBuilder.cpp
+++ b/WebCore/html/HTMLTreeBuilder.cpp
@@ -26,17 +26,27 @@
 #include "config.h"
 #include "HTMLTreeBuilder.h"
 
+#include "Comment.h"
 #include "DocumentFragment.h"
+#include "DocumentType.h"
 #include "Element.h"
 #include "Frame.h"
-#include "HTMLTokenizer.h"
-#include "HTMLToken.h"
 #include "HTMLDocument.h"
-#include "LegacyHTMLDocumentParser.h"
+#include "HTMLElementFactory.h"
+#include "HTMLHtmlElement.h"
 #include "HTMLNames.h"
+#include "HTMLScriptElement.h"
+#include "HTMLToken.h"
+#include "HTMLTokenizer.h"
+#include "LegacyHTMLDocumentParser.h"
 #include "LegacyHTMLTreeBuilder.h"
 #include "NotImplemented.h"
+#if ENABLE(SVG)
+#include "SVGNames.h"
+#endif
 #include "ScriptController.h"
+#include "Settings.h"
+#include "Text.h"
 #include <wtf/UnusedParam.h>
 
 namespace WebCore {
@@ -52,6 +62,142 @@ inline bool isTreeBuilderWhiteSpace(UChar cc)
     return cc == '\t' || cc == '\x0A' || cc == '\x0C' || cc == '\x0D' || cc == ' ';
 }
 
+bool shouldUseLegacyTreeBuilder(Document* document)
+{
+    return !document->settings() || !document->settings()->html5TreeBuilderEnabled();
+}
+
+bool isNumberedHeaderTag(const AtomicString& tagName)
+{
+    return tagName == h1Tag
+        || tagName == h2Tag
+        || tagName == h3Tag
+        || tagName == h4Tag
+        || tagName == h5Tag
+        || tagName == h6Tag;
+}
+
+bool isTableBodyContextTag(const AtomicString& tagName)
+{
+    return tagName == tbodyTag
+        || tagName == tfootTag
+        || tagName == theadTag;
+}
+
+// http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#special
+bool isSpecialTag(const AtomicString& tagName)
+{
+    return tagName == addressTag
+        || tagName == articleTag
+        || tagName == asideTag
+        || tagName == baseTag
+        || tagName == basefontTag
+        || tagName == "bgsound"
+        || tagName == blockquoteTag
+        || tagName == bodyTag
+        || tagName == brTag
+        || tagName == buttonTag
+        || tagName == centerTag
+        || tagName == colTag
+        || tagName == colgroupTag
+        || tagName == "command"
+        || tagName == ddTag
+        || tagName == "details"
+        || tagName == dirTag
+        || tagName == divTag
+        || tagName == dlTag
+        || tagName == dtTag
+        || tagName == embedTag
+        || tagName == fieldsetTag
+        || tagName == "figure"
+        || tagName == footerTag
+        || tagName == formTag
+        || tagName == frameTag
+        || tagName == framesetTag
+        || isNumberedHeaderTag(tagName)
+        || tagName == headTag
+        || tagName == headerTag
+        || tagName == hgroupTag
+        || tagName == hrTag
+        || tagName == iframeTag
+        || tagName == imgTag
+        || tagName == inputTag
+        || tagName == isindexTag
+        || tagName == liTag
+        || tagName == linkTag
+        || tagName == listingTag
+        || tagName == menuTag
+        || tagName == metaTag
+        || tagName == navTag
+        || tagName == noembedTag
+        || tagName == noframesTag
+        || tagName == noscriptTag
+        || tagName == olTag
+        || tagName == pTag
+        || tagName == paramTag
+        || tagName == plaintextTag
+        || tagName == preTag
+        || tagName == scriptTag
+        || tagName == sectionTag
+        || tagName == selectTag
+        || tagName == styleTag
+        || isTableBodyContextTag(tagName)
+        || tagName == textareaTag
+        || tagName == titleTag
+        || tagName == trTag
+        || tagName == ulTag
+        || tagName == wbrTag
+        || tagName == xmpTag;
+}
+
+// http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#scoping
+// Same as isScopingTag in LegacyHTMLTreeBuilder.cpp
+// and isScopeMarker in HTMLElementStack.cpp
+bool isScopingTag(const AtomicString& tagName)
+{
+    return tagName == appletTag
+        || tagName == buttonTag
+        || tagName == captionTag
+#if ENABLE(SVG_FOREIGN_OBJECT)
+        || tagName == SVGNames::foreignObjectTag
+#endif
+        || tagName == htmlTag
+        || tagName == marqueeTag
+        || tagName == objectTag
+        || tagName == tableTag
+        || tagName == tdTag
+        || tagName == thTag;
+}
+
+bool isNonAnchorFormattingTag(const AtomicString& tagName)
+{
+    return tagName == bTag
+        || tagName == bigTag
+        || tagName == codeTag
+        || tagName == emTag
+        || tagName == fontTag
+        || tagName == iTag
+        || tagName == nobrTag
+        || tagName == sTag
+        || tagName == smallTag
+        || tagName == strikeTag
+        || tagName == strongTag
+        || tagName == ttTag
+        || tagName == uTag;
+}
+
+// http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#formatting
+bool isFormattingTag(const AtomicString& tagName)
+{
+    return tagName == aTag || isNonAnchorFormattingTag(tagName);
+}
+
+// http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#phrasing
+bool isPhrasingTag(const AtomicString& tagName)
+{
+    return !isSpecialTag(tagName) && !isScopingTag(tagName) && !isFormattingTag(tagName);
+}
+
 } // namespace
 
 HTMLTreeBuilder::HTMLTreeBuilder(HTMLTokenizer* tokenizer, HTMLDocument* document, bool reportErrors)
@@ -60,11 +206,13 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLTokenizer* tokenizer, HTMLDocument* documen
     , m_reportErrors(reportErrors)
     , m_isPaused(false)
     , m_insertionMode(InitialMode)
+    , m_originalInsertionMode(InitialMode)
     , m_tokenizer(tokenizer)
-    , m_legacyTreeBuilder(new LegacyHTMLTreeBuilder(document, reportErrors))
+    , m_legacyTreeBuilder(shouldUseLegacyTreeBuilder(document) ? new LegacyHTMLTreeBuilder(document, reportErrors) : 0)
     , m_lastScriptElementStartLine(uninitializedLineNumberValue)
     , m_scriptToProcessStartLine(uninitializedLineNumberValue)
     , m_fragmentScriptingPermission(FragmentScriptingAllowed)
+    , m_isParsingFragment(false)
 {
 }
 
@@ -76,11 +224,13 @@ HTMLTreeBuilder::HTMLTreeBuilder(HTMLTokenizer* tokenizer, DocumentFragment* fra
     , m_reportErrors(false) // FIXME: Why not report errors in fragments?
     , m_isPaused(false)
     , m_insertionMode(InitialMode)
+    , m_originalInsertionMode(InitialMode)
     , m_tokenizer(tokenizer)
     , m_legacyTreeBuilder(new LegacyHTMLTreeBuilder(fragment, scriptingPermission))
     , m_lastScriptElementStartLine(uninitializedLineNumberValue)
     , m_scriptToProcessStartLine(uninitializedLineNumberValue)
     , m_fragmentScriptingPermission(scriptingPermission)
+    , m_isParsingFragment(true)
 {
 }
 
@@ -166,7 +316,7 @@ HTMLTokenizer::State HTMLTreeBuilder::adjustedLexerState(HTMLTokenizer::State st
     return state;
 }
 
-PassRefPtr<Node> HTMLTreeBuilder::passTokenToLegacyParser(HTMLToken& token)
+void HTMLTreeBuilder::passTokenToLegacyParser(HTMLToken& token)
 {
     if (token.type() == HTMLToken::DOCTYPE) {
         DoctypeToken doctypeToken;
@@ -176,9 +326,12 @@ PassRefPtr<Node> HTMLTreeBuilder::passTokenToLegacyParser(HTMLToken& token)
         doctypeToken.m_forceQuirks = token.forceQuirks();
 
         m_legacyTreeBuilder->parseDoctypeToken(&doctypeToken);
-        return 0;
+        return;
     }
 
+    if (token.type() == HTMLToken::EndOfFile)
+        return;
+
     // For now, we translate into an old-style token for testing.
     Token oldStyleToken;
     AtomicHTMLToken atomicToken(token);
@@ -214,371 +367,1302 @@ PassRefPtr<Node> HTMLTreeBuilder::passTokenToLegacyParser(HTMLToken& token)
         } else if (oldStyleToken.tagName == framesetTag)
             setInsertionMode(AfterFramesetMode);
     }
-    return result.release();
 }
 
-PassRefPtr<Node> HTMLTreeBuilder::constructTreeFromToken(HTMLToken& rawToken)
+void HTMLTreeBuilder::constructTreeFromToken(HTMLToken& rawToken)
 {
-    // Make MSVC ignore our unreachable code for now.
-    if (true)
-        return passTokenToLegacyParser(rawToken);
+    if (m_legacyTreeBuilder) {
+        passTokenToLegacyParser(rawToken);
+        return;
+    }
 
     AtomicHTMLToken token(rawToken);
+    processToken(token);
+}
+
+void HTMLTreeBuilder::processToken(AtomicHTMLToken& token)
+{
+    switch (token.type()) {
+    case HTMLToken::Uninitialized:
+        ASSERT_NOT_REACHED();
+        break;
+    case HTMLToken::DOCTYPE:
+        processDoctypeToken(token);
+        break;
+    case HTMLToken::StartTag:
+        processStartTag(token);
+        break;
+    case HTMLToken::EndTag:
+        processEndTag(token);
+        break;
+    case HTMLToken::Comment:
+        processComment(token);
+        return;
+    case HTMLToken::Character:
+        processCharacter(token);
+        break;
+    case HTMLToken::EndOfFile:
+        processEndOfFile(token);
+        break;
+    }
+}
+
+void HTMLTreeBuilder::processDoctypeToken(AtomicHTMLToken& token)
+{
+    if (insertionMode() == InitialMode) {
+        insertDoctype(token);
+        return;
+    }
+    parseError(token);
+}
 
-    // HTML5 expects the tokenizer to call the parser every time a character is
-    // emitted.  We instead collect characters and call the parser with a batch.
-    // In order to make our first-pass parser code simple, processToken matches
-    // the spec in only handling one character at a time.
-    if (token.type() == HTMLToken::Character) {
-        StringImpl* characters = token.characters().impl();
-        // FIXME: Calling processToken for each character is probably slow.
-        for (unsigned i = 0; i < characters->length(); ++i)
-            processToken(token, (*characters)[i]);
-        return 0; // FIXME: Should we be returning the Text node?
+void HTMLTreeBuilder::insertHTMLStartTagBeforeHTML(AtomicHTMLToken& token)
+{
+    RefPtr<Element> element = HTMLHtmlElement::create(m_document);
+    element->setAttributeMap(token.attributes(), m_fragmentScriptingPermission);
+    m_openElements.pushHTMLHtmlElement(attach(m_document, element.release()));
+}
+
+void HTMLTreeBuilder::mergeAttributesFromTokenIntoElement(AtomicHTMLToken& token, Element* element)
+{
+    if (!token.attributes())
+        return;
+
+    NamedNodeMap* attributes = element->attributes(false);
+    for (unsigned i = 0; i < token.attributes()->length(); ++i) {
+        Attribute* attribute = token.attributes()->attributeItem(i);
+        if (!attributes->getAttributeItem(attribute->name()))
+            element->setAttribute(attribute->name(), attribute->value());
     }
-    return processToken(token);
 }
 
-PassRefPtr<Node> HTMLTreeBuilder::processToken(AtomicHTMLToken& token, UChar cc)
+void HTMLTreeBuilder::insertHTMLStartTagInBody(AtomicHTMLToken& token)
+{
+    parseError(token);
+    mergeAttributesFromTokenIntoElement(token, m_openElements.htmlElement());
+}
+
+void HTMLTreeBuilder::processFakePEndTagIfPInScope()
+{
+    if (!m_openElements.inScope(pTag.localName()))
+        return;
+    AtomicHTMLToken endP(HTMLToken::EndTag, pTag.localName());
+    processEndTag(endP);
+}
+
+void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
 {
-reprocessToken:
     switch (insertionMode()) {
-    case InitialMode: {
-        switch (token.type()) {
-        case HTMLToken::Uninitialized:
-            ASSERT_NOT_REACHED();
-            break;
-        case HTMLToken::DOCTYPE:
-            return insertDoctype(token);
-        case HTMLToken::Comment:
-            return insertComment(token);
-        case HTMLToken::Character:
-            if (isTreeBuilderWhiteSpace(cc))
-                return 0;
-            break;
-        case HTMLToken::StartTag:
-        case HTMLToken::EndTag:
-        case HTMLToken::EndOfFile:
-            break;
+    case InitialMode:
+        ASSERT(insertionMode() == InitialMode);
+        processDefaultForInitialMode(token);
+        // Fall through.
+    case BeforeHTMLMode:
+        ASSERT(insertionMode() == BeforeHTMLMode);
+        if (token.name() == htmlTag) {
+            insertHTMLStartTagBeforeHTML(token);
+            setInsertionMode(BeforeHeadMode);
+            return;
         }
-        notImplemented();
-        parseError(token);
-        setInsertionMode(BeforeHTMLMode);
-        goto reprocessToken;
-    }
-    case BeforeHTMLMode: {
-        switch (token.type()) {
-        case HTMLToken::Uninitialized:
-            ASSERT_NOT_REACHED();
-            break;
-        case HTMLToken::DOCTYPE:
+        processDefaultForBeforeHTMLMode(token);
+        // Fall through.
+    case BeforeHeadMode:
+        ASSERT(insertionMode() == BeforeHeadMode);
+        if (token.name() == htmlTag) {
+            insertHTMLStartTagInBody(token);
+            return;
+        }
+        if (token.name() == headTag) {
+            insertHTMLHeadElement(token);
+            setInsertionMode(InHeadMode);
+            return;
+        }
+        processDefaultForBeforeHeadMode(token);
+        // Fall through.
+    case InHeadMode:
+        ASSERT(insertionMode() == InHeadMode);
+        if (processStartTagForInHead(token))
+            return;
+        processDefaultForInHeadMode(token);
+        // Fall through.
+    case AfterHeadMode:
+        ASSERT(insertionMode() == AfterHeadMode);
+        if (token.name() == htmlTag) {
+            insertHTMLStartTagInBody(token);
+            return;
+        }
+        if (token.name() == bodyTag) {
+            m_framesetOk = false;
+            insertHTMLBodyElement(token);
+            m_insertionMode = InBodyMode;
+            return;
+        }
+        if (token.name() == framesetTag) {
+            insertElement(token);
+            setInsertionMode(InFramesetMode);
+            return;
+        }
+        if (token.name() == baseTag || token.name() == linkTag || token.name() == metaTag || token.name() == noframesTag || token.name() == scriptTag || token.name() == styleTag || token.name() == titleTag) {
             parseError(token);
-            return 0;
-        case HTMLToken::Comment:
-            return insertComment(token);
-        case HTMLToken::Character:
-            if (isTreeBuilderWhiteSpace(cc))
-                return 0;
-            break;
-        case HTMLToken::StartTag:
-            if (token.name() == htmlTag) {
-                notImplemented();
-                setInsertionMode(BeforeHeadMode);
-                return 0;
-            }
-            break;
-        case HTMLToken::EndTag:
-            if (token.name() == headTag || token.name() == bodyTag || token.name() == htmlTag || token.name() == brTag)
-                break;
+            ASSERT(m_headElement);
+            m_openElements.pushHTMLHeadElement(m_headElement);
+            processStartTagForInHead(token);
+            m_openElements.removeHTMLHeadElement(m_headElement.get());
+            return;
+        }
+        if (token.name() == headTag) {
             parseError(token);
-            return 0;
-        case HTMLToken::EndOfFile:
-            break;
+            return;
         }
-        notImplemented();
-        setInsertionMode(BeforeHeadMode);
-        goto reprocessToken;
-    }
-    case BeforeHeadMode: {
-        switch (token.type()) {
-        case HTMLToken::Uninitialized:
-            ASSERT_NOT_REACHED();
-            break;
-        case HTMLToken::Character:
-            if (isTreeBuilderWhiteSpace(cc))
-                return 0;
-            break;
-        case HTMLToken::Comment:
-            return insertComment(token);
-        case HTMLToken::DOCTYPE:
+        processDefaultForAfterHeadMode(token);
+        // Fall through
+    case InBodyMode:
+        ASSERT(insertionMode() == InBodyMode);
+        if (token.name() == htmlTag) {
+            insertHTMLStartTagInBody(token);
+            return;
+        }
+        if (token.name() == baseTag || token.name() == "command" || token.name() == linkTag || token.name() == metaTag || token.name() == noframesTag || token.name() == scriptTag || token.name() == styleTag || token.name() == titleTag) {
+            bool didProcess = processStartTagForInHead(token);
+            ASSERT_UNUSED(didProcess, didProcess);
+            return;
+        }
+        if (token.name() == bodyTag) {
             parseError(token);
-            return 0;
-        case HTMLToken::StartTag:
-            if (token.name() == htmlTag) {
-                notImplemented();
-                return 0;
-            }
-            if (token.name() == headTag) {
-                m_headElement = insertElement(token);
-                setInsertionMode(InHeadMode);
-                return m_headElement;
+            notImplemented(); // fragment case
+            mergeAttributesFromTokenIntoElement(token, m_openElements.bodyElement());
+            return;
+        }
+        if (token.name() == framesetTag) {
+            parseError(token);
+            notImplemented(); // fragment case
+            if (!m_framesetOk)
+                return;
+            ExceptionCode ec = 0;
+            m_openElements.bodyElement()->remove(ec);
+            ASSERT(!ec);
+            m_openElements.popUntil(m_openElements.bodyElement());
+            m_openElements.popHTMLBodyElement();
+            ASSERT(m_openElements.top() == m_openElements.htmlElement());
+            insertElement(token);
+            m_insertionMode = InFramesetMode;
+            return;
+        }
+        if (token.name() == addressTag || token.name() == articleTag || token.name() == asideTag || token.name() == blockquoteTag || token.name() == centerTag || token.name() == "details" || token.name() == dirTag || token.name() == divTag || token.name() == dlTag || token.name() == fieldsetTag || token.name() == "figure" || token.name() == footerTag || token.name() == headerTag || token.name() == hgroupTag || token.name() == menuTag || token.name() == navTag || token.name() == olTag || token.name() == pTag || token.name() == sectionTag || token.name() == ulTag) {
+            processFakePEndTagIfPInScope();
+            insertElement(token);
+            return;
+        }
+        if (isNumberedHeaderTag(token.name())) {
+            processFakePEndTagIfPInScope();
+            notImplemented();
+            insertElement(token);
+            return;
+        }
+        if (token.name() == preTag || token.name() == listingTag) {
+            processFakePEndTagIfPInScope();
+            insertElement(token);
+            m_tokenizer->skipLeadingNewLineForListing();
+            m_framesetOk = false;
+            return;
+        }
+        if (token.name() == formTag) {
+            notImplemented();
+            processFakePEndTagIfPInScope();
+            insertElement(token);
+            m_formElement = currentElement();
+            return;
+        }
+        if (token.name() == liTag) {
+            notImplemented();
+            processFakePEndTagIfPInScope();
+            insertElement(token);
+            return;
+        }
+        if (token.name() == ddTag || token.name() == dtTag) {
+            notImplemented();
+            processFakePEndTagIfPInScope();
+            insertElement(token);
+            return;
+        }
+        if (token.name() == plaintextTag) {
+            processFakePEndTagIfPInScope();
+            insertElement(token);
+            m_tokenizer->setState(HTMLTokenizer::PLAINTEXTState);
+            return;
+        }
+        if (token.name() == buttonTag) {
+            notImplemented();
+            reconstructTheActiveFormattingElements();
+            insertElement(token);
+            m_framesetOk = false;
+            return;
+        }
+        if (token.name() == aTag) {
+            notImplemented();
+            reconstructTheActiveFormattingElements();
+            insertFormattingElement(token);
+            return;
+        }
+        if (isNonAnchorFormattingTag(token.name())) {
+            reconstructTheActiveFormattingElements();
+            insertFormattingElement(token);
+            return;
+        }
+        if (token.name() == nobrTag) {
+            reconstructTheActiveFormattingElements();
+            notImplemented();
+            insertFormattingElement(token);
+            return;
+        }
+        if (token.name() == appletTag || token.name() == marqueeTag || token.name() == objectTag) {
+            reconstructTheActiveFormattingElements();
+            insertElement(token);
+            notImplemented();
+            m_framesetOk = false;
+            return;
+        }
+        if (token.name() == tableTag) {
+            notImplemented();
+            insertElement(token);
+            m_framesetOk = false;
+            m_insertionMode = InTableMode;
+            return;
+        }
+        if (token.name() == imageTag) {
+            parseError(token);
+            // Apparently we're not supposed to ask.
+            token.setName(imgTag.localName());
+            // Note the fall through to the imgTag handling below!
+        }
+        if (token.name() == areaTag || token.name() == basefontTag || token.name() == "bgsound" || token.name() == brTag || token.name() == embedTag || token.name() == imgTag || token.name() == inputTag || token.name() == keygenTag || token.name() == wbrTag) {
+            reconstructTheActiveFormattingElements();
+            insertSelfClosingElement(token);
+            m_framesetOk = false;
+            return;
+        }
+        if (token.name() == paramTag || token.name() == sourceTag || token.name() == "track") {
+            insertSelfClosingElement(token);
+            return;
+        }
+        if (token.name() == hrTag) {
+            processFakePEndTagIfPInScope();
+            insertSelfClosingElement(token);
+            m_framesetOk = false;
+            return;
+        }
+        if (token.name() == isindexTag) {
+            parseError(token);
+            notImplemented();
+            return;
+        }
+        if (token.name() == textareaTag) {
+            insertElement(token);
+            m_tokenizer->skipLeadingNewLineForListing();
+            m_tokenizer->setState(HTMLTokenizer::RCDATAState);
+            m_originalInsertionMode = m_insertionMode;
+            m_framesetOk = false;
+            m_insertionMode = TextMode;
+            return;
+        }
+        if (token.name() == xmpTag) {
+            processFakePEndTagIfPInScope();
+            reconstructTheActiveFormattingElements();
+            m_framesetOk = false;
+            insertGenericRawTextElement(token);
+            return;
+        }
+        if (token.name() == iframeTag) {
+            m_framesetOk = false;
+            insertGenericRawTextElement(token);
+            return;
+        }
+        if (token.name() == noembedTag) {
+            insertGenericRawTextElement(token);
+            return;
+        }
+        if (token.name() == noscriptTag && isScriptingFlagEnabled(m_document->frame())) {
+            insertGenericRawTextElement(token);
+            return;
+        }
+        if (token.name() == selectTag) {
+            reconstructTheActiveFormattingElements();
+            insertElement(token);
+            m_framesetOk = false;
+            if (m_insertionMode == InTableMode || m_insertionMode == InCaptionMode || m_insertionMode == InColumnGroupMode || m_insertionMode == InTableBodyMode || m_insertionMode == InRowMode || m_insertionMode == InCellMode)
+                m_insertionMode = InSelectInTableMode;
+            else
+                m_insertionMode = InSelectMode;
+            return;
+        }
+        if (token.name() == optgroupTag || token.name() == optionTag) {
+            if (m_openElements.inScope(optionTag.localName())) {
+                AtomicHTMLToken endOption(HTMLToken::EndTag, optionTag.localName());
+                processEndTag(endOption);
             }
-            break;
-        case HTMLToken::EndTag:
-            if (token.name() == headTag || token.name() == bodyTag || token.name() == brTag) {
-                AtomicHTMLToken fakeHead(HTMLToken::StartTag, headTag.localName());
-                processToken(fakeHead);
-                goto reprocessToken;
+            reconstructTheActiveFormattingElements();
+            insertElement(token);
+            return;
+        }
+        if (token.name() == rpTag || token.name() == rtTag) {
+            if (m_openElements.inScope(rubyTag.localName())) {
+                generateImpliedEndTags();
+                if (!currentElement()->hasTagName(rubyTag)) {
+                    parseError(token);
+                    m_openElements.popUntil(rubyTag.localName());
+                }
             }
+            insertElement(token);
+            return;
+        }
+        if (token.name() == "math") {
+            // This is the MathML foreign content branch point.
+            notImplemented();
+        }
+        if (token.name() == "svg") {
+            // This is the SVG foreign content branch point.
+            notImplemented();
+        }
+        if (token.name() == captionTag || token.name() == colTag || token.name() == colgroupTag || token.name() == frameTag || token.name() == headTag || token.name() == tbodyTag || token.name() == tdTag || token.name() == tfootTag || token.name() == thTag || token.name() == theadTag || token.name() == trTag) {
+            parseError(token);
+            return;
+        }
+        reconstructTheActiveFormattingElements();
+        insertElement(token);
+        break;
+    case InTableMode:
+        ASSERT(insertionMode() == InTableMode);
+        if (token.name() == captionTag) {
+            m_openElements.popUntilTableScopeMarker();
+            m_activeFormattingElements.appendMarker();
+            insertElement(token);
+            m_insertionMode = InCaptionMode;
+            return;
+        }
+        if (token.name() == colgroupTag) {
+            m_openElements.popUntilTableScopeMarker();
+            insertElement(token);
+            m_insertionMode = InColumnGroupMode;
+            return;
+        }
+        if (token.name() == colTag) {
+            notImplemented();
+            return;
+        }
+        if (isTableBodyContextTag(token.name())) {
+            m_openElements.popUntilTableScopeMarker();
+            insertElement(token);
+            m_insertionMode = InTableBodyMode;
+            return;
+        }
+        if (token.name() == tdTag || token.name() == thTag || token.name() == trTag) {
+            notImplemented();
+            return;
+        }
+        if (token.name() == tableTag) {
+            notImplemented();
+            return;
+        }
+        if (token.name() == styleTag || token.name() == scriptTag) {
+            processStartTagForInHead(token);
+            return;
+        }
+        if (token.name() == inputTag) {
+            notImplemented();
+            return;
+        }
+        if (token.name() == formTag) {
+            parseError(token);
+            if (m_formElement)
+                return;
+            insertSelfClosingElement(token);
+            return;
+        }
+        parseError(token);
+        notImplemented();
+        break;
+    case InTableBodyMode:
+        ASSERT(insertionMode() == InTableBodyMode);
+        if (token.name() == trTag) {
+            m_openElements.popUntilTableBodyScopeMarker(); // How is there ever anything to pop?
+            insertElement(token);
+            m_insertionMode = InRowMode;
+            return;
+        }
+        if (token.name() == thTag || token.name() == tdTag) {
+            parseError(token);
+            AtomicHTMLToken fakeToken(HTMLToken::StartTag, trTag.localName());
+            processStartTag(fakeToken);
+            ASSERT(insertionMode() == InRowMode);
+            processStartTag(token);
+            return;
+        }
+        if (token.name() == captionTag || token.name() == colTag || token.name() == colgroupTag || isTableBodyContextTag(token.name())) {
+            // FIXME: The spec is unclear as to what is supposed to happen here.
+            notImplemented();
+            return;
+        }
+        notImplemented(); // process using "in table" rules
+        break;
+    case AfterBodyMode:
+    case AfterAfterBodyMode:
+        ASSERT(insertionMode() == AfterBodyMode || insertionMode() == AfterAfterBodyMode);
+        if (token.name() == htmlTag) {
+            insertHTMLStartTagInBody(token);
+            return;
+        }
+        m_insertionMode = InBodyMode;
+        processStartTag(token);
+        break;
+    case InHeadNoscriptMode:
+        ASSERT(insertionMode() == InHeadNoscriptMode);
+        if (token.name() == htmlTag) {
+            insertHTMLStartTagInBody(token);
+            return;
+        }
+        if (token.name() == linkTag || token.name() == metaTag || token.name() == noframesTag || token.name() == styleTag) {
+            bool didProcess = processStartTagForInHead(token);
+            ASSERT_UNUSED(didProcess, didProcess);
+            return;
+        }
+        if (token.name() == htmlTag || token.name() == noscriptTag) {
             parseError(token);
-            return 0;
-        case HTMLToken::EndOfFile:
-            break;
+            return;
+        }
+        processDefaultForInHeadNoscriptMode(token);
+        processToken(token);
+        break;
+    case InFramesetMode:
+        ASSERT(insertionMode() == InFramesetMode);
+        if (token.name() == htmlTag) {
+            insertHTMLStartTagInBody(token);
+            return;
+        }
+        if (token.name() == framesetTag) {
+            insertElement(token);
+            return;
+        }
+        if (token.name() == frameTag) {
+            insertSelfClosingElement(token);
+            return;
+        }
+        if (token.name() == noframesTag) {
+            processStartTagForInHead(token);
+            return;
         }
-        AtomicHTMLToken fakeHead(HTMLToken::StartTag, headTag.localName());
-        processToken(fakeHead);
-        goto reprocessToken;
+        parseError(token);
+        break;
+    case AfterFramesetMode:
+    case AfterAfterFramesetMode:
+        ASSERT(insertionMode() == AfterFramesetMode || insertionMode() == AfterAfterFramesetMode);
+        if (token.name() == htmlTag) {
+            insertHTMLStartTagInBody(token);
+            return;
+        }
+        if (token.name() == noframesTag) {
+            processStartTagForInHead(token);
+            return;
+        }
+        parseError(token);
+        break;
+    default:
+        notImplemented();
+    }
+}
+
+bool HTMLTreeBuilder::processBodyEndTagForInBody(AtomicHTMLToken& token)
+{
+    if (!m_openElements.inScope(bodyTag.localName())) {
+        parseError(token);
+        return false;
     }
-    case InHeadMode: {
-        switch (token.type()) {
-        case HTMLToken::Uninitialized:
-            ASSERT_NOT_REACHED();
-            break;
-        case HTMLToken::Character:
-            insertCharacter(cc);
-            break;
-        case HTMLToken::Comment:
-            return insertComment(token);
-        case HTMLToken::DOCTYPE:
+    notImplemented();
+    m_insertionMode = AfterBodyMode;
+    return true;
+}
+
+// FIXME: This probably belongs on HTMLElementStack.
+HTMLElementStack::ElementRecord* HTMLTreeBuilder::furthestBlockForFormattingElement(Element* formattingElement)
+{
+    HTMLElementStack::ElementRecord* furthestBlock = 0;
+    HTMLElementStack::ElementRecord* record = m_openElements.topRecord();
+    for (; record; record = record->next()) {
+        if (record->element() == formattingElement)
+            return furthestBlock;
+        const AtomicString& tagName = record->element()->localName();
+        // !phrasing && !formatting == scoping || special
+        if (isScopingTag(tagName) || isSpecialTag(tagName))
+            furthestBlock = record;
+    }
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+void HTMLTreeBuilder::findFosterParentFor(Element* element)
+{
+    Element* fosterParentElement = 0;
+    HTMLElementStack::ElementRecord* lastTableElementRecord = m_openElements.topmost(tableTag.localName());
+    if (lastTableElementRecord) {
+        Element* lastTableElement = lastTableElementRecord->element();
+        if (lastTableElement->parent()) {
+            // FIXME: We need an insertElement which does not send mutation events.
+            ExceptionCode ec = 0;
+            lastTableElement->parent()->insertBefore(element, lastTableElement, ec);
+            ASSERT(!ec);
+            return;
+        }
+        fosterParentElement = lastTableElementRecord->next()->element();
+    } else {
+        ASSERT(m_isParsingFragment);
+        fosterParentElement = m_openElements.bottom(); // <html> element
+    }
+
+    fosterParentElement->parserAddChild(element);
+}
+
+// FIXME: This should have a whitty name.
+// FIXME: This must be implemented in many other places in WebCore.
+void HTMLTreeBuilder::reparentChildren(Element* oldParent, Element* newParent)
+{
+    Node* child = oldParent->firstChild();
+    while (child) {
+        Node* nextChild = child->nextSibling();
+        ExceptionCode ec;
+        newParent->appendChild(child, ec);
+        ASSERT(!ec);
+        child = nextChild;
+    }
+}
+
+// http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#parsing-main-inbody
+void HTMLTreeBuilder::callTheAdoptionAgency(AtomicHTMLToken& token)
+{
+    while (1) {
+        // 1.
+        Element* formattingElement = m_activeFormattingElements.closestElementInScopeWithName(token.name());
+        if (!formattingElement || !m_openElements.inScope(formattingElement)) {
             parseError(token);
-            return 0;
-        case HTMLToken::StartTag:
-            if (token.name() == htmlTag) {
-                notImplemented();
-                return 0;
-            }
-            // FIXME: Atomize "command".
-            if (token.name() == baseTag || token.name() == "command" || token.name() == linkTag) {
-                PassRefPtr<Node> node = insertElement(token);
-                m_openElements.pop();
-                notImplemented();
-                return node;
-            }
-            if (token.name() == metaTag) {
-                PassRefPtr<Node> node = insertElement(token);
-                m_openElements.pop();
-                notImplemented();
-                return node;
-            }
-            if (token.name() == titleTag)
-                return insertGenericRCDATAElement(token);
-            if (token.name() == noscriptTag) {
-                if (isScriptingFlagEnabled(m_document->frame()))
-                    return insertGenericRawTextElement(token);
-                PassRefPtr<Node> node = insertElement(token);
-                setInsertionMode(InHeadNoscriptMode);
-                return node;
-            }
-            if (token.name() == noframesTag || token.name() == styleTag)
-                return insertGenericRawTextElement(token);
-            if (token.name() == scriptTag)
-                return insertScriptElement(token);
-            if (token.name() == headTag) {
-                notImplemented();
-                return 0;
-            }
-            break;
-        case HTMLToken::EndTag:
-            if (token.name() == headTag) {
-                ASSERT(m_openElements.top()->tagQName() == headTag);
-                m_openElements.pop();
-                setInsertionMode(AfterHeadMode);
-                return 0;
+            notImplemented(); // Check the stack of open elements for a more specific parse error.
+            return;
+        }
+        HTMLElementStack::ElementRecord* formattingElementRecord = m_openElements.find(formattingElement);
+        if (!formattingElementRecord) {
+            parseError(token);
+            m_activeFormattingElements.remove(formattingElement);
+            return;
+        }
+        if (formattingElement != currentElement())
+            parseError(token);
+        // 2.
+        HTMLElementStack::ElementRecord* furthestBlock = furthestBlockForFormattingElement(formattingElement);
+        // 3.
+        if (!furthestBlock) {
+            m_openElements.popUntil(formattingElement);
+            m_openElements.pop();
+            m_activeFormattingElements.remove(formattingElement);
+            return;
+        }
+        // 4.
+        ASSERT(furthestBlock->isAbove(formattingElementRecord));
+        Element* commonAncestor = formattingElementRecord->next()->element();
+        // 5.
+        notImplemented(); // bookmark?
+        // 6.
+        HTMLElementStack::ElementRecord* node = furthestBlock;
+        HTMLElementStack::ElementRecord* nextNode = node->next();
+        HTMLElementStack::ElementRecord* lastNode = furthestBlock;
+        while (1) {
+            // 6.1
+            node = nextNode;
+            ASSERT(node);
+            nextNode = node->next(); // Save node->next() for the next iteration in case node is deleted in 6.2.
+            // 6.2
+            if (!m_activeFormattingElements.contains(node->element())) {
+                m_openElements.remove(node->element());
+                node = 0;
+                continue;
             }
-            if (token.name() == bodyTag || token.name() == htmlTag || token.name() == brTag)
+            // 6.3
+            if (node == formattingElementRecord)
                 break;
-            parseError(token);
-            return 0;
-            break;
-        case HTMLToken::EndOfFile:
-            break;
-        }
-        AtomicHTMLToken fakeHead(HTMLToken::EndTag, headTag.localName());
-        processToken(fakeHead);
-        goto reprocessToken;
+            // 6.4
+            if (lastNode == furthestBlock)
+                notImplemented(); // move bookmark.
+            // 6.5
+            // FIXME: We're supposed to save the original token in the entry.
+            AtomicHTMLToken fakeToken(HTMLToken::StartTag, node->element()->localName());
+            // Is createElement correct? (instead of insertElement)
+            // Does this code ever leave newElement unattached?
+            RefPtr<Element> newElement = createElement(fakeToken);
+            HTMLFormattingElementList::Entry* nodeEntry = m_activeFormattingElements.find(node->element());
+            nodeEntry->replaceElement(newElement.get());
+            node->replaceElement(newElement.release());
+            // 6.6
+            // Use appendChild instead of parserAddChild to handle possible reparenting.
+            ExceptionCode ec;
+            node->element()->appendChild(lastNode->element(), ec);
+            ASSERT(!ec);
+            // 6.7
+            lastNode = node;
+        }
+        // 7
+        const AtomicString& commonAncestorTag = commonAncestor->localName();
+        if (commonAncestorTag == tableTag
+            || commonAncestorTag == trTag
+            || isTableBodyContextTag(commonAncestorTag))
+            findFosterParentFor(lastNode->element());
+        else {
+            ExceptionCode ec;
+            commonAncestor->appendChild(lastNode->element(), ec);
+            ASSERT(!ec);
+        }
+        // 8
+        // FIXME: We're supposed to save the original token in the entry.
+        AtomicHTMLToken fakeToken(HTMLToken::StartTag, formattingElement->localName());
+        RefPtr<Element> newElement = createElement(fakeToken);
+        // 9
+        reparentChildren(furthestBlock->element(), newElement.get());
+        // 10
+        furthestBlock->element()->parserAddChild(newElement);
+        // 11
+        m_activeFormattingElements.remove(formattingElement);
+        notImplemented(); // insert new element at bookmark
+        // 12
+        m_openElements.remove(formattingElement);
+        m_openElements.insertAbove(newElement, furthestBlock);
     }
-    case InHeadNoscriptMode: {
-        switch (token.type()) {
-        case HTMLToken::Uninitialized:
-            ASSERT_NOT_REACHED();
-            break;
-        case HTMLToken::DOCTYPE:
+}
+
+void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
+{
+    switch (insertionMode()) {
+    case InitialMode:
+        ASSERT(insertionMode() == InitialMode);
+        processDefaultForInitialMode(token);
+        // Fall through.
+    case BeforeHTMLMode:
+        ASSERT(insertionMode() == BeforeHTMLMode);
+        if (token.name() != headTag && token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
             parseError(token);
-            return 0;
-        case HTMLToken::StartTag:
-            if (token.name() == htmlTag) {
-                notImplemented();
-                return 0;
-            }
-            if (token.name() == linkTag || token.name() == metaTag || token.name() == noframesTag || token.name() == styleTag) {
-                notImplemented();
-                return 0;
-            }
-            if (token.name() == htmlTag || token.name() == noscriptTag) {
+            return;
+        }
+        processDefaultForBeforeHTMLMode(token);
+        // Fall through.
+    case BeforeHeadMode:
+        ASSERT(insertionMode() == BeforeHeadMode);
+        if (token.name() != headTag && token.name() != bodyTag && token.name() != brTag) {
+            parseError(token);
+            return;
+        }
+        processDefaultForBeforeHeadMode(token);
+        // Fall through.
+    case InHeadMode:
+        ASSERT(insertionMode() == InHeadMode);
+        if (token.name() == headTag) {
+            m_openElements.popHTMLHeadElement();
+            setInsertionMode(AfterHeadMode);
+            return;
+        }
+        if (token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
+            parseError(token);
+            return;
+        }
+        processDefaultForInHeadMode(token);
+        // Fall through.
+    case AfterHeadMode:
+        ASSERT(insertionMode() == AfterHeadMode);
+        if (token.name() != bodyTag && token.name() != htmlTag && token.name() != brTag) {
+            parseError(token);
+            return;
+        }
+        processDefaultForAfterHeadMode(token);
+        // Fall through
+    case InBodyMode:
+        ASSERT(insertionMode() == InBodyMode);
+        if (token.name() == bodyTag) {
+            processBodyEndTagForInBody(token);
+            return;
+        }
+        if (token.name() == htmlTag) {
+            if (processBodyEndTagForInBody(token))
+                processEndTag(token);
+            return;
+        }
+        if (token.name() == addressTag || token.name() == articleTag || token.name() == asideTag || token.name() == blockquoteTag || token.name() == buttonTag || token.name() == centerTag || token.name() == "details" || token.name() == dirTag || token.name() == divTag || token.name() == dlTag || token.name() == fieldsetTag || token.name() == "figure" || token.name() == footerTag || token.name() == headerTag || token.name() == hgroupTag || token.name() == listingTag || token.name() == menuTag || token.name() == navTag || token.name() == olTag || token.name() == preTag || token.name() == sectionTag || token.name() == ulTag) {
+            if (!m_openElements.inScope(token.name())) {
                 parseError(token);
-                return 0;
+                return;
             }
-            break;
-        case HTMLToken::EndTag:
-            if (token.name() == noscriptTag) {
-                ASSERT(m_openElements.top()->tagQName() == noscriptTag);
-                m_openElements.pop();
-                ASSERT(m_openElements.top()->tagQName() == headTag);
-                setInsertionMode(InHeadMode);
-                return 0;
-            }
-            if (token.name() == brTag)
-                break;
-            parseError(token);
-            return 0;
-        case HTMLToken::Character:
-            notImplemented();
-            break;
-        case HTMLToken::Comment:
-            notImplemented();
-            return 0;
-        case HTMLToken::EndOfFile:
-            break;
+            generateImpliedEndTags();
+            if (currentElement()->tagQName() != token.name())
+                parseError(token);
+            m_openElements.popUntil(token.name());
+            m_openElements.pop();
         }
-        AtomicHTMLToken fakeNoscript(HTMLToken::EndTag, noscriptTag.localName());
-        processToken(fakeNoscript);
-        goto reprocessToken;
-    }
-    case AfterHeadMode: {
-        switch (token.type()) {
-        case HTMLToken::Uninitialized:
-            ASSERT_NOT_REACHED();
-            break;
-        case HTMLToken::Character:
-            if (isTreeBuilderWhiteSpace(cc)) {
-                insertCharacter(cc);
-                return 0;
+        if (token.name() == formTag) {
+            RefPtr<Element> node = m_formElement.release();
+            if (!node || !m_openElements.inScope(node.get())) {
+                parseError(token);
+                return;
             }
-            break;
-        case HTMLToken::Comment:
-            return insertComment(token);
-        case HTMLToken::DOCTYPE:
-            parseError(token);
-            return 0;
-        case HTMLToken::StartTag:
-            if (token.name() == htmlTag) {
+            generateImpliedEndTags();
+            if (currentElement() != node.get())
+                parseError(token);
+            m_openElements.remove(node.get());
+        }
+        if (token.name() == pTag) {
+            if (!m_openElements.inScope(token.name())) {
+                parseError(token);
                 notImplemented();
-                return 0;
+                return;
             }
-            if (token.name() == bodyTag) {
-                m_framesetOk = false;
-                return insertElement(token);
+            generateImpliedEndTagsWithExclusion(token.name());
+            if (!currentElement()->hasLocalName(token.name()))
+                parseError(token);
+            m_openElements.popUntil(token.name());
+            m_openElements.pop();
+            return;
+        }
+        if (token.name() == liTag) {
+            if (!m_openElements.inListItemScope(token.name())) {
+                parseError(token);
+                return;
             }
-            if (token.name() == framesetTag) {
-                PassRefPtr<Node> node = insertElement(token);
-                setInsertionMode(InFramesetMode);
-                return node;
+            generateImpliedEndTagsWithExclusion(token.name());
+            if (!currentElement()->hasLocalName(token.name()))
+                parseError(token);
+            m_openElements.popUntil(token.name());
+            m_openElements.pop();
+            return;
+        }
+        if (token.name() == ddTag || token.name() == dtTag) {
+            if (!m_openElements.inScope(token.name())) {
+                parseError(token);
+                return;
             }
-            if (token.name() == baseTag || token.name() == linkTag || token.name() == metaTag || token.name() == noframesTag || token.name() == scriptTag || token.name() == styleTag || token.name() == titleTag) {
+            generateImpliedEndTagsWithExclusion(token.name());
+            if (!currentElement()->hasLocalName(token.name()))
                 parseError(token);
-                ASSERT(m_headElement);
-                m_openElements.push(m_headElement.get());
-                notImplemented();
-                m_openElements.remove(m_headElement.get());
+            m_openElements.popUntil(token.name());
+            m_openElements.pop();
+            return;
+        }
+        if (isNumberedHeaderTag(token.name())) {
+            if (!m_openElements.inScope(token.name())) {
+                parseError(token);
+                return;
             }
-            if (token.name() == headTag) {
+            generateImpliedEndTags();
+            if (!currentElement()->hasLocalName(token.name()))
                 parseError(token);
-                return 0;
+            m_openElements.popUntil(token.name());
+            m_openElements.pop();
+            return;
+        }
+        if (token.name() == "sarcasm") {
+            notImplemented(); // Take a deep breath.
+            return;
+        }
+        if (isFormattingTag(token.name())) {
+            callTheAdoptionAgency(token);
+            return;
+        }
+        if (token.name() == appletTag || token.name() == marqueeTag || token.name() == objectTag) {
+            if (!m_openElements.inScope(token.name())) {
+                parseError(token);
+                return;
             }
-            break;
-        case HTMLToken::EndTag:
-            if (token.name() == bodyTag || token.name() == htmlTag || token.name() == brTag)    
-                break;
+            generateImpliedEndTags();
+            if (currentElement()->tagQName() != token.name())
+                parseError(token);
+            m_openElements.popUntil(token.name());
+            m_openElements.pop();
+            m_activeFormattingElements.clearToLastMarker();
+            return;
+        }
+        if (token.name() == brTag) {
+            parseError(token);
+            reconstructTheActiveFormattingElements();
+            // Notice that we lose the attributes.
+            AtomicHTMLToken startBr(HTMLToken::StartTag, token.name());
+            insertSelfClosingElement(startBr);
+            m_framesetOk = false;
+            return;
+        }
+        // FIXME: We need an iterator over m_openElements to implement this
+        // correctly.
+        notImplemented();
+        if (!m_openElements.inScope(token.name()))
+            return;
+        m_openElements.popUntil(token.name());
+        m_openElements.pop();
+        break;
+    case AfterBodyMode:
+        ASSERT(insertionMode() == AfterBodyMode);
+        if (token.name() == htmlTag) {
+            if (m_isParsingFragment) {
+                parseError(token);
+                return;
+            }
+            m_insertionMode = AfterAfterBodyMode;
+            return;
+        }
+        // Fall through.
+    case AfterAfterBodyMode:
+        ASSERT(insertionMode() == AfterBodyMode || insertionMode() == AfterAfterBodyMode);
+        parseError(token);
+        m_insertionMode = InBodyMode;
+        processEndTag(token);
+        break;
+    case InHeadNoscriptMode:
+        ASSERT(insertionMode() == InHeadNoscriptMode);
+        if (token.name() == noscriptTag) {
+            ASSERT(currentElement()->tagQName() == noscriptTag);
+            m_openElements.pop();
+            ASSERT(currentElement()->tagQName() == headTag);
+            setInsertionMode(InHeadMode);
+            return;
+        }
+        if (token.name() != brTag) {
             parseError(token);
-            return 0;
-        case HTMLToken::EndOfFile:
-            break;
-        }
-        AtomicHTMLToken fakeBody(HTMLToken::StartTag, bodyTag.localName());
-        processToken(fakeBody);
-        m_framesetOk = true;
-        goto reprocessToken;
+            return;
+        }
+        processDefaultForInHeadNoscriptMode(token);
+        processToken(token);
+        break;
+    case TextMode:
+        if (token.name() == scriptTag) {
+            // Pause ourselves so that parsing stops until the script can be processed by the caller.
+            m_isPaused = true;
+            ASSERT(currentElement()->tagQName() == scriptTag);
+            m_scriptToProcess = currentElement();
+            m_openElements.pop();
+            m_insertionMode = m_originalInsertionMode;
+            return;
+        }
+        m_openElements.pop();
+        m_insertionMode = m_originalInsertionMode;
+        break;
+    case InFramesetMode:
+        ASSERT(insertionMode() == InFramesetMode);
+        if (token.name() == framesetTag) {
+            if (currentElement() == m_openElements.htmlElement()) {
+                parseError(token);
+                return;
+            }
+            m_openElements.pop();
+            if (!m_isParsingFragment && !currentElement()->hasTagName(framesetTag))
+                m_insertionMode = AfterFramesetMode;
+            return;
+        }
+        break;
+    case AfterFramesetMode:
+        ASSERT(insertionMode() == AfterFramesetMode);
+        if (token.name() == htmlTag) {
+            m_insertionMode = AfterAfterFramesetMode;
+            return;
+        }
+        // Fall through.
+    case AfterAfterFramesetMode:
+        ASSERT(insertionMode() == AfterFramesetMode || insertionMode() == AfterAfterFramesetMode);
+        parseError(token);
+        break;
+    default:
+        notImplemented();
     }
+}
+
+void HTMLTreeBuilder::processComment(AtomicHTMLToken& token)
+{
+    if (m_insertionMode == InitialMode || m_insertionMode == BeforeHTMLMode || m_insertionMode == AfterAfterBodyMode || m_insertionMode == AfterAfterFramesetMode) {
+        insertCommentOnDocument(token);
+        return;
+    }
+    if (m_insertionMode == AfterBodyMode) {
+        insertCommentOnHTMLHtmlElement(token);
+        return;
+    }
+    insertComment(token);
+}
+
+void HTMLTreeBuilder::processCharacter(AtomicHTMLToken& token)
+{
+    // FIXME: We need to figure out how to handle each character individually.
+    switch (insertionMode()) {
+    case InitialMode:
+        ASSERT(insertionMode() == InitialMode);
+        notImplemented();
+        processDefaultForInitialMode(token);
+        // Fall through.
+    case BeforeHTMLMode:
+        ASSERT(insertionMode() == BeforeHTMLMode);
+        notImplemented();
+        processDefaultForBeforeHTMLMode(token);
+        // Fall through.
+    case BeforeHeadMode:
+        ASSERT(insertionMode() == BeforeHeadMode);
+        notImplemented();
+        processDefaultForBeforeHeadMode(token);
+        // Fall through.
+    case InHeadMode:
+        ASSERT(insertionMode() == InHeadMode);
+        notImplemented();
+        processDefaultForInHeadMode(token);
+        // Fall through.
+    case AfterHeadMode:
+        ASSERT(insertionMode() == AfterHeadMode);
+        notImplemented();
+        processDefaultForAfterHeadMode(token);
+        // Fall through
     case InBodyMode:
-    case TextMode:
-    case InTableMode:
-    case InTableTextMode:
-    case InCaptionMode:
-    case InColumnGroupMode:
-    case InTableBodyMode:
-    case InRowMode:
-    case InCellMode:
-    case InSelectMode:
-    case InSelectInTableMode:
-    case InForeignContentMode:
+        ASSERT(insertionMode() == InBodyMode);
+        notImplemented();
+        insertTextNode(token);
+        break;
     case AfterBodyMode:
+    case AfterAfterBodyMode:
+        ASSERT(insertionMode() == AfterBodyMode || insertionMode() == AfterAfterBodyMode);
+        parseError(token);
+        m_insertionMode = InBodyMode;
+        processCharacter(token);
+        break;
+    case TextMode:
+        notImplemented();
+        insertTextNode(token);
+        break;
+    case InHeadNoscriptMode:
+        ASSERT(insertionMode() == InHeadNoscriptMode);
+        processDefaultForInHeadNoscriptMode(token);
+        processToken(token);
+        break;
     case InFramesetMode:
     case AfterFramesetMode:
+    case AfterAfterFramesetMode:
+        ASSERT(insertionMode() == InFramesetMode || insertionMode() == AfterFramesetMode || insertionMode() == AfterAfterFramesetMode);
+        parseError(token);
+        break;
+    default:
+        notImplemented();
+    }
+}
+
+void HTMLTreeBuilder::processEndOfFile(AtomicHTMLToken& token)
+{
+    switch (insertionMode()) {
+    case InitialMode:
+        ASSERT(insertionMode() == InitialMode);
+        processDefaultForInitialMode(token);
+        // Fall through.
+    case BeforeHTMLMode:
+        ASSERT(insertionMode() == BeforeHTMLMode);
+        processDefaultForBeforeHTMLMode(token);
+        // Fall through.
+    case BeforeHeadMode:
+        ASSERT(insertionMode() == BeforeHeadMode);
+        processDefaultForBeforeHeadMode(token);
+        // Fall through.
+    case InHeadMode:
+        ASSERT(insertionMode() == InHeadMode);
+        processDefaultForInHeadMode(token);
+        // Fall through.
+    case AfterHeadMode:
+        ASSERT(insertionMode() == AfterHeadMode);
+        processDefaultForAfterHeadMode(token);
+        // Fall through
+    case InBodyMode:
+        ASSERT(insertionMode() == InBodyMode);
+        notImplemented();
+        break;
+    case AfterBodyMode:
     case AfterAfterBodyMode:
+        ASSERT(insertionMode() == AfterBodyMode || insertionMode() == AfterAfterBodyMode);
+        notImplemented();
+        break;
+    case InHeadNoscriptMode:
+        ASSERT(insertionMode() == InHeadNoscriptMode);
+        processDefaultForInHeadNoscriptMode(token);
+        processToken(token);
+        break;
+    case InFramesetMode:
+        ASSERT(insertionMode() == InFramesetMode);
+        if (currentElement() != m_openElements.htmlElement())
+            parseError(token);
+        break;
+    case AfterFramesetMode:
     case AfterAfterFramesetMode:
-        ASSERT_NOT_REACHED();
+        ASSERT(insertionMode() == AfterFramesetMode || insertionMode() == AfterAfterFramesetMode);
+        break;
+    default:
+        notImplemented();
     }
+}
 
-    // Implementation coming in the next patch.
-    return 0;
+void HTMLTreeBuilder::processDefaultForInitialMode(AtomicHTMLToken& token)
+{
+    notImplemented();
+    parseError(token);
+    setInsertionMode(BeforeHTMLMode);
 }
 
-PassRefPtr<Node> HTMLTreeBuilder::insertDoctype(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processDefaultForBeforeHTMLMode(AtomicHTMLToken&)
 {
-    ASSERT_UNUSED(token, token.type() == HTMLToken::DOCTYPE);
-    return 0;
+    AtomicHTMLToken startHTML(HTMLToken::StartTag, htmlTag.localName());
+    insertHTMLStartTagBeforeHTML(startHTML);
+    setInsertionMode(BeforeHeadMode);
 }
 
-PassRefPtr<Node> HTMLTreeBuilder::insertComment(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processDefaultForBeforeHeadMode(AtomicHTMLToken&)
 {
-    ASSERT_UNUSED(token, token.type() == HTMLToken::Comment);
-    return 0;
+    AtomicHTMLToken startHead(HTMLToken::StartTag, headTag.localName());
+    processStartTag(startHead);
 }
 
-PassRefPtr<Element> HTMLTreeBuilder::insertElement(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processDefaultForInHeadMode(AtomicHTMLToken&)
 {
-    ASSERT_UNUSED(token, token.type() == HTMLToken::StartTag);
-    return 0;
+    AtomicHTMLToken endHead(HTMLToken::EndTag, headTag.localName());
+    processEndTag(endHead);
 }
 
-void HTMLTreeBuilder::insertCharacter(UChar cc)
+void HTMLTreeBuilder::processDefaultForInHeadNoscriptMode(AtomicHTMLToken&)
 {
-    ASSERT_UNUSED(cc, cc);
+    AtomicHTMLToken endNoscript(HTMLToken::EndTag, noscriptTag.localName());
+    processEndTag(endNoscript);
 }
 
-PassRefPtr<Node> HTMLTreeBuilder::insertGenericRCDATAElement(AtomicHTMLToken& token)
+void HTMLTreeBuilder::processDefaultForAfterHeadMode(AtomicHTMLToken&)
 {
-    ASSERT_UNUSED(token, token.type() == HTMLToken::StartTag);
-    return 0;
+    AtomicHTMLToken startBody(HTMLToken::StartTag, bodyTag.localName());
+    processStartTag(startBody);
+    m_framesetOk = true;
 }
 
-PassRefPtr<Node> HTMLTreeBuilder::insertGenericRawTextElement(AtomicHTMLToken& token)
+bool HTMLTreeBuilder::processStartTagForInHead(AtomicHTMLToken& token)
 {
-    ASSERT_UNUSED(token, token.type() == HTMLToken::StartTag);
-    return 0;
+    if (token.name() == htmlTag) {
+        insertHTMLStartTagInBody(token);
+        return true;
+    }
+    // FIXME: Atomize "command".
+    if (token.name() == baseTag || token.name() == "command" || token.name() == linkTag || token.name() == metaTag) {
+        insertSelfClosingElement(token);
+        // Note: The custom processing for the <meta> tag is done in HTMLMetaElement::process().
+        return true;
+    }
+    if (token.name() == titleTag) {
+        insertGenericRCDATAElement(token);
+        return true;
+    }
+    if (token.name() == noscriptTag) {
+        if (isScriptingFlagEnabled(m_document->frame())) {
+            insertGenericRawTextElement(token);
+            return true;
+        }
+        insertElement(token);
+        setInsertionMode(InHeadNoscriptMode);
+        return true;
+    }
+    if (token.name() == noframesTag || token.name() == styleTag) {
+        insertGenericRawTextElement(token);
+        return true;
+    }
+    if (token.name() == scriptTag) {
+        insertScriptElement(token);
+        return true;
+    }
+    if (token.name() == headTag) {
+        parseError(token);
+        return true;
+    }
+    return false;
+}
+
+void HTMLTreeBuilder::insertDoctype(AtomicHTMLToken& token)
+{
+    ASSERT(token.type() == HTMLToken::DOCTYPE);
+    attach(m_document, DocumentType::create(m_document, token.name(), String::adopt(token.publicIdentifier()), String::adopt(token.systemIdentifier())));
+    // FIXME: Move quirks mode detection from DocumentType element to here.
+    notImplemented();
+    if (token.forceQuirks())
+        m_document->setParseMode(Document::Compat);
+}
+
+void HTMLTreeBuilder::insertComment(AtomicHTMLToken& token)
+{
+    ASSERT(token.type() == HTMLToken::Comment);
+    attach(currentElement(), Comment::create(m_document, token.comment()));
+}
+
+void HTMLTreeBuilder::insertCommentOnDocument(AtomicHTMLToken& token)
+{
+    ASSERT(token.type() == HTMLToken::Comment);
+    attach(m_document, Comment::create(m_document, token.comment()));
+}
+
+void HTMLTreeBuilder::insertCommentOnHTMLHtmlElement(AtomicHTMLToken& token)
+{
+    ASSERT(token.type() == HTMLToken::Comment);
+    attach(m_openElements.htmlElement(), Comment::create(m_document, token.comment()));
+}
+
+PassRefPtr<Element> HTMLTreeBuilder::createElementAndAttachToCurrent(AtomicHTMLToken& token)
+{
+    ASSERT(token.type() == HTMLToken::StartTag);
+    return attach(currentElement(), createElement(token));
+}
+
+void HTMLTreeBuilder::insertHTMLHtmlElement(AtomicHTMLToken& token)
+{
+    m_openElements.pushHTMLHtmlElement(createElementAndAttachToCurrent(token));
 }
 
-PassRefPtr<Node> HTMLTreeBuilder::insertScriptElement(AtomicHTMLToken& token)
+void HTMLTreeBuilder::insertHTMLHeadElement(AtomicHTMLToken& token)
+{
+    m_headElement = createElementAndAttachToCurrent(token);
+    m_openElements.pushHTMLHeadElement(m_headElement);
+}
+
+void HTMLTreeBuilder::insertHTMLBodyElement(AtomicHTMLToken& token)
+{
+    m_openElements.pushHTMLBodyElement(createElementAndAttachToCurrent(token));
+}
+
+void HTMLTreeBuilder::insertElement(AtomicHTMLToken& token)
+{
+    m_openElements.push(createElementAndAttachToCurrent(token));
+}
+
+void HTMLTreeBuilder::insertSelfClosingElement(AtomicHTMLToken& token)
+{
+    ASSERT(token.type() == HTMLToken::StartTag);
+    attach(currentElement(), createElement(token));
+    // FIXME: Do we want to acknowledge the token's self-closing flag?
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#acknowledge-self-closing-flag
+}
+
+void HTMLTreeBuilder::insertFormattingElement(AtomicHTMLToken& token)
+{
+    // http://www.whatwg.org/specs/web-apps/current-work/multipage/parsing.html#the-stack-of-open-elements
+    // Possible active formatting elements include:
+    // a, b, big, code, em, font, i, nobr, s, small, strike, strong, tt, and u.
+    insertElement(token);
+    m_activeFormattingElements.append(currentElement());
+}
+
+void HTMLTreeBuilder::insertGenericRCDATAElement(AtomicHTMLToken& token)
+{
+    insertElement(token);
+    m_tokenizer->setState(HTMLTokenizer::RCDATAState);
+    m_originalInsertionMode = m_insertionMode;
+    m_insertionMode = TextMode;
+}
+
+void HTMLTreeBuilder::insertGenericRawTextElement(AtomicHTMLToken& token)
+{
+    insertElement(token);
+    m_tokenizer->setState(HTMLTokenizer::RAWTEXTState);
+    m_originalInsertionMode = m_insertionMode;
+    m_insertionMode = TextMode;
+}
+
+void HTMLTreeBuilder::insertScriptElement(AtomicHTMLToken& token)
 {
     ASSERT_UNUSED(token, token.type() == HTMLToken::StartTag);
-    return 0;
+    RefPtr<HTMLScriptElement> element = HTMLScriptElement::create(scriptTag, m_document, true);
+    element->setAttributeMap(token.attributes(), m_fragmentScriptingPermission);
+    m_openElements.push(attach(currentElement(), element.release()));
+    m_tokenizer->setState(HTMLTokenizer::ScriptDataState);
+    m_originalInsertionMode = m_insertionMode;
+    m_insertionMode = TextMode;
+}
+
+void HTMLTreeBuilder::insertTextNode(AtomicHTMLToken& token)
+{
+    attach(currentElement(), Text::create(m_document, token.characters()));
+}
+    
+PassRefPtr<Element> HTMLTreeBuilder::createElement(AtomicHTMLToken& token)
+{
+    RefPtr<Element> element = HTMLElementFactory::createHTMLElement(QualifiedName(nullAtom, token.name(), xhtmlNamespaceURI), m_document, 0);
+    element->setAttributeMap(token.attributes(), m_fragmentScriptingPermission);
+    return element.release();
+}
+
+bool HTMLTreeBuilder::indexOfFirstUnopenFormattingElement(unsigned& firstUnopenElementIndex) const
+{
+    if (m_activeFormattingElements.isEmpty())
+        return false;
+    unsigned index = m_activeFormattingElements.size();
+    do {
+        --index;
+        const HTMLFormattingElementList::Entry& entry = m_activeFormattingElements[index];
+        if (entry.isMarker() || m_openElements.contains(entry.element())) {
+            firstUnopenElementIndex = index;
+            return true;
+        }
+    } while (index);
+    return false;
+}
+
+void HTMLTreeBuilder::reconstructTheActiveFormattingElements()
+{
+    unsigned firstUnopenElementIndex;
+    if (!indexOfFirstUnopenFormattingElement(firstUnopenElementIndex))
+        return;
+
+    unsigned unopenEntryIndex = firstUnopenElementIndex;
+    ASSERT(unopenEntryIndex < m_activeFormattingElements.size());
+    for (; unopenEntryIndex < m_activeFormattingElements.size(); ++unopenEntryIndex) {
+        HTMLFormattingElementList::Entry& unopenedEntry = m_activeFormattingElements[unopenEntryIndex];
+        // FIXME: We're supposed to save the original token in the entry.
+        AtomicHTMLToken fakeToken(HTMLToken::StartTag, unopenedEntry.element()->localName());
+        insertElement(fakeToken);
+        unopenedEntry.replaceElement(currentElement());
+    }
+}
+
+namespace {
+
+bool hasImpliedEndTag(Element* element)
+{
+    return element->hasTagName(ddTag)
+        || element->hasTagName(dtTag)
+        || element->hasTagName(liTag)
+        || element->hasTagName(optionTag)
+        || element->hasTagName(optgroupTag)
+        || element->hasTagName(pTag)
+        || element->hasTagName(rpTag)
+        || element->hasTagName(rtTag);
+}
+
+}
+
+void HTMLTreeBuilder::generateImpliedEndTagsWithExclusion(const AtomicString& tagName)
+{
+    while (hasImpliedEndTag(currentElement()) && !currentElement()->hasLocalName(tagName))
+        m_openElements.pop();
+}
+
+void HTMLTreeBuilder::generateImpliedEndTags()
+{
+    while (hasImpliedEndTag(currentElement()))
+        m_openElements.pop();
 }
 
 void HTMLTreeBuilder::finished()
 {
     // We should call m_document->finishedParsing() here, except
     // m_legacyTreeBuilder->finished() does it for us.
-    m_legacyTreeBuilder->finished();
+    if (m_legacyTreeBuilder) {
+        m_legacyTreeBuilder->finished();
+        return;
+    }
+
+    AtomicHTMLToken eofToken(HTMLToken::EndOfFile, nullAtom);
+    processToken(eofToken);
+
+    // Warning, this may delete the parser, so don't try to do anything else after this.
+    if (!m_isParsingFragment)
+        m_document->finishedParsing();
 }
 
 bool HTMLTreeBuilder::isScriptingFlagEnabled(Frame* frame)
diff --git a/WebCore/html/HTMLTreeBuilder.h b/WebCore/html/HTMLTreeBuilder.h
index 76360ae..37e4279 100644
--- a/WebCore/html/HTMLTreeBuilder.h
+++ b/WebCore/html/HTMLTreeBuilder.h
@@ -26,10 +26,14 @@
 #ifndef HTMLTreeBuilder_h
 #define HTMLTreeBuilder_h
 
+#include "Element.h"
 #include "FragmentScriptingPermission.h"
+#include "HTMLElementStack.h"
+#include "HTMLFormattingElementList.h"
 #include "HTMLTokenizer.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 #include <wtf/unicode/Unicode.h>
@@ -39,7 +43,6 @@ namespace WebCore {
 class AtomicHTMLToken;
 class Document;
 class DocumentFragment;
-class Element;
 class Frame;
 class HTMLToken;
 class HTMLDocument;
@@ -57,7 +60,7 @@ public:
     bool isPaused() const { return m_isPaused; }
 
     // The token really should be passed as a const& since it's never modified.
-    PassRefPtr<Node> constructTreeFromToken(HTMLToken&);
+    void constructTreeFromToken(HTMLToken&);
     // Must be called when parser is paused before calling the parser again.
     PassRefPtr<Element> takeScriptToProcess(int& scriptStartLine);
 
@@ -99,27 +102,83 @@ private:
         AfterAfterFramesetMode,
     };
 
-    class ElementStack : public Noncopyable {
-    public:
-        void pop() { }
-        void push(Element*) { }
-        void remove(Element*) { }
-        Element* top() const { return 0; }
-    };
-
-    PassRefPtr<Node> passTokenToLegacyParser(HTMLToken&);
-    PassRefPtr<Node> processToken(AtomicHTMLToken&, UChar cc = 0);
-
-    PassRefPtr<Node> insertDoctype(AtomicHTMLToken&);
-    PassRefPtr<Node> insertComment(AtomicHTMLToken&);
-    PassRefPtr<Element> insertElement(AtomicHTMLToken&);
-    void insertCharacter(UChar cc);
-    PassRefPtr<Node> insertGenericRCDATAElement(AtomicHTMLToken&);
-    PassRefPtr<Node> insertGenericRawTextElement(AtomicHTMLToken&);
-    PassRefPtr<Node> insertScriptElement(AtomicHTMLToken&);
+    void passTokenToLegacyParser(HTMLToken&);
+
+    // Specialized functions for processing the different types of tokens.
+    void processToken(AtomicHTMLToken&);
+    void processDoctypeToken(AtomicHTMLToken&);
+    void processStartTag(AtomicHTMLToken&);
+    void processEndTag(AtomicHTMLToken&);
+    void processComment(AtomicHTMLToken&);
+    void processCharacter(AtomicHTMLToken&);
+    void processEndOfFile(AtomicHTMLToken&);
+
+    // Default processing for the different insertion modes.
+    void processDefaultForInitialMode(AtomicHTMLToken&);
+    void processDefaultForBeforeHTMLMode(AtomicHTMLToken&);
+    void processDefaultForBeforeHeadMode(AtomicHTMLToken&);
+    void processDefaultForInHeadMode(AtomicHTMLToken&);
+    void processDefaultForInHeadNoscriptMode(AtomicHTMLToken&);
+    void processDefaultForAfterHeadMode(AtomicHTMLToken&);
+
+    bool processStartTagForInHead(AtomicHTMLToken&);
+    bool processBodyEndTagForInBody(AtomicHTMLToken&);
+    void processFakePEndTagIfPInScope();
+
+    HTMLElementStack::ElementRecord* furthestBlockForFormattingElement(Element*);
+    void findFosterParentFor(Element*);
+    void reparentChildren(Element* oldParent, Element* newParent);
+    void callTheAdoptionAgency(AtomicHTMLToken&);
+
+    template<typename ChildType>
+    PassRefPtr<ChildType> attach(Node* parent, PassRefPtr<ChildType> prpChild)
+    {
+        RefPtr<ChildType> child = prpChild;
+        parent->parserAddChild(child);
+        // It's slightly unfortunate that we need to hold a reference to child
+        // here to call attach().  We should investigate whether we can rely on
+        // |parent| to hold a ref at this point.  In the common case (at least
+        // for elements), however, we'll get to use this ref in the stack of
+        // open elements.
+        child->attach();
+        return child.release();
+    }
+
+    void insertDoctype(AtomicHTMLToken&);
+    void insertComment(AtomicHTMLToken&);
+    void insertCommentOnDocument(AtomicHTMLToken&);
+    void insertCommentOnHTMLHtmlElement(AtomicHTMLToken&);
+    void insertHTMLHtmlElement(AtomicHTMLToken&);
+    void insertHTMLHeadElement(AtomicHTMLToken&);
+    void insertHTMLBodyElement(AtomicHTMLToken&);
+    void insertElement(AtomicHTMLToken&);
+    void insertSelfClosingElement(AtomicHTMLToken&);
+    void insertFormattingElement(AtomicHTMLToken&);
+    void insertGenericRCDATAElement(AtomicHTMLToken&);
+    void insertGenericRawTextElement(AtomicHTMLToken&);
+    void insertScriptElement(AtomicHTMLToken&);
+    void insertTextNode(AtomicHTMLToken&);
+
+    void insertHTMLStartTagBeforeHTML(AtomicHTMLToken&);
+    void insertHTMLStartTagInBody(AtomicHTMLToken&);
+
+    PassRefPtr<Element> createElement(AtomicHTMLToken&);
+    PassRefPtr<Element> createElementAndAttachToCurrent(AtomicHTMLToken&);
+
+    void mergeAttributesFromTokenIntoElement(AtomicHTMLToken&, Element*);
+
+    bool indexOfFirstUnopenFormattingElement(unsigned& firstUnopenElementIndex) const;
+    void reconstructTheActiveFormattingElements();
+
+    void generateImpliedEndTags();
+    void generateImpliedEndTagsWithExclusion(const AtomicString& tagName);
+
+    Element* currentElement() { return m_openElements.top(); }
 
     RefPtr<Element> m_headElement;
-    ElementStack m_openElements;
+    RefPtr<Element> m_formElement;
+    HTMLElementStack m_openElements;
+    HTMLFormattingElementList m_activeFormattingElements;
     bool m_framesetOk;
 
     // FIXME: Implement error reporting.
@@ -138,6 +197,7 @@ private:
     bool m_isPaused;
 
     InsertionMode m_insertionMode;
+    InsertionMode m_originalInsertionMode;
 
     // HTML5 spec requires that we be able to change the state of the tokenizer
     // from within parser actions.
@@ -158,6 +218,7 @@ private:
     // FragmentScriptingNotAllowed causes the Parser to remove children
     // from <script> tags (so javascript doesn't show up in pastes).
     FragmentScriptingPermission m_fragmentScriptingPermission;
+    bool m_isParsingFragment;
 };
 
 }
diff --git a/WebCore/html/HTMLUListElement.cpp b/WebCore/html/HTMLUListElement.cpp
index e022ba9..4b121aa 100644
--- a/WebCore/html/HTMLUListElement.cpp
+++ b/WebCore/html/HTMLUListElement.cpp
@@ -65,24 +65,4 @@ void HTMLUListElement::parseMappedAttribute(Attribute* attr)
         HTMLElement::parseMappedAttribute(attr);
 }
 
-bool HTMLUListElement::compact() const
-{
-    return !getAttribute(compactAttr).isNull();
-}
-
-void HTMLUListElement::setCompact(bool b)
-{
-    setAttribute(compactAttr, b ? "" : 0);
-}
-
-String HTMLUListElement::type() const
-{
-    return getAttribute(typeAttr);
-}
-
-void HTMLUListElement::setType(const String &value)
-{
-    setAttribute(typeAttr, value);
-}
-
 }
diff --git a/WebCore/html/HTMLUListElement.h b/WebCore/html/HTMLUListElement.h
index 0b74c43..996626c 100644
--- a/WebCore/html/HTMLUListElement.h
+++ b/WebCore/html/HTMLUListElement.h
@@ -32,12 +32,6 @@ public:
     static PassRefPtr<HTMLUListElement> create(Document*);
     static PassRefPtr<HTMLUListElement> create(const QualifiedName&, Document*);
 
-    bool compact() const;
-    void setCompact(bool);
-
-    String type() const;
-    void setType(const String&);
-
 private:
     HTMLUListElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLUListElement.idl b/WebCore/html/HTMLUListElement.idl
index f6d3b78..221dcca 100644
--- a/WebCore/html/HTMLUListElement.idl
+++ b/WebCore/html/HTMLUListElement.idl
@@ -20,7 +20,7 @@
 module html {
 
     interface HTMLUListElement : HTMLElement {
-        attribute boolean compact;
+        attribute [Reflect] boolean compact;
         attribute [Reflect] DOMString type;
     };
 
diff --git a/WebCore/html/HTMLVideoElement.cpp b/WebCore/html/HTMLVideoElement.cpp
index 9fd1a09..cf7d64c 100644
--- a/WebCore/html/HTMLVideoElement.cpp
+++ b/WebCore/html/HTMLVideoElement.cpp
@@ -154,11 +154,6 @@ unsigned HTMLVideoElement::width() const
     unsigned w = getAttribute(widthAttr).string().toUInt(&ok);
     return ok ? w : 0;
 }
-
-void HTMLVideoElement::setWidth(unsigned value)
-{
-    setAttribute(widthAttr, String::number(value));
-}
     
 unsigned HTMLVideoElement::height() const
 {
@@ -167,16 +162,6 @@ unsigned HTMLVideoElement::height() const
     return ok ? h : 0;
 }
     
-void HTMLVideoElement::setHeight(unsigned value)
-{
-    setAttribute(heightAttr, String::number(value));
-}
-
-void HTMLVideoElement::setPoster(const String& value)
-{
-    setAttribute(posterAttr, value);
-}
-
 bool HTMLVideoElement::isURLAttribute(Attribute* attribute) const
 {
     return HTMLMediaElement::isURLAttribute(attribute)
diff --git a/WebCore/html/HTMLVideoElement.h b/WebCore/html/HTMLVideoElement.h
index 4b8acbb..c27962f 100644
--- a/WebCore/html/HTMLVideoElement.h
+++ b/WebCore/html/HTMLVideoElement.h
@@ -39,15 +39,12 @@ public:
     static PassRefPtr<HTMLVideoElement> create(const QualifiedName&, Document*);
 
     unsigned width() const;
-    void setWidth(unsigned);
     unsigned height() const;
-    void setHeight(unsigned);
     
     unsigned videoWidth() const;
     unsigned videoHeight() const;
     
     virtual const KURL poster() const { return m_posterURL; }
-    void setPoster(const String&);
 
     // Fullscreen
     void webkitEnterFullscreen(bool isUserGesture, ExceptionCode&);
diff --git a/WebCore/html/HTMLViewSourceDocument.cpp b/WebCore/html/HTMLViewSourceDocument.cpp
index f66703a..6cee27c 100644
--- a/WebCore/html/HTMLViewSourceDocument.cpp
+++ b/WebCore/html/HTMLViewSourceDocument.cpp
@@ -69,10 +69,10 @@ DocumentParser* HTMLViewSourceDocument::createParser()
 void HTMLViewSourceDocument::createContainingTable()
 {
     RefPtr<HTMLHtmlElement> html = HTMLHtmlElement::create(this);
-    addChild(html);
+    legacyParserAddChild(html);
     html->attach();
     RefPtr<HTMLBodyElement> body = HTMLBodyElement::create(this);
-    html->addChild(body);
+    html->legacyParserAddChild(body);
     body->attach();
     
     // Create a line gutter div that can be used to make sure the gutter extends down the height of the whole
@@ -81,14 +81,14 @@ void HTMLViewSourceDocument::createContainingTable()
     RefPtr<NamedNodeMap> attrs = NamedNodeMap::create();
     attrs->addAttribute(Attribute::createMapped(classAttr, "webkit-line-gutter-backdrop"));
     div->setAttributeMap(attrs.release());
-    body->addChild(div);
+    body->legacyParserAddChild(div);
     div->attach();
 
     RefPtr<HTMLTableElement> table = HTMLTableElement::create(this);
-    body->addChild(table);
+    body->legacyParserAddChild(table);
     table->attach();
     m_tbody = HTMLTableSectionElement::create(tbodyTag, this);
-    table->addChild(m_tbody);
+    table->legacyParserAddChild(m_tbody);
     m_tbody->attach();
     m_current = m_tbody;
 }
@@ -214,7 +214,7 @@ PassRefPtr<Element> HTMLViewSourceDocument::addSpanWithClassName(const String& c
     RefPtr<NamedNodeMap> attrs = NamedNodeMap::create();
     attrs->addAttribute(Attribute::createMapped(classAttr, className));
     span->setAttributeMap(attrs.release());
-    m_current->addChild(span);
+    m_current->legacyParserAddChild(span);
     span->attach();
     return span.release();
 }
@@ -223,7 +223,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
 {
     // Create a table row.
     RefPtr<HTMLTableRowElement> trow = HTMLTableRowElement::create(this);
-    m_tbody->addChild(trow);
+    m_tbody->legacyParserAddChild(trow);
     trow->attach();
     
     // Create a cell that will hold the line number (it is generated in the stylesheet using counters).
@@ -231,7 +231,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
     RefPtr<NamedNodeMap> attrs = NamedNodeMap::create();
     attrs->addAttribute(Attribute::createMapped(classAttr, "webkit-line-number"));
     td->setAttributeMap(attrs.release());
-    trow->addChild(td);
+    trow->legacyParserAddChild(td);
     td->attach();
 
     // Create a second cell for the line contents
@@ -239,7 +239,7 @@ void HTMLViewSourceDocument::addLine(const String& className)
     attrs = NamedNodeMap::create();
     attrs->addAttribute(Attribute::createMapped(classAttr, "webkit-line-content"));
     td->setAttributeMap(attrs.release());
-    trow->addChild(td);
+    trow->legacyParserAddChild(td);
     td->attach();
     m_current = m_td = td;
 
@@ -276,7 +276,7 @@ void HTMLViewSourceDocument::addText(const String& text, const String& className
         if (m_current == m_tbody)
             addLine(className);
         RefPtr<Text> t = Text::create(this, substring);
-        m_current->addChild(t);
+        m_current->legacyParserAddChild(t);
         t->attach();
         if (i < size - 1)
             m_current = m_tbody;
@@ -304,7 +304,7 @@ PassRefPtr<Element> HTMLViewSourceDocument::addLink(const String& url, bool isAn
     attrs->addAttribute(Attribute::createMapped(targetAttr, "_blank"));
     attrs->addAttribute(Attribute::createMapped(hrefAttr, url));
     anchor->setAttributeMap(attrs.release());
-    m_current->addChild(anchor);
+    m_current->legacyParserAddChild(anchor);
     anchor->attach();
     return anchor.release();
 }
diff --git a/WebCore/html/LegacyHTMLDocumentParser.cpp b/WebCore/html/LegacyHTMLDocumentParser.cpp
index 38c8a75..cb5fac8 100644
--- a/WebCore/html/LegacyHTMLDocumentParser.cpp
+++ b/WebCore/html/LegacyHTMLDocumentParser.cpp
@@ -147,7 +147,7 @@ inline void Token::addAttribute(AtomicString& attrName, const AtomicString& attr
 // ----------------------------------------------------------------------------
 
 LegacyHTMLDocumentParser::LegacyHTMLDocumentParser(HTMLDocument* document, bool reportErrors)
-    : DocumentParser(document)
+    : ScriptableDocumentParser(document)
     , m_buffer(0)
     , m_scriptCode(0)
     , m_scriptCodeSize(0)
@@ -167,7 +167,7 @@ LegacyHTMLDocumentParser::LegacyHTMLDocumentParser(HTMLDocument* document, bool
 }
 
 LegacyHTMLDocumentParser::LegacyHTMLDocumentParser(HTMLViewSourceDocument* document)
-    : DocumentParser(document, true)
+    : ScriptableDocumentParser(document, true)
     , m_buffer(0)
     , m_scriptCode(0)
     , m_scriptCodeSize(0)
@@ -186,7 +186,7 @@ LegacyHTMLDocumentParser::LegacyHTMLDocumentParser(HTMLViewSourceDocument* docum
 }
 
 LegacyHTMLDocumentParser::LegacyHTMLDocumentParser(DocumentFragment* frag, FragmentScriptingPermission scriptingPermission)
-    : DocumentParser(frag->document())
+    : ScriptableDocumentParser(frag->document())
     , m_buffer(0)
     , m_scriptCode(0)
     , m_scriptCodeSize(0)
@@ -1391,7 +1391,7 @@ LegacyHTMLDocumentParser::State LegacyHTMLDocumentParser::parseTag(SegmentedStri
 
                         if (m_currentToken.beginTag && m_currentToken.tagName == scriptTag && !inViewSourceMode() && !m_treeBuilder->skipMode() && m_attrName == srcAttr) {
                             String context(m_rawAttributeBeforeValue.data(), m_rawAttributeBeforeValue.size());
-                            if (m_XSSAuditor && !m_XSSAuditor->canLoadExternalScriptFromSrc(attributeValue))
+                            if (xssAuditor() && !xssAuditor()->canLoadExternalScriptFromSrc(attributeValue))
                                 attributeValue = blankURL().string();
                         }
 
@@ -1428,7 +1428,7 @@ LegacyHTMLDocumentParser::State LegacyHTMLDocumentParser::parseTag(SegmentedStri
 
                         if (m_currentToken.beginTag && m_currentToken.tagName == scriptTag && !inViewSourceMode() && !m_treeBuilder->skipMode() && m_attrName == srcAttr) {
                             String context(m_rawAttributeBeforeValue.data(), m_rawAttributeBeforeValue.size());
-                            if (m_XSSAuditor && !m_XSSAuditor->canLoadExternalScriptFromSrc(attributeValue))
+                            if (xssAuditor() && !xssAuditor()->canLoadExternalScriptFromSrc(attributeValue))
                                 attributeValue = blankURL().string();
                         }
 
@@ -1787,8 +1787,28 @@ void LegacyHTMLDocumentParser::write(const SegmentedString& str, bool appendData
     if (m_noMoreData && !m_inWrite && !state.loadingExtScript() && !m_executingScript && !m_timer.isActive())
         end(); // this actually causes us to be deleted
 
-    // After parsing, go ahead and dispatch image beforeload events.
-    ImageLoader::dispatchPendingBeforeLoadEvents();
+    // After parsing, go ahead and dispatch image beforeload events, but only if we're doing
+    // document parsing.  For document fragments we wait, since they'll likely end up in the document by the time
+    // the beforeload events fire.
+    if (!m_fragment)
+        ImageLoader::dispatchPendingBeforeLoadEvents();
+}
+
+void LegacyHTMLDocumentParser::insert(const SegmentedString& source)
+{
+    // FIXME: forceSynchronous should always be the same as the bool passed to
+    // write().  However LegacyHTMLDocumentParser uses write("", false) to pump
+    // the parser (after running external scripts, etc.) thus necessitating a
+    // separate state for forceSynchronous.
+    bool wasForcedSynchronous = forceSynchronous();
+    setForceSynchronous(true);
+    write(source, false);
+    setForceSynchronous(wasForcedSynchronous);
+}
+
+void LegacyHTMLDocumentParser::append(const SegmentedString& source)
+{
+    write(source, true);
 }
 
 void LegacyHTMLDocumentParser::stopParsing()
diff --git a/WebCore/html/LegacyHTMLDocumentParser.h b/WebCore/html/LegacyHTMLDocumentParser.h
index 5b96bc3..49e6976 100644
--- a/WebCore/html/LegacyHTMLDocumentParser.h
+++ b/WebCore/html/LegacyHTMLDocumentParser.h
@@ -28,9 +28,9 @@
 #include "CachedResourceHandle.h"
 #include "FragmentScriptingPermission.h"
 #include "NamedNodeMap.h"
+#include "ScriptableDocumentParser.h"
 #include "SegmentedString.h"
 #include "Timer.h"
-#include "DocumentParser.h"
 #include <wtf/Deque.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/Vector.h>
@@ -140,7 +140,7 @@ public:
 // (like dealing with <script> tags).  The HTML tokenizer bits should be pushed
 // down into a separate HTML tokenizer class.
 
-class LegacyHTMLDocumentParser : public DocumentParser, public CachedResourceClient {
+class LegacyHTMLDocumentParser : public ScriptableDocumentParser, public CachedResourceClient {
 public:
     LegacyHTMLDocumentParser(HTMLDocument*, bool reportErrors);
     LegacyHTMLDocumentParser(HTMLViewSourceDocument*);
@@ -150,18 +150,16 @@ public:
     bool forceSynchronous() const { return m_state.forceSynchronous(); }
     void setForceSynchronous(bool force);
 
-    // Exposed for LegacyHTMLTreeBuilder::reportErrorToConsole
-    bool processingContentWrittenByScript() const { return m_src.excludeLineNumbers(); }
-
     static void parseDocumentFragment(const String&, DocumentFragment*, FragmentScriptingPermission = FragmentScriptingAllowed);
 
 protected:
     // Exposed for FTPDirectoryDocumentParser
-    virtual void write(const SegmentedString&, bool appendData);
+    virtual void insert(const SegmentedString&);
     virtual void finish();
 
 private:
-    // DocumentParser
+    // ScriptableDocumentParser
+    virtual void append(const SegmentedString&);
     virtual bool finishWasCalled();
     virtual bool isWaitingForScripts() const;
     virtual void stopParsing();
@@ -171,10 +169,11 @@ private:
     virtual int lineNumber() const { return m_lineNumber; }
     virtual int columnNumber() const { return 1; }
 
+    virtual bool processingContentWrittenByScript() const { return m_src.excludeLineNumbers(); }
+
     virtual void executeScriptsWaitingForStylesheets();
 
     virtual LegacyHTMLTreeBuilder* htmlTreeBuilder() const { return m_treeBuilder.get(); }
-    virtual LegacyHTMLDocumentParser* asHTMLDocumentParser() { return this; }
 
     class State;
 
@@ -183,6 +182,7 @@ private:
     void reset();
 
     void willWriteHTML(const SegmentedString&);
+    void write(const SegmentedString&, bool appendData);
     ALWAYS_INLINE void advance(State&);
     void didWriteHTML();
 
diff --git a/WebCore/html/LegacyHTMLTreeBuilder.cpp b/WebCore/html/LegacyHTMLTreeBuilder.cpp
index 7b44943..afd79b6 100644
--- a/WebCore/html/LegacyHTMLTreeBuilder.cpp
+++ b/WebCore/html/LegacyHTMLTreeBuilder.cpp
@@ -67,7 +67,7 @@ using namespace HTMLNames;
 
 static const unsigned cMaxRedundantTagDepth = 20;
 static const unsigned cResidualStyleMaxDepth = 200;
-static const unsigned cResidualStyleIterationLimit = 5;
+static const unsigned cResidualStyleIterationLimit = 10;
 
 
 static const int minBlockLevelTagPriority = 3;
@@ -344,7 +344,7 @@ void LegacyHTMLTreeBuilder::parseDoctypeToken(DoctypeToken* t)
         return;
 
     // Make a new doctype node and set it as our doctype.
-    m_document->addChild(DocumentType::create(m_document, String::adopt(t->m_name), String::adopt(t->m_publicID), String::adopt(t->m_systemID)));
+    m_document->legacyParserAddChild(DocumentType::create(m_document, String::adopt(t->m_name), String::adopt(t->m_publicID), String::adopt(t->m_systemID)));
     if (t->m_forceQuirks)
         m_document->setParseMode(Document::Compat);
 }
@@ -390,7 +390,7 @@ bool LegacyHTMLTreeBuilder::insertNode(Node* n, bool flat)
 
     // let's be stupid and just try to insert it.
     // this should work if the document is well-formed
-    Node* newNode = m_current->addChild(n);
+    Node* newNode = m_current->legacyParserAddChild(n);
     if (!newNode)
         return handleError(n, flat, localName, tagPriority); // Try to handle the error.
 
@@ -459,12 +459,12 @@ bool LegacyHTMLTreeBuilder::handleError(Node* n, bool flat, const AtomicString&
             if (m_head) {
                 if (!createdHead)
                     reportError(MisplacedHeadContentError, &localName, &m_current->localName());
-                if (m_head->addChild(n)) {
+                if (m_head->legacyParserAddChild(n)) {
                     if (!n->attached() && !m_isParsingFragment)
                         n->attach();
                     return true;
-                } else
-                    return false;
+                }
+                return false;
             }
         } else if (h->hasLocalName(htmlTag)) {
             if (!m_current->isDocumentNode() ) {
@@ -490,7 +490,7 @@ bool LegacyHTMLTreeBuilder::handleError(Node* n, bool flat, const AtomicString&
                 createdHead = true;
             }
             if (m_head) {
-                Node* newNode = m_head->addChild(n);
+                Node* newNode = m_head->legacyParserAddChild(n);
                 if (!newNode) {
                     setSkipMode(h->tagQName());
                     return false;
@@ -530,7 +530,7 @@ bool LegacyHTMLTreeBuilder::handleError(Node* n, bool flat, const AtomicString&
         } else if (h->hasLocalName(areaTag)) {
             if (m_currentMapElement) {
                 reportError(MisplacedAreaError, &m_current->localName());
-                m_currentMapElement->addChild(n);
+                m_currentMapElement->legacyParserAddChild(n);
                 if (!n->attached() && !m_isParsingFragment)
                     n->attach();
                 handled = true;
@@ -944,7 +944,7 @@ PassRefPtr<Node> LegacyHTMLTreeBuilder::getNode(Token* t)
         QualifiedName nestedCreateErrorTags[] = { aTag, buttonTag, nobrTag, trTag };
         mapTagsToFunc(gFunctionMap, nestedCreateErrorTags, &LegacyHTMLTreeBuilder::nestedCreateErrorCheck);
 
-        QualifiedName nestedStyleCreateErrorTags[] = { bTag, bigTag, iTag, sTag, smallTag, strikeTag, ttTag, uTag };
+        QualifiedName nestedStyleCreateErrorTags[] = { bTag, bigTag, iTag, markTag, sTag, smallTag, strikeTag, ttTag, uTag };
         mapTagsToFunc(gFunctionMap, nestedStyleCreateErrorTags, &LegacyHTMLTreeBuilder::nestedStyleCreateErrorCheck);
 
         QualifiedName pCloserCreateErrorTags[] = { addressTag, articleTag,
@@ -1057,7 +1057,7 @@ bool LegacyHTMLTreeBuilder::isInline(Node* node) const
             e->hasLocalName(abbrTag) || e->hasLocalName(acronymTag) || e->hasLocalName(subTag) ||
             e->hasLocalName(supTag) || e->hasLocalName(spanTag) || e->hasLocalName(nobrTag) ||
             e->hasLocalName(noframesTag) || e->hasLocalName(nolayerTag) ||
-            e->hasLocalName(noembedTag))
+            e->hasLocalName(noembedTag) || e->hasLocalName(markTag))
             return true;
 #if !ENABLE(XHTMLMP)
         if (e->hasLocalName(noscriptTag) && !m_isParsingFragment) {
@@ -1077,7 +1077,7 @@ bool LegacyHTMLTreeBuilder::isResidualStyleTag(const AtomicString& tagName)
     if (residualStyleTags.isEmpty()) {
         QualifiedName tagNames[] = { aTag, fontTag, ttTag, uTag, bTag, iTag,
             sTag, strikeTag, bigTag, smallTag, emTag, strongTag, dfnTag,
-            codeTag, sampTag, kbdTag, varTag, nobrTag };
+            codeTag, sampTag, kbdTag, varTag, nobrTag, markTag };
         addTags(residualStyleTags, tagNames);
     }
     return residualStyleTags.contains(tagName.impl());
@@ -1606,10 +1606,10 @@ PassRefPtr<Node> LegacyHTMLTreeBuilder::handleIsindex(Token* t)
         t->attrs = 0;
     }
 
-    n->addChild(HTMLHRElement::create(m_document));
-    n->addChild(Text::create(m_document, text));
-    n->addChild(isIndex.release());
-    n->addChild(HTMLHRElement::create(m_document));
+    n->legacyParserAddChild(HTMLHRElement::create(m_document));
+    n->legacyParserAddChild(Text::create(m_document, text));
+    n->legacyParserAddChild(isIndex.release());
+    n->legacyParserAddChild(HTMLHRElement::create(m_document));
 
     return n.release();
 }
@@ -1647,8 +1647,9 @@ void LegacyHTMLTreeBuilder::reportErrorToConsole(HTMLParserErrorCode errorCode,
     Frame* frame = m_document->frame();
     if (!frame)
         return;
-    
-    int lineNumber = m_document->parser()->lineNumber() + 1;
+
+    ScriptableDocumentParser* parser = m_document->scriptableDocumentParser();
+    int lineNumber = parser->lineNumber() + 1;
 
     AtomicString tag1;
     AtomicString tag2;
@@ -1674,9 +1675,7 @@ void LegacyHTMLTreeBuilder::reportErrorToConsole(HTMLParserErrorCode errorCode,
         return;
 
     String message;
-    // FIXME: This doesn't work for the new HTMLDocumentParser and should.
-    LegacyHTMLDocumentParser* htmlParser = m_document->parser()->asHTMLDocumentParser();
-    if (htmlParser && htmlParser->processingContentWrittenByScript())
+    if (parser->processingContentWrittenByScript())
         message += htmlParserDocumentWriteMessage();
     message += errorMsg;
     message.replace("%tag1", tag1);
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 522e51d..2ac2ca3 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -4,6 +4,7 @@
  * Copyright (C) 2007 Alp Toker <alp@atoker.com>
  * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2008 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) 2010 Torch Mobile (Beijing) Co. Ltd. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -44,6 +45,7 @@
 #include "GraphicsContext.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
+#include "HTMLMediaElement.h"
 #include "HTMLNames.h"
 #include "ImageBuffer.h"
 #include "ImageData.h"
@@ -572,9 +574,8 @@ void CanvasRenderingContext2D::quadraticCurveTo(float cpx, float cpy, float x, f
     if (!state().m_invertibleCTM)
         return;
     if (!m_path.hasCurrentPoint())
-        m_path.moveTo(FloatPoint(x, y));
-    else
-        m_path.addQuadCurveTo(FloatPoint(cpx, cpy), FloatPoint(x, y));
+        m_path.moveTo(FloatPoint(cpx, cpy));
+    m_path.addQuadCurveTo(FloatPoint(cpx, cpy), FloatPoint(x, y));
 }
 
 void CanvasRenderingContext2D::bezierCurveTo(float cp1x, float cp1y, float cp2x, float cp2y, float x, float y)
@@ -584,9 +585,8 @@ void CanvasRenderingContext2D::bezierCurveTo(float cp1x, float cp1y, float cp2x,
     if (!state().m_invertibleCTM)
         return;
     if (!m_path.hasCurrentPoint())
-        m_path.moveTo(FloatPoint(x, y));
-    else
-        m_path.addBezierCurveTo(FloatPoint(cp1x, cp1y), FloatPoint(cp2x, cp2y), FloatPoint(x, y));
+        m_path.moveTo(FloatPoint(cp1x, cp1y));
+    m_path.addBezierCurveTo(FloatPoint(cp1x, cp1y), FloatPoint(cp2x, cp2y), FloatPoint(x, y));
 }
 
 void CanvasRenderingContext2D::arcTo(float x0, float y0, float x1, float y1, float r, ExceptionCode& ec)
@@ -755,8 +755,9 @@ void CanvasRenderingContext2D::fillRect(float x, float y, float width, float hei
 
     // from the HTML5 Canvas spec:
     // If x0 = x1 and y0 = y1, then the linear gradient must paint nothing
+    // If x0 = x1 and y0 = y1 and r0 = r1, then the radial gradient must paint nothing
     Gradient* gradient = c->fillGradient();
-    if (gradient && gradient->isZeroSize() && !gradient->isRadial())
+    if (gradient && gradient->isZeroSize())
         return;
 
     FloatRect rect(x, y, width, height);
@@ -958,12 +959,20 @@ static inline FloatRect normalizeRect(const FloatRect& rect)
 
 void CanvasRenderingContext2D::checkOrigin(const KURL& url)
 {
+    if (m_cleanOrigins.contains(url.string()))
+        return;
+
     if (canvas()->securityOrigin().taintsCanvas(url))
         canvas()->setOriginTainted();
+    else
+        m_cleanOrigins.add(url.string());
 }
 
 void CanvasRenderingContext2D::checkOrigin(const String& url)
 {
+    if (m_cleanOrigins.contains(url))
+        return;
+
     checkOrigin(KURL(KURL(), url));
 }
 
@@ -1009,6 +1018,13 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRec
 
     ec = 0;
 
+    if (!isfinite(dstRect.x()) || !isfinite(dstRect.y()) || !isfinite(dstRect.width()) || !isfinite(dstRect.height())
+        || !isfinite(srcRect.x()) || !isfinite(srcRect.y()) || !isfinite(srcRect.width()) || !isfinite(srcRect.height()))
+        return;
+
+    if (!image->complete())
+        return;
+
     FloatRect imageRect = FloatRect(FloatPoint(), size(image));
     if (!imageRect.contains(normalizeRect(srcRect)) || srcRect.width() == 0 || srcRect.height() == 0) {
         ec = INDEX_SIZE_ERR;
@@ -1074,14 +1090,20 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* sourceCanvas, const
         return;
     }
 
-    ec = 0;
-
     FloatRect srcCanvasRect = FloatRect(FloatPoint(), sourceCanvas->size());
+
+    if (!srcCanvasRect.width() || !srcCanvasRect.height()) {
+        ec = INVALID_STATE_ERR;
+        return;
+    }
+
     if (!srcCanvasRect.contains(normalizeRect(srcRect)) || srcRect.width() == 0 || srcRect.height() == 0) {
         ec = INDEX_SIZE_ERR;
         return;
     }
 
+    ec = 0;
+
     if (!dstRect.width() || !dstRect.height())
         return;
 
@@ -1145,6 +1167,10 @@ void CanvasRenderingContext2D::drawImage(HTMLVideoElement* video, const FloatRec
     }
     
     ec = 0;
+
+    if (video->readyState() == HTMLMediaElement::HAVE_NOTHING || video->readyState() == HTMLMediaElement::HAVE_METADATA)
+        return;
+
     FloatRect videoRect = FloatRect(FloatPoint(), size(video));
     if (!videoRect.contains(normalizeRect(srcRect)) || srcRect.width() == 0 || srcRect.height() == 0) {
         ec = INDEX_SIZE_ERR;
@@ -1489,7 +1515,16 @@ void CanvasRenderingContext2D::setFont(const String& newFont)
     state().m_font.update(styleSelector->fontSelector());
     state().m_realizedFont = true;
 }
-        
+
+void CanvasRenderingContext2D::updateFont()
+{
+    if (!state().m_realizedFont)
+        return;
+
+    const Font& font = state().m_font;
+    font.update(font.fontSelector());
+}
+
 String CanvasRenderingContext2D::textAlign() const
 {
     return textAlignName(state().m_textAlign);
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.h b/WebCore/html/canvas/CanvasRenderingContext2D.h
index d6b0c8a..43f3b35 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -34,6 +34,7 @@
 #include "GraphicsTypes.h"
 #include "Path.h"
 #include "PlatformString.h"
+#include <wtf/text/StringHash.h>
 #include <wtf/Vector.h>
 
 #if PLATFORM(CG)
@@ -192,6 +193,7 @@ namespace WebCore {
 
         String font() const;
         void setFont(const String&);
+        void updateFont();
         
         String textAlign() const;
         void setTextAlign(const String&);
@@ -264,6 +266,9 @@ namespace WebCore {
 #endif
         
         void prepareGradientForDashboard(CanvasGradient* gradient) const;
+
+        HashSet<String> m_cleanOrigins;
+
         void checkOrigin(const KURL&);
         void checkOrigin(const String&);
 
diff --git a/WebCore/html/canvas/CheckedInt.h b/WebCore/html/canvas/CheckedInt.h
new file mode 100644
index 0000000..861e8e6
--- /dev/null
+++ b/WebCore/html/canvas/CheckedInt.h
@@ -0,0 +1,527 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim:set ts=2 sw=2 sts=2 et cindent: */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is Mozilla code.
+ *
+ * The Initial Developer of the Original Code is the Mozilla Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2009
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Benoit Jacob <bjacob@mozilla.com>
+ *  Jeff Muizelaar <jmuizelaar@mozilla.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+// Necessary modifications are made to the original CheckedInt.h file to remove
+// dependencies on prtypes.
+// Also, change define Mozilla_CheckedInt_h to CheckedInt_h, change namespace
+// from mozilla to WebCore for easier usage.
+
+#ifndef CheckedInt_h
+#define CheckedInt_h
+
+#include <climits>
+
+namespace WebCore {
+
+namespace CheckedInt_internal {
+
+/* we don't want to use std::numeric_limits here because int... types may not support it,
+ * depending on the platform, e.g. on certain platform they use nonstandard built-in types
+ */
+
+/*** Step 1: manually record information for all the types that we want to support
+ ***/
+
+struct unsupported_type {};
+
+template<typename T> struct integer_type_manually_recorded_info
+{
+    enum { is_supported = 0 };
+    typedef unsupported_type twice_bigger_type;
+};
+
+
+#define CHECKEDINT_REGISTER_SUPPORTED_TYPE(T,_twice_bigger_type)  \
+template<> struct integer_type_manually_recorded_info<T>       \
+{                                                              \
+    enum { is_supported = 1 };                                 \
+    typedef _twice_bigger_type twice_bigger_type;              \
+    static void TYPE_NOT_SUPPORTED_BY_CheckedInt() {}             \
+};
+
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(int8_t,   int16_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint8_t,  uint16_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(int16_t,  int32_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint16_t, uint32_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(int32_t,  int64_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint32_t, uint64_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(int64_t,  unsupported_type)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint64_t, unsupported_type)
+
+
+/*** Step 2: record some info about a given integer type,
+ ***         including whether it is supported, whether a twice bigger integer type
+ ***         is supported, what that twice bigger type is, and some stuff as found
+ ***         in std::numeric_limits (which we don't use because int.. types may
+ ***         not support it, if they are defined directly from compiler built-in types).
+ ***/
+
+template<typename T> struct is_unsupported_type { enum { answer = 0 }; };
+template<> struct is_unsupported_type<unsupported_type> { enum { answer = 1 }; };
+
+template<typename T> struct integer_traits
+{
+    typedef typename integer_type_manually_recorded_info<T>::twice_bigger_type twice_bigger_type;
+
+    enum {
+        is_supported = integer_type_manually_recorded_info<T>::is_supported,
+        twice_bigger_type_is_supported
+            = is_unsupported_type<
+                  typename integer_type_manually_recorded_info<T>::twice_bigger_type
+              >::answer ? 0 : 1,
+        size = sizeof(T),
+        position_of_sign_bit = CHAR_BIT * size - 1,
+        is_signed = (T(-1) > T(0)) ? 0 : 1
+    };
+
+    static T min()
+    {
+        // bitwise ops may return a larger type, that's why we cast explicitly to T
+        return is_signed ? T(T(1) << position_of_sign_bit) : T(0);
+    }
+
+    static T max()
+    {
+        return ~min();
+    }
+};
+
+/*** Step 3: Implement the actual validity checks --- ideas taken from IntegerLib, code different.
+ ***/
+
+// bitwise ops may return a larger type, so it's good to use these inline helpers guaranteeing that
+// the result is really of type T
+
+template<typename T> inline T has_sign_bit(T x)
+{
+    return x >> integer_traits<T>::position_of_sign_bit;
+}
+
+template<typename T> inline T binary_complement(T x)
+{
+    return ~x;
+}
+
+template<typename T, typename U,
+         bool is_T_signed = integer_traits<T>::is_signed,
+         bool is_U_signed = integer_traits<U>::is_signed>
+struct is_in_range_impl {};
+
+template<typename T, typename U>
+struct is_in_range_impl<T, U, true, true>
+{
+    static T run(U x)
+    {
+        return (x <= integer_traits<T>::max()) &
+               (x >= integer_traits<T>::min());
+    }
+};
+
+template<typename T, typename U>
+struct is_in_range_impl<T, U, false, false>
+{
+    static T run(U x)
+    {
+        return x <= integer_traits<T>::max();
+    }
+};
+
+template<typename T, typename U>
+struct is_in_range_impl<T, U, true, false>
+{
+    static T run(U x)
+    {
+        if (sizeof(T) > sizeof(U))
+            return 1;
+        else
+            return x <= U(integer_traits<T>::max());
+    }
+};
+
+template<typename T, typename U>
+struct is_in_range_impl<T, U, false, true>
+{
+    static T run(U x)
+    {
+        if (sizeof(T) >= sizeof(U))
+            return x >= 0;
+        else
+            return x >= 0 && x <= U(integer_traits<T>::max());
+    }
+};
+
+template<typename T, typename U> inline T is_in_range(U x)
+{
+    return is_in_range_impl<T, U>::run(x);
+}
+
+template<typename T> inline T is_add_valid(T x, T y, T result)
+{
+    return integer_traits<T>::is_signed ?
+                        // addition is valid if the sign of x+y is equal to either that of x or that of y.
+                        // Beware! These bitwise operations can return a larger integer type, if T was a
+                        // small type like int8, so we explicitly cast to T.
+                        has_sign_bit(binary_complement(T((result^x) & (result^y))))
+                    :
+                        binary_complement(x) >= y;
+}
+
+template<typename T> inline T is_sub_valid(T x, T y, T result)
+{
+    return integer_traits<T>::is_signed ?
+                        // substraction is valid if either x and y have same sign, or x-y and x have same sign
+                        has_sign_bit(binary_complement(T((result^x) & (x^y))))
+                    :
+                        x >= y;
+}
+
+template<typename T,
+         bool is_signed =  integer_traits<T>::is_signed,
+         bool twice_bigger_type_is_supported = integer_traits<T>::twice_bigger_type_is_supported>
+struct is_mul_valid_impl {};
+
+template<typename T>
+struct is_mul_valid_impl<T, true, true>
+{
+    static T run(T x, T y)
+    {
+        typedef typename integer_traits<T>::twice_bigger_type twice_bigger_type;
+        twice_bigger_type product = twice_bigger_type(x) * twice_bigger_type(y);
+        return is_in_range<T>(product);
+    }
+};
+
+template<typename T>
+struct is_mul_valid_impl<T, false, true>
+{
+    static T run(T x, T y)
+    {
+        typedef typename integer_traits<T>::twice_bigger_type twice_bigger_type;
+        twice_bigger_type product = twice_bigger_type(x) * twice_bigger_type(y);
+        return is_in_range<T>(product);
+    }
+};
+
+template<typename T>
+struct is_mul_valid_impl<T, true, false>
+{
+    static T run(T x, T y)
+    {
+        const T max_value = integer_traits<T>::max();
+        const T min_value = integer_traits<T>::min();
+
+        if (x == 0 || y == 0) return true;
+
+        if (x > 0) {
+            if (y > 0)
+                return x <= max_value / y;
+            else
+                return y >= min_value / x;
+        } else {
+            if (y > 0)
+                return x >= min_value / y;
+            else
+                return y >= max_value / x;
+        }
+    }
+};
+
+template<typename T>
+struct is_mul_valid_impl<T, false, false>
+{
+    static T run(T x, T y)
+    {
+        const T max_value = integer_traits<T>::max();
+        if (x == 0 || y == 0) return true;
+        return x <= max_value / y;
+    }
+};
+
+template<typename T> inline T is_mul_valid(T x, T y, T /*result not used*/)
+{
+    return is_mul_valid_impl<T>::run(x, y);
+}
+
+template<typename T> inline T is_div_valid(T x, T y)
+{
+    return integer_traits<T>::is_signed ?
+                        // keep in mind that min/-1 is invalid because abs(min)>max
+                        y != 0 && (x != integer_traits<T>::min() || y != T(-1))
+                    :
+                        y != 0;
+}
+
+} // end namespace CheckedInt_internal
+
+
+/*** Step 4: Now define the CheckedInt class.
+ ***/
+
+/** \class CheckedInt
+  * \brief Integer wrapper class checking for integer overflow and other errors
+  * \param T the integer type to wrap. Can be any of int8_t, uint8_t, int16_t, uint16_t,
+  *          int32_t, uint32_t, int64_t, uint64_t.
+  *
+  * This class implements guarded integer arithmetic. Do a computation, then check that
+  * valid() returns true, you then have a guarantee that no problem, such as integer overflow,
+  * happened during this computation.
+  *
+  * The arithmetic operators in this class are guaranteed not to crash your app
+  * in case of a division by zero.
+  *
+  * For example, suppose that you want to implement a function that computes (x+y)/z,
+  * that doesn't crash if z==0, and that reports on error (divide by zero or integer overflow).
+  * You could code it as follows:
+    \code
+    bool compute_x_plus_y_over_z(int32_t x, int32_t y, int32_t z, int32_t *result)
+    {
+        CheckedInt<int32_t> checked_result = (CheckedInt<int32_t>(x) + y) / z;
+        *result = checked_result.value();
+        return checked_result.valid();
+    }
+    \endcode
+  *
+  * Implicit conversion from plain integers to checked integers is allowed. The plain integer
+  * is checked to be in range before being casted to the destination type. This means that the following
+  * lines all compile, and the resulting CheckedInts are correctly detected as valid or invalid:
+  * \code
+    CheckedInt<uint8_t> x(1);   // 1 is of type int, is found to be in range for uint8_t, x is valid
+    CheckedInt<uint8_t> x(-1);  // -1 is of type int, is found not to be in range for uint8_t, x is invalid
+    CheckedInt<int8_t> x(-1);   // -1 is of type int, is found to be in range for int8_t, x is valid
+    CheckedInt<int8_t> x(int16_t(1000)); // 1000 is of type int16_t, is found not to be in range for int8_t, x is invalid
+    CheckedInt<int32_t> x(uint32_t(123456789)); // 3123456789 is of type uint32_t, is found not to be in range
+                                             // for int32_t, x is invalid
+  * \endcode
+  * Implicit conversion from
+  * checked integers to plain integers is not allowed. As shown in the
+  * above example, to get the value of a checked integer as a normal integer, call value().
+  *
+  * Arithmetic operations between checked and plain integers is allowed; the result type
+  * is the type of the checked integer.
+  *
+  * Safe integers of different types cannot be used in the same arithmetic expression.
+  */
+template<typename T>
+class CheckedInt
+{
+protected:
+    T mValue;
+    T mIsValid; // stored as a T to limit the number of integer conversions when
+                // evaluating nested arithmetic expressions.
+
+    template<typename U>
+    CheckedInt(const U& value, bool isValid) : mValue(value), mIsValid(isValid)
+    {
+        CheckedInt_internal::integer_type_manually_recorded_info<T>
+            ::TYPE_NOT_SUPPORTED_BY_CheckedInt();
+    }
+
+public:
+    /** Constructs a checked integer with given \a value. The checked integer is initialized as valid or invalid
+      * depending on whether the \a value is in range.
+      *
+      * This constructor is not explicit. Instead, the type of its argument is a separate template parameter,
+      * ensuring that no conversion is performed before this constructor is actually called.
+      * As explained in the above documentation for class CheckedInt, this constructor checks that its argument is
+      * valid.
+      */
+    template<typename U>
+    CheckedInt(const U& value)
+        : mValue(value),
+          mIsValid(CheckedInt_internal::is_in_range<T>(value))
+    {
+        CheckedInt_internal::integer_type_manually_recorded_info<T>
+            ::TYPE_NOT_SUPPORTED_BY_CheckedInt();
+    }
+
+    /** Constructs a valid checked integer with uninitialized value */
+    CheckedInt() : mIsValid(1)
+    {
+        CheckedInt_internal::integer_type_manually_recorded_info<T>
+            ::TYPE_NOT_SUPPORTED_BY_CheckedInt();
+    }
+
+    /** \returns the actual value */
+    T value() const { return mValue; }
+
+    /** \returns true if the checked integer is valid, i.e. is not the result
+      * of an invalid operation or of an operation involving an invalid checked integer
+      */
+    bool valid() const { return mIsValid; }
+
+    /** \returns the sum. Checks for overflow. */
+    template<typename U> friend CheckedInt<U> operator +(const CheckedInt<U>& lhs, const CheckedInt<U>& rhs);
+    /** Adds. Checks for overflow. \returns self reference */
+    template<typename U> CheckedInt& operator +=(const U &rhs);
+    /** \returns the difference. Checks for overflow. */
+    template<typename U> friend CheckedInt<U> operator -(const CheckedInt<U>& lhs, const CheckedInt<U> &rhs);
+    /** Substracts. Checks for overflow. \returns self reference */
+    template<typename U> CheckedInt& operator -=(const U &rhs);
+    /** \returns the product. Checks for overflow. */
+    template<typename U> friend CheckedInt<U> operator *(const CheckedInt<U>& lhs, const CheckedInt<U> &rhs);
+    /** Multiplies. Checks for overflow. \returns self reference */
+    template<typename U> CheckedInt& operator *=(const U &rhs);
+    /** \returns the quotient. Checks for overflow and for divide-by-zero. */
+    template<typename U> friend CheckedInt<U> operator /(const CheckedInt<U>& lhs, const CheckedInt<U> &rhs);
+    /** Divides. Checks for overflow and for divide-by-zero. \returns self reference */
+    template<typename U> CheckedInt& operator /=(const U &rhs);
+
+    /** \returns the opposite value. Checks for overflow. */
+    CheckedInt operator -() const
+    {
+        T result = -value();
+        /* give the compiler a good chance to perform RVO */
+        return CheckedInt(result,
+                       mIsValid & CheckedInt_internal::is_sub_valid(T(0), value(), result));
+    }
+
+    /** \returns true if the left and right hand sides are valid and have the same value. */
+    bool operator ==(const CheckedInt& other) const
+    {
+        return bool(mIsValid & other.mIsValid & T(value() == other.value()));
+    }
+
+private:
+    /** operator!= is disabled. Indeed: (a!=b) should be the same as !(a==b) but that
+      * would mean that if a or b is invalid, (a!=b) is always true, which is very tricky.
+      */
+    template<typename U>
+    bool operator !=(const U& other) const { return !(*this == other); }
+};
+
+#define CHECKEDINT_BASIC_BINARY_OPERATOR(NAME, OP)               \
+template<typename T>                                          \
+inline CheckedInt<T> operator OP(const CheckedInt<T> &lhs, const CheckedInt<T> &rhs) \
+{                                                             \
+    T x = lhs.value();                                        \
+    T y = rhs.value();                                        \
+    T result = x OP y;                                        \
+    T is_op_valid                                             \
+        = CheckedInt_internal::is_##NAME##_valid(x, y, result);  \
+    /* give the compiler a good chance to perform RVO */      \
+    return CheckedInt<T>(result,                                 \
+                      lhs.mIsValid &                          \
+                      rhs.mIsValid &                          \
+                      is_op_valid);                           \
+}
+
+CHECKEDINT_BASIC_BINARY_OPERATOR(add, +)
+CHECKEDINT_BASIC_BINARY_OPERATOR(sub, -)
+CHECKEDINT_BASIC_BINARY_OPERATOR(mul, *)
+
+// division can't be implemented by CHECKEDINT_BASIC_BINARY_OPERATOR
+// because if rhs == 0, we are not allowed to even try to compute the quotient.
+template<typename T>
+inline CheckedInt<T> operator /(const CheckedInt<T> &lhs, const CheckedInt<T> &rhs)
+{
+    T x = lhs.value();
+    T y = rhs.value();
+    T is_op_valid = CheckedInt_internal::is_div_valid(x, y);
+    T result = is_op_valid ? (x / y) : 0;
+    /* give the compiler a good chance to perform RVO */
+    return CheckedInt<T>(result,
+                      lhs.mIsValid &
+                      rhs.mIsValid &
+                      is_op_valid);
+}
+
+// implement cast_to_CheckedInt<T>(x), making sure that
+//  - it allows x to be either a CheckedInt<T> or any integer type that can be casted to T
+//  - if x is already a CheckedInt<T>, we just return a reference to it, instead of copying it (optimization)
+
+template<typename T, typename U>
+struct cast_to_CheckedInt_impl
+{
+    typedef CheckedInt<T> return_type;
+    static CheckedInt<T> run(const U& u) { return u; }
+};
+
+template<typename T>
+struct cast_to_CheckedInt_impl<T, CheckedInt<T> >
+{
+    typedef const CheckedInt<T>& return_type;
+    static const CheckedInt<T>& run(const CheckedInt<T>& u) { return u; }
+};
+
+template<typename T, typename U>
+inline typename cast_to_CheckedInt_impl<T, U>::return_type
+cast_to_CheckedInt(const U& u)
+{
+    return cast_to_CheckedInt_impl<T, U>::run(u);
+}
+
+#define CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(OP, COMPOUND_OP) \
+template<typename T>                                          \
+template<typename U>                                          \
+CheckedInt<T>& CheckedInt<T>::operator COMPOUND_OP(const U &rhs)    \
+{                                                             \
+    *this = *this OP cast_to_CheckedInt<T>(rhs);                 \
+    return *this;                                             \
+}                                                             \
+template<typename T, typename U>                              \
+inline CheckedInt<T> operator OP(const CheckedInt<T> &lhs, const U &rhs) \
+{                                                             \
+    return lhs OP cast_to_CheckedInt<T>(rhs);                    \
+}                                                             \
+template<typename T, typename U>                              \
+inline CheckedInt<T> operator OP(const U & lhs, const CheckedInt<T> &rhs) \
+{                                                             \
+    return cast_to_CheckedInt<T>(lhs) OP rhs;                    \
+}
+
+CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(+, +=)
+CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(*, *=)
+CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(-, -=)
+CHECKEDINT_CONVENIENCE_BINARY_OPERATORS(/, /=)
+
+template<typename T, typename U>
+inline bool operator ==(const CheckedInt<T> &lhs, const U &rhs)
+{
+    return lhs == cast_to_CheckedInt<T>(rhs);
+}
+
+template<typename T, typename U>
+inline bool operator ==(const U & lhs, const CheckedInt<T> &rhs)
+{
+    return cast_to_CheckedInt<T>(lhs) == rhs;
+}
+
+} // end namespace WebCore
+
+#endif /* CheckedInt_h */
diff --git a/WebCore/html/canvas/WebGLBuffer.cpp b/WebCore/html/canvas/WebGLBuffer.cpp
index 8790b1a..4c87958 100644
--- a/WebCore/html/canvas/WebGLBuffer.cpp
+++ b/WebCore/html/canvas/WebGLBuffer.cpp
@@ -39,8 +39,8 @@ PassRefPtr<WebGLBuffer> WebGLBuffer::create(WebGLRenderingContext* ctx)
 
 WebGLBuffer::WebGLBuffer(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
-    , m_elementArrayBufferByteLength(0)
-    , m_arrayBufferByteLength(0)
+    , m_target(0)
+    , m_byteLength(0)
     , m_nextAvailableCacheEntry(0)
 {
     setObject(context()->graphicsContext3D()->createBuffer());
@@ -52,50 +52,51 @@ void WebGLBuffer::_deleteObject(Platform3DObject object)
     context()->graphicsContext3D()->deleteBuffer(object);
 }
 
-bool WebGLBuffer::associateBufferData(unsigned long target, int size)
+bool WebGLBuffer::associateBufferData(int size)
 {
-    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
-        m_elementArrayBufferByteLength = size;
-        return true;
-    }
-    
-    if (target == GraphicsContext3D::ARRAY_BUFFER) {
-        m_arrayBufferByteLength = size;
+    switch (m_target) {
+    case GraphicsContext3D::ELEMENT_ARRAY_BUFFER:
+    case GraphicsContext3D::ARRAY_BUFFER:
+        m_byteLength = size;
         return true;
+    default:
+        return false;
     }
-
-    return false;
 }
 
-bool WebGLBuffer::associateBufferData(unsigned long target, ArrayBufferView* array)
+bool WebGLBuffer::associateBufferData(ArrayBufferView* array)
 {
+    if (!m_target)
+        return false;
     if (!array)
         return false;
-        
-    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+
+    if (m_target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
         clearCachedMaxIndices();
-        m_elementArrayBufferByteLength = array->byteLength();
+        m_byteLength = array->byteLength();
         // We must always clone the incoming data because client-side
         // modifications without calling bufferData or bufferSubData
         // must never be able to change the validation results.
         m_elementArrayBuffer = ArrayBuffer::create(array->buffer().get());
         return true;
     }
-    
-    if (target == GraphicsContext3D::ARRAY_BUFFER) {
-        m_arrayBufferByteLength = array->byteLength();
+
+    if (m_target == GraphicsContext3D::ARRAY_BUFFER) {
+        m_byteLength = array->byteLength();
         return true;
     }
     
     return false;
 }
 
-bool WebGLBuffer::associateBufferSubData(unsigned long target, long offset, ArrayBufferView* array)
+bool WebGLBuffer::associateBufferSubData(long offset, ArrayBufferView* array)
 {
+    if (!m_target)
+        return false;
     if (!array)
         return false;
-        
-    if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
+
+    if (m_target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER) {
         clearCachedMaxIndices();
 
         // We need to protect against integer overflow with these tests
@@ -103,22 +104,22 @@ bool WebGLBuffer::associateBufferSubData(unsigned long target, long offset, Arra
             return false;
             
         unsigned long uoffset = static_cast<unsigned long>(offset);
-        if (uoffset > m_elementArrayBufferByteLength || array->byteLength() > m_elementArrayBufferByteLength - uoffset)
+        if (uoffset > m_byteLength || array->byteLength() > m_byteLength - uoffset)
             return false;
             
         memcpy(static_cast<unsigned char*>(m_elementArrayBuffer->data()) + offset, array->baseAddress(), array->byteLength());
         return true;
     }
-    
-    if (target == GraphicsContext3D::ARRAY_BUFFER)
-        return array->byteLength() + offset <= m_arrayBufferByteLength;
+
+    if (m_target == GraphicsContext3D::ARRAY_BUFFER)
+        return array->byteLength() + offset <= m_byteLength;
 
     return false;
 }
 
-unsigned WebGLBuffer::byteLength(unsigned long target) const
+unsigned WebGLBuffer::byteLength() const
 {
-    return (target == GraphicsContext3D::ARRAY_BUFFER) ? m_arrayBufferByteLength : m_elementArrayBufferByteLength;
+    return m_byteLength;
 }
 
 long WebGLBuffer::getCachedMaxIndex(unsigned long type)
@@ -143,6 +144,15 @@ void WebGLBuffer::setCachedMaxIndex(unsigned long type, long value)
     m_nextAvailableCacheEntry = (m_nextAvailableCacheEntry + 1) % numEntries;
 }
 
+void WebGLBuffer::setTarget(unsigned long target)
+{
+    // In WebGL, a buffer is bound to one target in its lifetime
+    if (m_target)
+        return;
+    if (target == GraphicsContext3D::ARRAY_BUFFER || target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER)
+        m_target = target;
+}
+
 void WebGLBuffer::clearCachedMaxIndices()
 {
     memset(m_maxIndexCache, 0, sizeof(m_maxIndexCache));
diff --git a/WebCore/html/canvas/WebGLBuffer.h b/WebCore/html/canvas/WebGLBuffer.h
index bd9f190..e1fec47 100644
--- a/WebCore/html/canvas/WebGLBuffer.h
+++ b/WebCore/html/canvas/WebGLBuffer.h
@@ -40,11 +40,11 @@ namespace WebCore {
         
         static PassRefPtr<WebGLBuffer> create(WebGLRenderingContext*);
 
-        bool associateBufferData(unsigned long target, int size);
-        bool associateBufferData(unsigned long target, ArrayBufferView* array);
-        bool associateBufferSubData(unsigned long target, long offset, ArrayBufferView* array);
+        bool associateBufferData(int size);
+        bool associateBufferData(ArrayBufferView* array);
+        bool associateBufferSubData(long offset, ArrayBufferView* array);
         
-        unsigned byteLength(unsigned long target) const;
+        unsigned byteLength() const;
         const ArrayBuffer* elementArrayBuffer() const { return m_elementArrayBuffer.get(); }
                         
         // Gets the cached max index for the given type. Returns -1 if
@@ -53,6 +53,9 @@ namespace WebCore {
         // Sets the cached max index for the given type.
         void setCachedMaxIndex(unsigned long type, long value);
 
+        unsigned long getTarget() const { return m_target; }
+        void setTarget(unsigned long);
+
     protected:
         WebGLBuffer(WebGLRenderingContext*);
 
@@ -61,9 +64,10 @@ namespace WebCore {
     private:
         virtual bool isBuffer() const { return true; }
 
+        unsigned long m_target;
+
         RefPtr<ArrayBuffer> m_elementArrayBuffer;
-        unsigned m_elementArrayBufferByteLength;
-        unsigned m_arrayBufferByteLength;
+        unsigned m_byteLength;
 
         // Optimization for index validation. For each type of index
         // (i.e., UNSIGNED_SHORT), cache the maximum index in the
diff --git a/WebCore/html/canvas/WebGLGetInfo.cpp b/WebCore/html/canvas/WebGLGetInfo.cpp
index 79fc971..0c8b548 100644
--- a/WebCore/html/canvas/WebGLGetInfo.cpp
+++ b/WebCore/html/canvas/WebGLGetInfo.cpp
@@ -46,6 +46,16 @@ WebGLGetInfo::WebGLGetInfo(bool value)
 {
 }
 
+WebGLGetInfo::WebGLGetInfo(const bool* value, int size)
+    : m_type(kTypeBoolArray)
+{
+    if (!value || size <=0)
+        return;
+    m_boolArray.resize(size);
+    for (int ii = 0; ii < size; ++ii)
+        m_boolArray[ii] = value[ii];
+}
+
 WebGLGetInfo::WebGLGetInfo(float value)
     : m_type(kTypeFloat)
     , m_float(value)
@@ -138,6 +148,12 @@ bool WebGLGetInfo::getBool() const
     return m_bool;
 }
 
+const Vector<bool>& WebGLGetInfo::getBoolArray() const
+{
+    ASSERT(getType() == kTypeBoolArray);
+    return m_boolArray;
+}
+
 float WebGLGetInfo::getFloat() const
 {
     ASSERT(getType() == kTypeFloat);
diff --git a/WebCore/html/canvas/WebGLGetInfo.h b/WebCore/html/canvas/WebGLGetInfo.h
index b35add8..94f6f9b 100644
--- a/WebCore/html/canvas/WebGLGetInfo.h
+++ b/WebCore/html/canvas/WebGLGetInfo.h
@@ -53,6 +53,7 @@ class WebGLGetInfo {
 public:
     enum Type {
         kTypeBool,
+        kTypeBoolArray,
         kTypeFloat,
         kTypeLong,
         kTypeNull,
@@ -70,6 +71,7 @@ public:
     };
 
     WebGLGetInfo(bool value);
+    WebGLGetInfo(const bool* value, int size);
     WebGLGetInfo(float value);
     WebGLGetInfo(long value);
     // Represents the NULL value and type
@@ -92,6 +94,7 @@ public:
     Type getType() const;
 
     bool getBool() const;
+    const Vector<bool>& getBoolArray() const;
     float getFloat() const;
     long getLong() const;
     const String& getString() const;
@@ -110,6 +113,7 @@ public:
 private:
     Type m_type;
     bool m_bool;
+    Vector<bool> m_boolArray;
     float m_float;
     long m_long;
     String m_string;
diff --git a/WebCore/html/canvas/WebGLProgram.cpp b/WebCore/html/canvas/WebGLProgram.cpp
index 750df45..0004465 100644
--- a/WebCore/html/canvas/WebGLProgram.cpp
+++ b/WebCore/html/canvas/WebGLProgram.cpp
@@ -39,6 +39,7 @@ PassRefPtr<WebGLProgram> WebGLProgram::create(WebGLRenderingContext* ctx)
 
 WebGLProgram::WebGLProgram(WebGLRenderingContext* ctx)
     : CanvasObject(ctx)
+    , m_linkFailure(false)
 {
     setObject(context()->graphicsContext3D()->createProgram());
 }
@@ -71,18 +72,27 @@ bool WebGLProgram::cacheActiveAttribLocations()
     return true;
 }
 
-int WebGLProgram::numActiveAttribLocations()
+int WebGLProgram::numActiveAttribLocations() const
 {
     return static_cast<int>(m_activeAttribLocations.size());
 }
 
-int WebGLProgram::getActiveAttribLocation(int index)
+int WebGLProgram::getActiveAttribLocation(int index) const
 {
     if (index < 0 || index >= numActiveAttribLocations())
         return -1;
     return m_activeAttribLocations[static_cast<size_t>(index)];
 }
 
+bool WebGLProgram::isUsingVertexAttrib0() const
+{
+    for (int ii = 0; ii < numActiveAttribLocations(); ++ii) {
+        if (!getActiveAttribLocation(ii))
+            return true;
+    }
+    return false;
+}
+
 }
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLProgram.h b/WebCore/html/canvas/WebGLProgram.h
index b13fc22..1049334 100644
--- a/WebCore/html/canvas/WebGLProgram.h
+++ b/WebCore/html/canvas/WebGLProgram.h
@@ -43,8 +43,16 @@ namespace WebCore {
         // cacheActiveAttribLocation() is only called once after linkProgram()
         // succeeds.
         bool cacheActiveAttribLocations();
-        int numActiveAttribLocations();
-        int getActiveAttribLocation(int index);
+        int numActiveAttribLocations() const;
+        int getActiveAttribLocation(int index) const;
+
+        bool isUsingVertexAttrib0() const;
+
+        // Return true means getProgramParameter(LINK_STATUS) should return
+        // false; return false means we should actually call
+        // getProgramParameter(LINK_STATUS) to find out.
+        bool isLinkFailureFlagSet() const { return m_linkFailure; }
+        void setLinkFailureFlag(bool failed) { m_linkFailure = failed; }
 
     protected:
         WebGLProgram(WebGLRenderingContext*);
@@ -55,6 +63,8 @@ namespace WebCore {
         virtual bool isProgram() const { return true; }
 
         Vector<int> m_activeAttribLocations;
+
+        bool m_linkFailure;
     };
     
 } // namespace WebCore
diff --git a/WebCore/html/canvas/WebGLRenderingContext.cpp b/WebCore/html/canvas/WebGLRenderingContext.cpp
index 2124506..c3dea58 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -29,6 +29,7 @@
 
 #include "WebGLRenderingContext.h"
 
+#include "CheckedInt.h"
 #include "CanvasPixelArray.h"
 #include "Console.h"
 #include "DOMWindow.h"
@@ -52,6 +53,7 @@
 #include "WebGLUniformLocation.h"
 
 #include <wtf/ByteArray.h>
+#include <wtf/OwnArrayPtr.h>
 
 namespace WebCore {
 
@@ -120,8 +122,10 @@ WebGLRenderingContext::WebGLRenderingContext(HTMLCanvasElement* passedCanvas, Pa
     m_context->getIntegerv(GraphicsContext3D::MAX_CUBE_MAP_TEXTURE_SIZE, &maxCubeMapTextureSize);
     m_maxCubeMapTextureSize = maxCubeMapTextureSize;
 
-    if (!isGLES2Compliant())
+    if (!isGLES2Compliant()) {
         createFallbackBlackTextures1x1();
+        initVertexAttrib0();
+    }
     m_context->reshape(canvas()->width(), canvas()->height());
     m_context->viewport(0, 0, canvas()->width(), canvas()->height());
 }
@@ -192,7 +196,7 @@ int WebGLRenderingContext::sizeInBytes(int type, ExceptionCode& ec)
 void WebGLRenderingContext::activeTexture(unsigned long texture, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if ((texture - GraphicsContext3D::TEXTURE0) > sizeof(m_textureUnits) / sizeof(TextureUnitState)) {
+    if (texture - GraphicsContext3D::TEXTURE0 >= m_textureUnits.size()) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return;
     }
@@ -204,10 +208,8 @@ void WebGLRenderingContext::activeTexture(unsigned long texture, ExceptionCode&
 void WebGLRenderingContext::attachShader(WebGLProgram* program, WebGLShader* shader, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!program || program->context() != this || !shader || shader->context() != this) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+    if (!validateWebGLObject(program) || !validateWebGLObject(shader))
         return;
-    }
     m_context->attachShader(program, shader);
     cleanupAfterGraphicsCall(false);
 }
@@ -228,6 +230,10 @@ void WebGLRenderingContext::bindBuffer(unsigned long target, WebGLBuffer* buffer
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
         return;
     }
+    if (buffer && buffer->getTarget() && buffer->getTarget() != target) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
 
     if (target == GraphicsContext3D::ARRAY_BUFFER)
         m_boundArrayBuffer = buffer;
@@ -239,6 +245,8 @@ void WebGLRenderingContext::bindBuffer(unsigned long target, WebGLBuffer* buffer
     }
 
     m_context->bindBuffer(target, buffer);
+    if (buffer)
+        buffer->setTarget(target);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -307,12 +315,20 @@ void WebGLRenderingContext::blendColor(double red, double green, double blue, do
 
 void WebGLRenderingContext::blendEquation( unsigned long mode )
 {
+    if (!isGLES2Compliant()) {
+        if (!validateBlendEquation(mode))
+            return;
+    }
     m_context->blendEquation(mode);
     cleanupAfterGraphicsCall(false);
 }
 
 void WebGLRenderingContext::blendEquationSeparate(unsigned long modeRGB, unsigned long modeAlpha)
 {
+    if (!isGLES2Compliant()) {
+        if (!validateBlendEquation(modeRGB) || !validateBlendEquation(modeAlpha))
+            return;
+    }
     m_context->blendEquationSeparate(modeRGB, modeAlpha);
     cleanupAfterGraphicsCall(false);
 }
@@ -334,12 +350,12 @@ void WebGLRenderingContext::bufferData(unsigned long target, int size, unsigned
 {
     UNUSED_PARAM(ec);
     if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
-        if (!m_boundElementArrayBuffer->associateBufferData(target, size)) {
+        if (!m_boundElementArrayBuffer->associateBufferData(size)) {
             m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
             return;
         }
     } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
-        if (!m_boundArrayBuffer->associateBufferData(target, size)) {
+        if (!m_boundArrayBuffer->associateBufferData(size)) {
             m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
             return;
         }
@@ -356,12 +372,12 @@ void WebGLRenderingContext::bufferData(unsigned long target, ArrayBufferView* da
 {
     UNUSED_PARAM(ec);
     if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
-        if (!m_boundElementArrayBuffer->associateBufferData(target, data)) {
+        if (!m_boundElementArrayBuffer->associateBufferData(data)) {
             m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
             return;
         }
     } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
-        if (!m_boundArrayBuffer->associateBufferData(target, data)) {
+        if (!m_boundArrayBuffer->associateBufferData(data)) {
             m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
             return;
         }
@@ -378,12 +394,12 @@ void WebGLRenderingContext::bufferSubData(unsigned long target, long offset, Arr
 {
     UNUSED_PARAM(ec);
     if (target == GraphicsContext3D::ELEMENT_ARRAY_BUFFER && m_boundElementArrayBuffer) {
-        if (!m_boundElementArrayBuffer->associateBufferSubData(target, offset, data)) {
+        if (!m_boundElementArrayBuffer->associateBufferSubData(offset, data)) {
             m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
             return;
         }
     } else if (target == GraphicsContext3D::ARRAY_BUFFER && m_boundArrayBuffer) {
-        if (!m_boundArrayBuffer->associateBufferSubData(target, offset, data)) {
+        if (!m_boundArrayBuffer->associateBufferSubData(offset, data)) {
             m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
             return;
         }
@@ -562,6 +578,20 @@ void WebGLRenderingContext::deleteBuffer(WebGLBuffer* buffer)
         return;
     
     buffer->deleteObject();
+
+    if (!isGLES2Compliant()) {
+        VertexAttribState& state = m_vertexAttribState[0];
+        if (buffer == state.bufferBinding) {
+            state.bufferBinding = m_vertexAttrib0Buffer;
+            state.bytesPerElement = 0;
+            state.size = 4;
+            state.type = GraphicsContext3D::FLOAT;
+            state.normalized = false;
+            state.stride = 16;
+            state.originalStride = 0;
+            state.offset = 0;
+        }
+    }
 }
 
 void WebGLRenderingContext::deleteFramebuffer(WebGLFramebuffer* framebuffer)
@@ -638,6 +668,10 @@ void WebGLRenderingContext::detachShader(WebGLProgram* program, WebGLShader* sha
 
 void WebGLRenderingContext::disable(unsigned long cap)
 {
+    if (!isGLES2Compliant()) {
+        if (!validateCapability(cap))
+            return;
+    }
     m_context->disable(cap);
     cleanupAfterGraphicsCall(false);
 }
@@ -652,9 +686,11 @@ void WebGLRenderingContext::disableVertexAttribArray(unsigned long index, Except
     
     if (index < m_vertexAttribState.size())
         m_vertexAttribState[index].enabled = false;
-    
-    m_context->disableVertexAttribArray(index);
-    cleanupAfterGraphicsCall(false);
+
+    if (index > 0 || isGLES2Compliant()) {
+        m_context->disableVertexAttribArray(index);
+        cleanupAfterGraphicsCall(false);
+    }
 }
 
 bool WebGLRenderingContext::validateElementArraySize(unsigned long count, unsigned long type, long offset)
@@ -675,11 +711,11 @@ bool WebGLRenderingContext::validateElementArraySize(unsigned long count, unsign
         // Make uoffset an element offset.
         uoffset /= 2;
 
-        unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER) / 2;
+        unsigned long n = m_boundElementArrayBuffer->byteLength() / 2;
         if (uoffset > n || count > n - uoffset)
             return false;
     } else if (type == GraphicsContext3D::UNSIGNED_BYTE) {
-        unsigned long n = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER);
+        unsigned long n = m_boundElementArrayBuffer->byteLength();
         if (uoffset > n || count > n - uoffset)
             return false;
     }
@@ -699,17 +735,25 @@ bool WebGLRenderingContext::validateIndexArrayConservative(unsigned long type, l
         // Compute the maximum index in the entire buffer for the given type of index.
         switch (type) {
         case GraphicsContext3D::UNSIGNED_BYTE: {
-            unsigned numElements = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER);
-            const unsigned char* p = static_cast<const unsigned char*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
-            for (unsigned i = 0; i < numElements; i++)
-                maxIndex = max(maxIndex, static_cast<long>(p[i]));
+            unsigned numElements = m_boundElementArrayBuffer->byteLength();
+            if (!numElements)
+                maxIndex = 0;
+            else {
+                const unsigned char* p = static_cast<const unsigned char*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
+                for (unsigned i = 0; i < numElements; i++)
+                    maxIndex = max(maxIndex, static_cast<long>(p[i]));
+            }
             break;
         }
         case GraphicsContext3D::UNSIGNED_SHORT: {
-            unsigned numElements = m_boundElementArrayBuffer->byteLength(GraphicsContext3D::ELEMENT_ARRAY_BUFFER) / sizeof(unsigned short);
-            const unsigned short* p = static_cast<const unsigned short*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
-            for (unsigned i = 0; i < numElements; i++)
-                maxIndex = max(maxIndex, static_cast<long>(p[i]));
+            unsigned numElements = m_boundElementArrayBuffer->byteLength() / sizeof(unsigned short);
+            if (!numElements)
+                maxIndex = 0;
+            else {
+                const unsigned short* p = static_cast<const unsigned short*>(m_boundElementArrayBuffer->elementArrayBuffer()->data());
+                for (unsigned i = 0; i < numElements; i++)
+                    maxIndex = max(maxIndex, static_cast<long>(p[i]));
+            }
             break;
         }
         default:
@@ -766,8 +810,10 @@ bool WebGLRenderingContext::validateRenderingState(long numElementsRequired)
     if (!m_currentProgram)
         return false;
 
+    int numAttribStates = static_cast<int>(m_vertexAttribState.size());
+
     // Look in each enabled vertex attrib and check if they've been bound to a buffer.
-    for (size_t i = 0; i < m_vertexAttribState.size(); ++i) {
+    for (int i = 0; i < numAttribStates; ++i) {
         if (m_vertexAttribState[i].enabled
             && (!m_vertexAttribState[i].bufferBinding || !m_vertexAttribState[i].bufferBinding->object()))
             return false;
@@ -776,13 +822,21 @@ bool WebGLRenderingContext::validateRenderingState(long numElementsRequired)
     // Look in each consumed vertex attrib (by the current program) and find the smallest buffer size
     long smallestNumElements = LONG_MAX;
     int numActiveAttribLocations = m_currentProgram->numActiveAttribLocations();
-    int numAttribStates = static_cast<int>(m_vertexAttribState.size());
     for (int i = 0; i < numActiveAttribLocations; ++i) {
         int loc = m_currentProgram->getActiveAttribLocation(i);
         if (loc >=0 && loc < numAttribStates) {
             const VertexAttribState& state = m_vertexAttribState[loc];
-            if (state.enabled && state.numElements < smallestNumElements)
-                smallestNumElements = state.numElements;
+            if (state.enabled) {
+                // Avoid off-by-one errors in numElements computation.
+                // For the last element, we will only touch the data for the
+                // element and nothing beyond it.
+                long bytesRemaining = state.bufferBinding->byteLength() - state.offset;
+                long numElements = 0;
+                if (bytesRemaining >= state.bytesPerElement)
+                    numElements = 1 + (bytesRemaining - state.bytesPerElement) / state.stride;
+                if (numElements < smallestNumElements)
+                    smallestNumElements = numElements;
+            }
         }
     }
     
@@ -817,18 +871,26 @@ void WebGLRenderingContext::drawArrays(unsigned long mode, long first, long coun
         return;
     }
 
-    if (!count)
-        return;
-
     // Ensure we have a valid rendering state
-    if (!validateRenderingState(first + count)) {
+    CheckedInt<int32_t> checkedFirst(first);
+    CheckedInt<int32_t> checkedCount(count);
+    CheckedInt<int32_t> checkedSum = checkedFirst + checkedCount;
+    if (!checkedSum.valid() || !validateRenderingState(checkedSum.value())) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
         return;
     }
 
-    handleNPOTTextures(true);
+    bool vertexAttrib0Simulated = false;
+    if (!isGLES2Compliant()) {
+        vertexAttrib0Simulated = simulateVertexAttrib0(first + count - 1);
+        handleNPOTTextures(true);
+    }
     m_context->drawArrays(mode, first, count);
-    handleNPOTTextures(false);
+    if (!isGLES2Compliant()) {
+        handleNPOTTextures(false);
+        if (vertexAttrib0Simulated)
+            restoreStatesAfterVertexAttrib0Simulation();
+    }
     cleanupAfterGraphicsCall(true);
 }
 
@@ -853,9 +915,6 @@ void WebGLRenderingContext::drawElements(unsigned long mode, long count, unsigne
         return;
     }
 
-    if (!count)
-        return;
-
     // Ensure we have a valid rendering state
     long numElements;
     
@@ -870,14 +929,26 @@ void WebGLRenderingContext::drawElements(unsigned long mode, long count, unsigne
             return;
         }
 
-    handleNPOTTextures(true);
+    bool vertexAttrib0Simulated = false;
+    if (!isGLES2Compliant()) {
+        vertexAttrib0Simulated = simulateVertexAttrib0(numElements);
+        handleNPOTTextures(true);
+    }
     m_context->drawElements(mode, count, type, offset);
-    handleNPOTTextures(false);
+    if (!isGLES2Compliant()) {
+        handleNPOTTextures(false);
+        if (vertexAttrib0Simulated)
+            restoreStatesAfterVertexAttrib0Simulation();
+    }
     cleanupAfterGraphicsCall(true);
 }
 
 void WebGLRenderingContext::enable(unsigned long cap)
 {
+    if (!isGLES2Compliant()) {
+        if (!validateCapability(cap))
+            return;
+    }
     m_context->enable(cap);
     cleanupAfterGraphicsCall(false);
 }
@@ -1040,6 +1111,33 @@ PassRefPtr<WebGLActiveInfo> WebGLRenderingContext::getActiveUniform(WebGLProgram
     return WebGLActiveInfo::create(info.name, info.type, info.size);
 }
 
+bool WebGLRenderingContext::getAttachedShaders(WebGLProgram* program, Vector<WebGLShader*>& shaderObjects, ExceptionCode& ec)
+{
+    UNUSED_PARAM(ec);
+    shaderObjects.clear();
+    if (!validateWebGLObject(program))
+        return false;
+    int numShaders = 0;
+    m_context->getProgramiv(program, GraphicsContext3D::ATTACHED_SHADERS, &numShaders);
+    if (numShaders) {
+        OwnArrayPtr<unsigned int> shaders(new unsigned int[numShaders]);
+        int count;
+        m_context->getAttachedShaders(program, numShaders, &count, shaders.get());
+        if (count != numShaders)
+            return false;
+        shaderObjects.resize(numShaders);
+        for (int ii = 0; ii < numShaders; ++ii) {
+            WebGLShader* shader = findShader(shaders[ii]);
+            if (!shader) {
+                shaderObjects.clear();
+                return false;
+            }
+            shaderObjects[ii] = shader;
+        }
+    }
+    return true;
+}
+
 int WebGLRenderingContext::getAttribLocation(WebGLProgram* program, const String& name)
 {
     return m_context->getAttribLocation(program, name);
@@ -1162,7 +1260,7 @@ WebGLGetInfo WebGLRenderingContext::getParameter(unsigned long pname, ExceptionC
     case GraphicsContext3D::COLOR_CLEAR_VALUE:
         return getWebGLFloatArrayParameter(pname);
     case GraphicsContext3D::COLOR_WRITEMASK:
-        return getWebGLUnsignedByteArrayParameter(pname);
+        return getBooleanArrayParameter(pname);
     case GraphicsContext3D::COMPRESSED_TEXTURE_FORMATS:
         // Defined as null in the spec
         return WebGLGetInfo();
@@ -1318,10 +1416,14 @@ WebGLGetInfo WebGLRenderingContext::getProgramParameter(WebGLProgram* program, u
     int value = 0;
     switch (pname) {
     case GraphicsContext3D::DELETE_STATUS:
-    case GraphicsContext3D::LINK_STATUS:
     case GraphicsContext3D::VALIDATE_STATUS:
         m_context->getProgramiv(program, pname, &value);
         return WebGLGetInfo(static_cast<bool>(value));
+    case GraphicsContext3D::LINK_STATUS:
+        if (program->isLinkFailureFlagSet())
+            return WebGLGetInfo(false);
+        m_context->getProgramiv(program, pname, &value);
+        return WebGLGetInfo(static_cast<bool>(value));
     case GraphicsContext3D::INFO_LOG_LENGTH:
     case GraphicsContext3D::ATTACHED_SHADERS:
     case GraphicsContext3D::ACTIVE_ATTRIBUTES:
@@ -1469,13 +1571,24 @@ WebGLGetInfo WebGLRenderingContext::getUniform(WebGLProgram* program, const WebG
         ActiveInfo info;
         if (!m_context->getActiveUniform(program, i, info))
             return WebGLGetInfo();
-        // Now need to look this up by name again to find its location
-        long loc = m_context->getUniformLocation(program, info.name);
-        if (loc == location) {
-            // Found it. Use the type in the ActiveInfo to determine the return type.
-            GraphicsContext3D::WebGLEnumType baseType;
-            unsigned length;
-            switch (info.type) {
+        // Strip "[0]" from the name if it's an array.
+        if (info.size > 1)
+            info.name = info.name.left(info.name.length() - 3);
+        // If it's an array, we need to iterate through each element, appending "[index]" to the name.
+        for (int index = 0; index < info.size; ++index) {
+            String name = info.name;
+            if (info.size > 1 && index >= 1) {
+                name.append('[');
+                name.append(String::number(index));
+                name.append(']');
+            }
+            // Now need to look this up by name again to find its location
+            long loc = m_context->getUniformLocation(program, name);
+            if (loc == location) {
+                // Found it. Use the type in the ActiveInfo to determine the return type.
+                GraphicsContext3D::WebGLEnumType baseType;
+                unsigned length;
+                switch (info.type) {
                 case GraphicsContext3D::BOOL:
                     baseType = GraphicsContext3D::BOOL;
                     length = 1;
@@ -1541,38 +1654,36 @@ WebGLGetInfo WebGLRenderingContext::getUniform(WebGLProgram* program, const WebG
                     // FIXME: what to do about samplers?
                     m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
                     return WebGLGetInfo();
-            }
-            switch (baseType) {
-            case GraphicsContext3D::FLOAT: {
-                float value[16] = {0};
-                m_context->getUniformfv(program, location, value);
-                if (length == 1)
-                    return WebGLGetInfo(value[0]);
-                else
+                }
+                switch (baseType) {
+                case GraphicsContext3D::FLOAT: {
+                    float value[16] = {0};
+                    m_context->getUniformfv(program, location, value);
+                    if (length == 1)
+                        return WebGLGetInfo(value[0]);
                     return WebGLGetInfo(Float32Array::create(value, length));
-            }
-            case GraphicsContext3D::INT: {
-                int value[16] = {0};
-                m_context->getUniformiv(program, location, value);
-                if (length == 1)
-                    return WebGLGetInfo(static_cast<long>(value[0]));
-                else
+                }
+                case GraphicsContext3D::INT: {
+                    int value[16] = {0};
+                    m_context->getUniformiv(program, location, value);
+                    if (length == 1)
+                        return WebGLGetInfo(static_cast<long>(value[0]));
                     return WebGLGetInfo(Int32Array::create(value, length));
-            }
-            case GraphicsContext3D::BOOL: {
-                int value[16] = {0};
-                m_context->getUniformiv(program, location, value);
-                if (length == 1)
+                }
+                case GraphicsContext3D::BOOL: {
+                    int value[16] = {0};
+                    m_context->getUniformiv(program, location, value);
+                    if (length > 1) {
+                        unsigned char boolValue[16] = {0};
+                        for (unsigned j = 0; j < length; j++)
+                            boolValue[j] = static_cast<bool>(value[j]);
+                        return WebGLGetInfo(Uint8Array::create(boolValue, length));
+                    }
                     return WebGLGetInfo(static_cast<bool>(value[0]));
-                else {
-                    unsigned char boolValue[16] = {0};
-                    for (unsigned j = 0; j < length; j++)
-                        boolValue[j] = static_cast<bool>(value[j]);
-                    return WebGLGetInfo(Uint8Array::create(boolValue, length));
                 }
-            }
-            default:
-                notImplemented();
+                default:
+                    notImplemented();
+                }
             }
         }
     }
@@ -1597,39 +1708,48 @@ WebGLGetInfo WebGLRenderingContext::getVertexAttrib(unsigned long index, unsigne
 {
     UNUSED_PARAM(ec);
     WebGLStateRestorer(this, false);
-    switch (pname) {
-    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_BUFFER_BINDING: {
-        int name = 0;
-        m_context->getVertexAttribiv(index, pname, &name);
-        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(findBuffer(static_cast<Platform3DObject>(name))));
+    if (index >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return WebGLGetInfo();
     }
+    switch (pname) {
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_BUFFER_BINDING:
+        if (!isGLES2Compliant() && !index && m_vertexAttribState[0].bufferBinding == m_vertexAttrib0Buffer
+            || index >= m_vertexAttribState.size()
+            || !m_vertexAttribState[index].bufferBinding
+            || !m_vertexAttribState[index].bufferBinding->object())
+            return WebGLGetInfo();
+        return WebGLGetInfo(PassRefPtr<WebGLBuffer>(m_vertexAttribState[index].bufferBinding));
     case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_ENABLED:
-    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_NORMALIZED: {
-        int value = 0;
-        m_context->getVertexAttribiv(index, pname, &value);
-        return WebGLGetInfo(static_cast<bool>(value));
-    }
+        if (index >= m_vertexAttribState.size())
+            return WebGLGetInfo(false);
+        return WebGLGetInfo(m_vertexAttribState[index].enabled);
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_NORMALIZED:
+        if (index >= m_vertexAttribState.size())
+            return WebGLGetInfo(false);
+        return WebGLGetInfo(m_vertexAttribState[index].normalized);
     case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_SIZE:
-    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_STRIDE: {
-        int value = 0;
-        m_context->getVertexAttribiv(index, pname, &value);
-        return WebGLGetInfo(static_cast<long>(value));
-    }
-    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_TYPE: {
-        int value = 0;
-        m_context->getVertexAttribiv(index, pname, &value);
-        return WebGLGetInfo(static_cast<unsigned long>(value));
-    }
-    case GraphicsContext3D::CURRENT_VERTEX_ATTRIB: {
-        float value[4] = {0};
-        m_context->getVertexAttribfv(index, pname, value);
-        return WebGLGetInfo(Float32Array::create(value, 4));
-    }
-    default: {
+        if (index >= m_vertexAttribState.size())
+            return WebGLGetInfo(static_cast<long>(4));
+        return WebGLGetInfo(m_vertexAttribState[index].size);
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_STRIDE:
+        if (index >= m_vertexAttribState.size())
+            return WebGLGetInfo(static_cast<long>(0));
+        return WebGLGetInfo(m_vertexAttribState[index].originalStride);
+    case GraphicsContext3D::VERTEX_ATTRIB_ARRAY_TYPE:
+        if (index >= m_vertexAttribState.size())
+            return WebGLGetInfo(static_cast<unsigned long>(GraphicsContext3D::FLOAT));
+        return WebGLGetInfo(m_vertexAttribState[index].type);
+    case GraphicsContext3D::CURRENT_VERTEX_ATTRIB:
+        if (index >= m_vertexAttribState.size()) {
+            float value[4] = { 0.0f, 0.0f, 0.0f, 1.0f };
+            return WebGLGetInfo(Float32Array::create(value, 4));
+        }
+        return WebGLGetInfo(Float32Array::create(m_vertexAttribState[index].value, 4));
+    default:
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return WebGLGetInfo();
     }
-    }
 }
 
 long WebGLRenderingContext::getVertexAttribOffset(unsigned long index, unsigned long pname)
@@ -1641,6 +1761,12 @@ long WebGLRenderingContext::getVertexAttribOffset(unsigned long index, unsigned
 
 void WebGLRenderingContext::hint(unsigned long target, unsigned long mode)
 {
+    if (!isGLES2Compliant()) {
+        if (target != GraphicsContext3D::GENERATE_MIPMAP_HINT) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+            return;
+        }
+    }
     m_context->hint(target, mode);
     cleanupAfterGraphicsCall(false);
 }
@@ -1655,6 +1781,10 @@ bool WebGLRenderingContext::isBuffer(WebGLBuffer* buffer)
 
 bool WebGLRenderingContext::isEnabled(unsigned long cap)
 {
+    if (!isGLES2Compliant()) {
+        if (!validateCapability(cap))
+            return false;
+    }
     return m_context->isEnabled(cap);
 }
 
@@ -1709,6 +1839,28 @@ void WebGLRenderingContext::linkProgram(WebGLProgram* program, ExceptionCode& ec
     UNUSED_PARAM(ec);
     if (!validateWebGLObject(program))
         return;
+    if (!isGLES2Compliant()) {
+        Vector<WebGLShader*> shaders;
+        bool succeed = getAttachedShaders(program, shaders, ec);
+        if (succeed) {
+            bool vShader = false;
+            bool fShader = false;
+            for (size_t ii = 0; ii < shaders.size() && (!vShader || !fShader); ++ii) {
+                if (shaders[ii]->getType() == GraphicsContext3D::VERTEX_SHADER)
+                    vShader = true;
+                else if (shaders[ii]->getType() == GraphicsContext3D::FRAGMENT_SHADER)
+                    fShader = true;
+            }
+            if (!vShader || !fShader)
+                succeed = false;
+        }
+        if (!succeed) {
+            program->setLinkFailureFlag(true);
+            return;
+        }
+        program->setLinkFailureFlag(false);
+    }
+
     m_context->linkProgram(program);
     program->cacheActiveAttribLocations();
     cleanupAfterGraphicsCall(false);
@@ -1716,22 +1868,26 @@ void WebGLRenderingContext::linkProgram(WebGLProgram* program, ExceptionCode& ec
 
 void WebGLRenderingContext::pixelStorei(unsigned long pname, long param)
 {
-    if (pname == GraphicsContext3D::UNPACK_FLIP_Y_WEBGL) {
+    switch (pname) {
+    case GraphicsContext3D::UNPACK_FLIP_Y_WEBGL:
         m_unpackFlipY = param;
-    } else if (pname == GraphicsContext3D::UNPACK_PREMULTIPLY_ALPHA_WEBGL) {
+        break;
+    case GraphicsContext3D::UNPACK_PREMULTIPLY_ALPHA_WEBGL:
         m_unpackPremultiplyAlpha = param;
-    } else {
+        break;
+    case GraphicsContext3D::PACK_ALIGNMENT:
+    case GraphicsContext3D::UNPACK_ALIGNMENT:
         m_context->pixelStorei(pname, param);
         if (param == 1 || param == 2 || param == 4 || param == 8) {
-            switch (pname) {
-            case GraphicsContext3D::PACK_ALIGNMENT:
+            if (pname == GraphicsContext3D::PACK_ALIGNMENT)
                 m_packAlignment = static_cast<int>(param);
-                break;
-            case GraphicsContext3D::UNPACK_ALIGNMENT:
+            else // GraphicsContext3D::UNPACK_ALIGNMENT:
                 m_unpackAlignment = static_cast<int>(param);
-                break;
-            }
         }
+        break;
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return;
     }
     cleanupAfterGraphicsCall(false);
 }
@@ -1940,9 +2096,27 @@ void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, unsigned
                                        unsigned width, unsigned height, unsigned border,
                                        unsigned format, unsigned type, ArrayBufferView* pixels, ExceptionCode& ec)
 {
-    // FIXME: Need to make sure passed buffer has enough bytes to define the texture
+    if (!validateTexFuncData(width, height, format, type, pixels))
+        return;
+    void* data = pixels ? pixels->baseAddress() : 0;
+    Vector<uint8_t> tempData;
+    bool changeUnpackAlignment = false;
+    if (pixels && (m_unpackFlipY || m_unpackPremultiplyAlpha)) {
+        if (!m_context->extractTextureData(width, height, format, type,
+                                           m_unpackAlignment,
+                                           m_unpackFlipY, m_unpackPremultiplyAlpha,
+                                           pixels,
+                                           tempData))
+            return;
+        data = tempData.data();
+        changeUnpackAlignment = true;
+    }
+    if (changeUnpackAlignment)
+        m_context->pixelStorei(GraphicsContext3D::UNPACK_ALIGNMENT, 1);
     texImage2DBase(target, level, internalformat, width, height, border,
-                   format, type, pixels ? pixels->baseAddress() : 0, ec);
+                   format, type, data, ec);
+    if (changeUnpackAlignment)
+        m_context->pixelStorei(GraphicsContext3D::UNPACK_ALIGNMENT, m_unpackAlignment);
 }
 
 void WebGLRenderingContext::texImage2D(unsigned target, unsigned level, unsigned internalformat,
@@ -2196,8 +2370,26 @@ void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsig
                                           unsigned width, unsigned height,
                                           unsigned format, unsigned type, ArrayBufferView* pixels, ExceptionCode& ec)
 {
-    // FIXME: Need to make sure passed buffer has enough bytes to define the texture
-    texSubImage2DBase(target, level, xoffset, yoffset, width, height, format, type, pixels ? pixels->baseAddress() : 0, ec);
+    if (!validateTexFuncData(width, height, format, type, pixels))
+        return;
+    void* data = pixels ? pixels->baseAddress() : 0;
+    Vector<uint8_t> tempData;
+    bool changeUnpackAlignment = false;
+    if (pixels && (m_unpackFlipY || m_unpackPremultiplyAlpha)) {
+        if (!m_context->extractTextureData(width, height, format, type,
+                                           m_unpackAlignment,
+                                           m_unpackFlipY, m_unpackPremultiplyAlpha,
+                                           pixels,
+                                           tempData))
+            return;
+        data = tempData.data();
+        changeUnpackAlignment = true;
+    }
+    if (changeUnpackAlignment)
+        m_context->pixelStorei(GraphicsContext3D::UNPACK_ALIGNMENT, 1);
+    texSubImage2DBase(target, level, xoffset, yoffset, width, height, format, type, data, ec);
+    if (changeUnpackAlignment)
+        m_context->pixelStorei(GraphicsContext3D::UNPACK_ALIGNMENT, m_unpackAlignment);
 }
 
 void WebGLRenderingContext::texSubImage2D(unsigned target, unsigned level, unsigned xoffset, unsigned yoffset,
@@ -2381,18 +2573,9 @@ void WebGLRenderingContext::uniform1f(const WebGLUniformLocation* location, floa
 void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, 1))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
     m_context->uniform1fv(location->location(), v->data(), v->length());
     cleanupAfterGraphicsCall(false);
 }
@@ -2400,18 +2583,9 @@ void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, Flo
 void WebGLRenderingContext::uniform1fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 1))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
     m_context->uniform1fv(location->location(), v, size);
     cleanupAfterGraphicsCall(false);
 }
@@ -2434,18 +2608,9 @@ void WebGLRenderingContext::uniform1i(const WebGLUniformLocation* location, int
 void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, Int32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, 1))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
     m_context->uniform1iv(location->location(), v->data(), v->length());
     cleanupAfterGraphicsCall(false);
 }
@@ -2453,18 +2618,9 @@ void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, Int
 void WebGLRenderingContext::uniform1iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 1))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
     m_context->uniform1iv(location->location(), v, size);
     cleanupAfterGraphicsCall(false);
 }
@@ -2487,19 +2643,9 @@ void WebGLRenderingContext::uniform2f(const WebGLUniformLocation* location, floa
 void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, 2))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 2
     m_context->uniform2fv(location->location(), v->data(), v->length() / 2);
     cleanupAfterGraphicsCall(false);
 }
@@ -2507,19 +2653,9 @@ void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, Flo
 void WebGLRenderingContext::uniform2fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 2))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 2
     m_context->uniform2fv(location->location(), v, size / 2);
     cleanupAfterGraphicsCall(false);
 }
@@ -2542,19 +2678,9 @@ void WebGLRenderingContext::uniform2i(const WebGLUniformLocation* location, int
 void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, Int32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, 2))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 2
     m_context->uniform2iv(location->location(), v->data(), v->length() / 2);
     cleanupAfterGraphicsCall(false);
 }
@@ -2562,19 +2688,9 @@ void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, Int
 void WebGLRenderingContext::uniform2iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 2))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 2
     m_context->uniform2iv(location->location(), v, size / 2);
     cleanupAfterGraphicsCall(false);
 }
@@ -2597,19 +2713,9 @@ void WebGLRenderingContext::uniform3f(const WebGLUniformLocation* location, floa
 void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, 3))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 3
     m_context->uniform3fv(location->location(), v->data(), v->length() / 3);
     cleanupAfterGraphicsCall(false);
 }
@@ -2617,19 +2723,9 @@ void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, Flo
 void WebGLRenderingContext::uniform3fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 3))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 3
     m_context->uniform3fv(location->location(), v, size / 3);
     cleanupAfterGraphicsCall(false);
 }
@@ -2652,19 +2748,9 @@ void WebGLRenderingContext::uniform3i(const WebGLUniformLocation* location, int
 void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, Int32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, 3))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 3
     m_context->uniform3iv(location->location(), v->data(), v->length() / 3);
     cleanupAfterGraphicsCall(false);
 }
@@ -2672,19 +2758,9 @@ void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, Int
 void WebGLRenderingContext::uniform3iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 3))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 3
     m_context->uniform3iv(location->location(), v, size / 3);
     cleanupAfterGraphicsCall(false);
 }
@@ -2707,19 +2783,9 @@ void WebGLRenderingContext::uniform4f(const WebGLUniformLocation* location, floa
 void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformParameters(location, v, 4))
         return;
-    }
 
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 4
     m_context->uniform4fv(location->location(), v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2727,19 +2793,9 @@ void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, Flo
 void WebGLRenderingContext::uniform4fv(const WebGLUniformLocation* location, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 4))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 4
     m_context->uniform4fv(location->location(), v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2762,19 +2818,9 @@ void WebGLRenderingContext::uniform4i(const WebGLUniformLocation* location, int
 void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, Int32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, 4))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 4
     m_context->uniform4iv(location->location(), v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2782,19 +2828,9 @@ void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, Int
 void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, int* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformParameters(location, v, size, 4))
         return;
 
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 4
     m_context->uniform4iv(location->location(), v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2802,19 +2838,8 @@ void WebGLRenderingContext::uniform4iv(const WebGLUniformLocation* location, int
 void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+    if (!validateUniformMatrixParameters(location, transpose, v, 4))
         return;
-    }
-    // FIXME: length needs to be a multiple of 4
     m_context->uniformMatrix2fv(location->location(), transpose, v->data(), v->length() / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2822,19 +2847,8 @@ void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformMatrixParameters(location, transpose, v, size, 4))
         return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 4
     m_context->uniformMatrix2fv(location->location(), transpose, v, size / 4);
     cleanupAfterGraphicsCall(false);
 }
@@ -2842,19 +2856,8 @@ void WebGLRenderingContext::uniformMatrix2fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformMatrixParameters(location, transpose, v, 9))
         return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 9
     m_context->uniformMatrix3fv(location->location(), transpose, v->data(), v->length() / 9);
     cleanupAfterGraphicsCall(false);
 }
@@ -2862,19 +2865,8 @@ void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateUniformMatrixParameters(location, transpose, v, size, 9))
         return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 9
     m_context->uniformMatrix3fv(location->location(), transpose, v, size / 9);
     cleanupAfterGraphicsCall(false);
 }
@@ -2882,19 +2874,8 @@ void WebGLRenderingContext::uniformMatrix3fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, Float32Array* v, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
-        return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+    if (!validateUniformMatrixParameters(location, transpose, v, 16))
         return;
-    }
-    // FIXME: length needs to be a multiple of 16
     m_context->uniformMatrix4fv(location->location(), transpose, v->data(), v->length() / 16);
     cleanupAfterGraphicsCall(false);
 }
@@ -2902,19 +2883,8 @@ void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* location, bool transpose, float* v, int size, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!location)
+    if (!validateUniformMatrixParameters(location, transpose, v, size, 16))
         return;
-
-    if (location->program() != m_currentProgram) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
-        return;
-    }
-
-    if (!v) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
-        return;
-    }
-    // FIXME: length needs to be a multiple of 16
     m_context->uniformMatrix4fv(location->location(), transpose, v, size / 16);
     cleanupAfterGraphicsCall(false);
 }
@@ -2922,11 +2892,10 @@ void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* locatio
 void WebGLRenderingContext::useProgram(WebGLProgram* program, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!program || program->context() != this) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+    if (program && program->context() != this) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
         return;
     }
-        
     m_currentProgram = program;
     m_context->useProgram(program);
     cleanupAfterGraphicsCall(false);
@@ -2935,139 +2904,111 @@ void WebGLRenderingContext::useProgram(WebGLProgram* program, ExceptionCode& ec)
 void WebGLRenderingContext::validateProgram(WebGLProgram* program, ExceptionCode& ec)
 {
     UNUSED_PARAM(ec);
-    if (!program || program->context() != this) {
-        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+    if (!validateWebGLObject(program))
         return;
-    }
-        
     m_context->validateProgram(program);
     cleanupAfterGraphicsCall(false);
 }
 
-void WebGLRenderingContext::vertexAttrib1f(unsigned long indx, float v0)
+void WebGLRenderingContext::vertexAttrib1f(unsigned long index, float v0)
 {
-    m_context->vertexAttrib1f(indx, v0);
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfImpl(index, 1, v0, 0.0f, 0.0f, 1.0f);
 }
 
-void WebGLRenderingContext::vertexAttrib1fv(unsigned long indx, Float32Array* v)
+void WebGLRenderingContext::vertexAttrib1fv(unsigned long index, Float32Array* v)
 {
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib1fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfvImpl(index, v, 1);
 }
 
-void WebGLRenderingContext::vertexAttrib1fv(unsigned long indx, float* v, int size)
+void WebGLRenderingContext::vertexAttrib1fv(unsigned long index, float* v, int size)
 {
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib1fv(indx, v);
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfvImpl(index, v, size, 1);
 }
 
-void WebGLRenderingContext::vertexAttrib2f(unsigned long indx, float v0, float v1)
+void WebGLRenderingContext::vertexAttrib2f(unsigned long index, float v0, float v1)
 {
-    m_context->vertexAttrib2f(indx, v0, v1);
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfImpl(index, 2, v0, v1, 0.0f, 1.0f);
 }
 
-void WebGLRenderingContext::vertexAttrib2fv(unsigned long indx, Float32Array* v)
+void WebGLRenderingContext::vertexAttrib2fv(unsigned long index, Float32Array* v)
 {
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib2fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfvImpl(index, v, 2);
 }
 
-void WebGLRenderingContext::vertexAttrib2fv(unsigned long indx, float* v, int size)
+void WebGLRenderingContext::vertexAttrib2fv(unsigned long index, float* v, int size)
 {
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib2fv(indx, v);
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfvImpl(index, v, size, 2);
 }
 
-void WebGLRenderingContext::vertexAttrib3f(unsigned long indx, float v0, float v1, float v2)
+void WebGLRenderingContext::vertexAttrib3f(unsigned long index, float v0, float v1, float v2)
 {
-    m_context->vertexAttrib3f(indx, v0, v1, v2);
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfImpl(index, 3, v0, v1, v2, 1.0f);
 }
 
-void WebGLRenderingContext::vertexAttrib3fv(unsigned long indx, Float32Array* v)
+void WebGLRenderingContext::vertexAttrib3fv(unsigned long index, Float32Array* v)
 {
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib3fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfvImpl(index, v, 3);
 }
 
-void WebGLRenderingContext::vertexAttrib3fv(unsigned long indx, float* v, int size)
+void WebGLRenderingContext::vertexAttrib3fv(unsigned long index, float* v, int size)
 {
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib3fv(indx, v);
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfvImpl(index, v, size, 3);
 }
 
-void WebGLRenderingContext::vertexAttrib4f(unsigned long indx, float v0, float v1, float v2, float v3)
+void WebGLRenderingContext::vertexAttrib4f(unsigned long index, float v0, float v1, float v2, float v3)
 {
-    m_context->vertexAttrib4f(indx, v0, v1, v2, v3);
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfImpl(index, 4, v0, v1, v2, v3);
 }
 
-void WebGLRenderingContext::vertexAttrib4fv(unsigned long indx, Float32Array* v)
+void WebGLRenderingContext::vertexAttrib4fv(unsigned long index, Float32Array* v)
 {
-    // FIXME: Need to make sure array is big enough for attribute being set
-    m_context->vertexAttrib4fv(indx, v->data());
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfvImpl(index, v, 4);
 }
 
-void WebGLRenderingContext::vertexAttrib4fv(unsigned long indx, float* v, int size)
+void WebGLRenderingContext::vertexAttrib4fv(unsigned long index, float* v, int size)
 {
-    // FIXME: Need to make sure array is big enough for attribute being set
-    UNUSED_PARAM(size);
-    
-    m_context->vertexAttrib4fv(indx, v);
-    cleanupAfterGraphicsCall(false);
+    vertexAttribfvImpl(index, v, size, 4);
 }
 
-void WebGLRenderingContext::vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized, unsigned long stride, unsigned long offset, ExceptionCode& ec)
+void WebGLRenderingContext::vertexAttribPointer(unsigned long index, long size, unsigned long type, bool normalized, long stride, long offset, ExceptionCode& ec)
 {
-    UNUSED_PARAM(ec);
-    if (!m_boundArrayBuffer || indx >= m_maxVertexAttribs) {
+    if (index >= m_maxVertexAttribs) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
         return;
     }
-    
-    if (indx >= m_vertexAttribState.size())
-        m_vertexAttribState.resize(indx + 1);
-
+    if (size < 1 || size > 4 || stride < 0 || offset < 0) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    if (!m_boundArrayBuffer) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return;
+    }
     // Determine the number of elements the bound buffer can hold, given the offset, size, type and stride
     long bytesPerElement = size * sizeInBytes(type, ec);
     if (bytesPerElement <= 0)
         return;
+
+    if (index >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(index + 1);
+
     long validatedStride = bytesPerElement;
     if (stride != 0) {
         if ((long) stride < bytesPerElement) {
             m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
             return;
         }
-        
         validatedStride = stride;
     }
-
-    m_vertexAttribState[indx].bufferBinding = m_boundArrayBuffer;
-    // Avoid off-by-one errors in numElements computation.
-    // For the last element, we will only touch the data for the
-    // element and nothing beyond it.
-    long bytesRemaining = m_boundArrayBuffer->byteLength(GraphicsContext3D::ARRAY_BUFFER) - offset;
-    if (bytesRemaining < bytesPerElement)
-        m_vertexAttribState[indx].numElements = 0;
-    else
-        m_vertexAttribState[indx].numElements = 1 + (bytesRemaining - bytesPerElement) / validatedStride;
-
-    m_context->vertexAttribPointer(indx, size, type, normalized, stride, offset);
+    m_vertexAttribState[index].bufferBinding = m_boundArrayBuffer;
+    m_vertexAttribState[index].bytesPerElement = bytesPerElement;
+    m_vertexAttribState[index].size = size;
+    m_vertexAttribState[index].type = type;
+    m_vertexAttribState[index].normalized = normalized;
+    m_vertexAttribState[index].stride = validatedStride;
+    m_vertexAttribState[index].originalStride = stride;
+    m_vertexAttribState[index].offset = offset;
+    m_context->vertexAttribPointer(index, size, type, normalized, stride, offset);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -3141,6 +3082,18 @@ WebGLBuffer* WebGLRenderingContext::findBuffer(Platform3DObject obj)
     return 0;
 }
 
+WebGLShader* WebGLRenderingContext::findShader(Platform3DObject obj)
+{
+    if (!obj)
+        return 0;
+    HashSet<RefPtr<CanvasObject> >::iterator pend = m_canvasObjects.end();
+    for (HashSet<RefPtr<CanvasObject> >::iterator it = m_canvasObjects.begin(); it != pend; ++it) {
+        if ((*it)->isShader() && (*it)->object() == obj)
+            return reinterpret_cast<WebGLShader*>((*it).get());
+    }
+    return 0;
+}
+
 WebGLGetInfo WebGLRenderingContext::getBooleanParameter(unsigned long pname)
 {
     unsigned char value;
@@ -3148,6 +3101,20 @@ WebGLGetInfo WebGLRenderingContext::getBooleanParameter(unsigned long pname)
     return WebGLGetInfo(static_cast<bool>(value));
 }
 
+WebGLGetInfo WebGLRenderingContext::getBooleanArrayParameter(unsigned long pname)
+{
+    if (pname != GraphicsContext3D::COLOR_WRITEMASK) {
+        notImplemented();
+        return WebGLGetInfo(0, 0);
+    }
+    unsigned char value[4] = {0};
+    m_context->getBooleanv(pname, value);
+    bool boolValue[4];
+    for (int ii = 0; ii < 4; ++ii)
+        boolValue[ii] = static_cast<bool>(value[ii]);
+    return WebGLGetInfo(boolValue, 4);
+}
+
 WebGLGetInfo WebGLRenderingContext::getFloatParameter(unsigned long pname)
 {
     float value;
@@ -3214,21 +3181,6 @@ WebGLGetInfo WebGLRenderingContext::getWebGLIntArrayParameter(unsigned long pnam
     return WebGLGetInfo(Int32Array::create(value, length));
 }
 
-WebGLGetInfo WebGLRenderingContext::getWebGLUnsignedByteArrayParameter(unsigned long pname)
-{
-    unsigned char value[4] = {0};
-    m_context->getBooleanv(pname, value);
-    unsigned length = 0;
-    switch (pname) {
-    case GraphicsContext3D::COLOR_WRITEMASK:
-        length = 4;
-        break;
-    default:
-        notImplemented();
-    }
-    return WebGLGetInfo(Uint8Array::create(value, length));
-}
-
 bool WebGLRenderingContext::isGLES2Compliant()
 {
     return m_context->isGLES2Compliant();
@@ -3236,8 +3188,6 @@ bool WebGLRenderingContext::isGLES2Compliant()
 
 void WebGLRenderingContext::handleNPOTTextures(bool prepareToDraw)
 {
-    if (isGLES2Compliant())
-        return;
     bool resetActiveUnit = false;
     for (unsigned ii = 0; ii < m_textureUnits.size(); ++ii) {
         if (m_textureUnits[ii].m_texture2DBinding && m_textureUnits[ii].m_texture2DBinding->needToUseBlackTexture()
@@ -3445,6 +3395,56 @@ bool WebGLRenderingContext::validateTexFuncParameters(unsigned long target, long
     return true;
 }
 
+bool WebGLRenderingContext::validateTexFuncData(long width, long height,
+                                                unsigned long format, unsigned long type,
+                                                ArrayBufferView* pixels)
+{
+    if (!pixels)
+        return true;
+
+    if (!validateTexFuncFormatAndType(format, type))
+        return false;
+
+    switch (type) {
+    case GraphicsContext3D::UNSIGNED_BYTE:
+        if (!pixels->isUnsignedByteArray()) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+            return false;
+        }
+        break;
+    case GraphicsContext3D::UNSIGNED_SHORT_5_6_5:
+    case GraphicsContext3D::UNSIGNED_SHORT_4_4_4_4:
+    case GraphicsContext3D::UNSIGNED_SHORT_5_5_5_1:
+        if (!pixels->isUnsignedShortArray()) {
+            m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+            return false;
+        }
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    unsigned long componentsPerPixel, bytesPerComponent;
+    if (!m_context->computeFormatAndTypeParameters(format, type, &componentsPerPixel, &bytesPerComponent)) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return false;
+    }
+
+    if (!width || !height)
+        return true;
+    unsigned int validRowBytes = width * componentsPerPixel * bytesPerComponent;
+    unsigned int totalRowBytes = validRowBytes;
+    unsigned int remainder = validRowBytes % m_unpackAlignment;
+    if (remainder)
+        totalRowBytes += (m_unpackAlignment - remainder);
+    unsigned int totalBytesRequired = (height - 1) * totalRowBytes + validRowBytes;
+    if (pixels->byteLength() < totalBytesRequired) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return false;
+    }
+    return true;
+}
+
 bool WebGLRenderingContext::validateDrawMode(unsigned long mode)
 {
     switch (mode) {
@@ -3487,6 +3487,231 @@ bool WebGLRenderingContext::validateFramebufferFuncParameters(unsigned long targ
     return true;
 }
 
+bool WebGLRenderingContext::validateBlendEquation(unsigned long mode)
+{
+    switch (mode) {
+    case GraphicsContext3D::FUNC_ADD:
+    case GraphicsContext3D::FUNC_SUBTRACT:
+    case GraphicsContext3D::FUNC_REVERSE_SUBTRACT:
+        return true;
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return false;
+    }
+}
+
+bool WebGLRenderingContext::validateCapability(unsigned long cap)
+{
+    switch (cap) {
+    case GraphicsContext3D::BLEND:
+    case GraphicsContext3D::CULL_FACE:
+    case GraphicsContext3D::DEPTH_TEST:
+    case GraphicsContext3D::DITHER:
+    case GraphicsContext3D::POLYGON_OFFSET_FILL:
+    case GraphicsContext3D::SAMPLE_ALPHA_TO_COVERAGE:
+    case GraphicsContext3D::SAMPLE_COVERAGE:
+    case GraphicsContext3D::SCISSOR_TEST:
+    case GraphicsContext3D::STENCIL_TEST:
+        return true;
+    default:
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return false;
+    }
+}
+
+bool WebGLRenderingContext::validateUniformParameters(const WebGLUniformLocation* location, Float32Array* v, int requiredMinSize)
+{
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    return validateUniformMatrixParameters(location, false, v->data(), v->length(), requiredMinSize);
+}
+
+bool WebGLRenderingContext::validateUniformParameters(const WebGLUniformLocation* location, Int32Array* v, int requiredMinSize)
+{
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    return validateUniformMatrixParameters(location, false, v->data(), v->length(), requiredMinSize);
+}
+
+bool WebGLRenderingContext::validateUniformParameters(const WebGLUniformLocation* location, void* v, int size, int requiredMinSize)
+{
+    return validateUniformMatrixParameters(location, false, v, size, requiredMinSize);
+}
+
+bool WebGLRenderingContext::validateUniformMatrixParameters(const WebGLUniformLocation* location, bool transpose, Float32Array* v, int requiredMinSize)
+{
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    return validateUniformMatrixParameters(location, transpose, v->data(), v->length(), requiredMinSize);
+}
+
+bool WebGLRenderingContext::validateUniformMatrixParameters(const WebGLUniformLocation* location, bool transpose, void* v, int size, int requiredMinSize)
+{
+    if (!location)
+        return false;
+    if (location->program() != m_currentProgram) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
+        return false;
+    }
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    if (transpose) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    if (size < requiredMinSize) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return false;
+    }
+    return true;
+}
+
+void WebGLRenderingContext::vertexAttribfImpl(unsigned long index, int expectedSize, float v0, float v1, float v2, float v3)
+{
+    if (index >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // In GL, we skip setting vertexAttrib0 values.
+    if (index || isGLES2Compliant()) {
+        switch (expectedSize) {
+        case 1:
+            m_context->vertexAttrib1f(index, v0);
+            break;
+        case 2:
+            m_context->vertexAttrib2f(index, v0, v1);
+            break;
+        case 3:
+            m_context->vertexAttrib3f(index, v0, v1, v2);
+            break;
+        case 4:
+            m_context->vertexAttrib4f(index, v0, v1, v2, v3);
+            break;
+        }
+        cleanupAfterGraphicsCall(false);
+    }
+    if (index >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(index + 1);
+    m_vertexAttribState[index].value[0] = v0;
+    m_vertexAttribState[index].value[1] = v1;
+    m_vertexAttribState[index].value[2] = v2;
+    m_vertexAttribState[index].value[3] = v3;
+}
+
+void WebGLRenderingContext::vertexAttribfvImpl(unsigned long index, Float32Array* v, int expectedSize)
+{
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    vertexAttribfvImpl(index, v->data(), v->length(), expectedSize);
+}
+
+void WebGLRenderingContext::vertexAttribfvImpl(unsigned long index, float* v, int size, int expectedSize)
+{
+    if (!v) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    if (size < expectedSize) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    if (index >= m_maxVertexAttribs) {
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_VALUE);
+        return;
+    }
+    // In GL, we skip setting vertexAttrib0 values.
+    if (index || isGLES2Compliant()) {
+        switch (expectedSize) {
+        case 1:
+            m_context->vertexAttrib1fv(index, v);
+            break;
+        case 2:
+            m_context->vertexAttrib2fv(index, v);
+            break;
+        case 3:
+            m_context->vertexAttrib3fv(index, v);
+            break;
+        case 4:
+            m_context->vertexAttrib4fv(index, v);
+            break;
+        }
+        cleanupAfterGraphicsCall(false);
+    }
+    if (index >= m_vertexAttribState.size())
+        m_vertexAttribState.resize(index + 1);
+    m_vertexAttribState[index].initValue();
+    for (int ii = 0; ii < expectedSize; ++ii)
+        m_vertexAttribState[index].value[ii] = v[ii];
+}
+
+void WebGLRenderingContext::initVertexAttrib0()
+{
+    m_vertexAttribState.resize(1);
+    m_vertexAttrib0Buffer = createBuffer();
+    m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_vertexAttrib0Buffer.get());
+    m_context->bufferData(GraphicsContext3D::ARRAY_BUFFER, 0, GraphicsContext3D::DYNAMIC_DRAW);
+    m_context->vertexAttribPointer(0, 4, GraphicsContext3D::FLOAT, false, 0, 0);
+    m_vertexAttribState[0].bufferBinding = m_vertexAttrib0Buffer;
+    m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, 0);
+    m_context->enableVertexAttribArray(0);
+    m_vertexAttrib0BufferSize = 0;
+    m_vertexAttrib0BufferValue[0] = 0.0f;
+    m_vertexAttrib0BufferValue[1] = 0.0f;
+    m_vertexAttrib0BufferValue[2] = 0.0f;
+    m_vertexAttrib0BufferValue[3] = 1.0f;
+}
+
+bool WebGLRenderingContext::simulateVertexAttrib0(long numVertex)
+{
+    const VertexAttribState& state = m_vertexAttribState[0];
+    if (state.enabled || !m_currentProgram || !m_currentProgram->object()
+        || !m_currentProgram->isUsingVertexAttrib0())
+        return false;
+    m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_vertexAttrib0Buffer.get());
+    long bufferDataSize = (numVertex + 1) * 4 * sizeof(float);
+    if (bufferDataSize > m_vertexAttrib0BufferSize
+        || state.value[0] != m_vertexAttrib0BufferValue[0]
+        || state.value[1] != m_vertexAttrib0BufferValue[1]
+        || state.value[2] != m_vertexAttrib0BufferValue[2]
+        || state.value[3] != m_vertexAttrib0BufferValue[3]) {
+        RefPtr<Float32Array> bufferData = Float32Array::create((numVertex + 1) * 4);
+        for (long ii = 0; ii < numVertex + 1; ++ii) {
+            bufferData->set(ii * 4, state.value[0]);
+            bufferData->set(ii * 4 + 1, state.value[1]);
+            bufferData->set(ii * 4 + 2, state.value[2]);
+            bufferData->set(ii * 4 + 3, state.value[3]);
+        }
+        m_context->bufferData(GraphicsContext3D::ARRAY_BUFFER, bufferData.get(), GraphicsContext3D::DYNAMIC_DRAW);
+        m_vertexAttrib0BufferSize = bufferDataSize;
+        m_vertexAttrib0BufferValue[0] = state.value[0];
+        m_vertexAttrib0BufferValue[1] = state.value[1];
+        m_vertexAttrib0BufferValue[2] = state.value[2];
+        m_vertexAttrib0BufferValue[3] = state.value[3];
+    }
+    m_context->vertexAttribPointer(0, 4, GraphicsContext3D::FLOAT, false, 0, 0);
+    return true;
+}
+
+void WebGLRenderingContext::restoreStatesAfterVertexAttrib0Simulation()
+{
+    const VertexAttribState& state = m_vertexAttribState[0];
+    if (state.bufferBinding != m_vertexAttrib0Buffer) {
+        m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, state.bufferBinding.get());
+        m_context->vertexAttribPointer(0, state.size, state.type, state.normalized, state.originalStride, state.offset);
+    }
+    m_context->bindBuffer(GraphicsContext3D::ARRAY_BUFFER, m_boundArrayBuffer.get());
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/html/canvas/WebGLRenderingContext.h b/WebCore/html/canvas/WebGLRenderingContext.h
index d05d60b..be74001 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/WebCore/html/canvas/WebGLRenderingContext.h
@@ -131,6 +131,8 @@ class WebKitCSSMatrix;
         PassRefPtr<WebGLActiveInfo> getActiveAttrib(WebGLProgram*, unsigned long index, ExceptionCode&);
         PassRefPtr<WebGLActiveInfo> getActiveUniform(WebGLProgram*, unsigned long index, ExceptionCode&);
 
+        bool getAttachedShaders(WebGLProgram*, Vector<WebGLShader*>&, ExceptionCode&);
+
         int  getAttribLocation(WebGLProgram*, const String& name);
 
         WebGLGetInfo getBufferParameter(unsigned long target, unsigned long pname, ExceptionCode&);
@@ -281,20 +283,20 @@ class WebKitCSSMatrix;
         void useProgram(WebGLProgram*, ExceptionCode&);
         void validateProgram(WebGLProgram*, ExceptionCode&);
 
-        void vertexAttrib1f(unsigned long indx, float x);
-        void vertexAttrib1fv(unsigned long indx, Float32Array* values);
-        void vertexAttrib1fv(unsigned long indx, float* values, int size);
-        void vertexAttrib2f(unsigned long indx, float x, float y);
-        void vertexAttrib2fv(unsigned long indx, Float32Array* values);
-        void vertexAttrib2fv(unsigned long indx, float* values, int size);
-        void vertexAttrib3f(unsigned long indx, float x, float y, float z);
-        void vertexAttrib3fv(unsigned long indx, Float32Array* values);
-        void vertexAttrib3fv(unsigned long indx, float* values, int size);
-        void vertexAttrib4f(unsigned long indx, float x, float y, float z, float w);
-        void vertexAttrib4fv(unsigned long indx, Float32Array* values);
-        void vertexAttrib4fv(unsigned long indx, float* values, int size);
-        void vertexAttribPointer(unsigned long indx, long size, unsigned long type, bool normalized,
-                                 unsigned long stride, unsigned long offset, ExceptionCode&);
+        void vertexAttrib1f(unsigned long index, float x);
+        void vertexAttrib1fv(unsigned long index, Float32Array* values);
+        void vertexAttrib1fv(unsigned long index, float* values, int size);
+        void vertexAttrib2f(unsigned long index, float x, float y);
+        void vertexAttrib2fv(unsigned long index, Float32Array* values);
+        void vertexAttrib2fv(unsigned long index, float* values, int size);
+        void vertexAttrib3f(unsigned long index, float x, float y, float z);
+        void vertexAttrib3fv(unsigned long index, Float32Array* values);
+        void vertexAttrib3fv(unsigned long index, float* values, int size);
+        void vertexAttrib4f(unsigned long index, float x, float y, float z, float w);
+        void vertexAttrib4fv(unsigned long index, Float32Array* values);
+        void vertexAttrib4fv(unsigned long index, float* values, int size);
+        void vertexAttribPointer(unsigned long index, long size, unsigned long type, bool normalized,
+                                 long stride, long offset, ExceptionCode&);
 
         void viewport(long x, long y, unsigned long width, unsigned long height);
 
@@ -318,6 +320,7 @@ class WebKitCSSMatrix;
         WebGLTexture* findTexture(Platform3DObject);
         WebGLRenderbuffer* findRenderbuffer(Platform3DObject);
         WebGLBuffer* findBuffer(Platform3DObject);
+        WebGLShader* findShader(Platform3DObject);
 
         void markContextChanged();
         void cleanupAfterGraphicsCall(bool changed)
@@ -354,14 +357,44 @@ class WebKitCSSMatrix;
         // Cached values for vertex attrib range checks
         class VertexAttribState {
         public:
-            VertexAttribState() : enabled(false), numElements(0) { }
+            VertexAttribState()
+                : enabled(false)
+                , bytesPerElement(0)
+                , size(4)
+                , type(GraphicsContext3D::FLOAT)
+                , normalized(false)
+                , stride(16)
+                , originalStride(0)
+                , offset(0)
+            {
+                initValue();
+            }
+
+            void initValue()
+            {
+                value[0] = 0.0f;
+                value[1] = 0.0f;
+                value[2] = 0.0f;
+                value[3] = 1.0f;
+            }
+
             bool enabled;
-            long numElements;
             RefPtr<WebGLBuffer> bufferBinding;
+            long bytesPerElement;
+            long size;
+            unsigned long type;
+            bool normalized;
+            long stride;
+            long originalStride;
+            long offset;
+            float value[4];
         };
         
         Vector<VertexAttribState> m_vertexAttribState;
         unsigned m_maxVertexAttribs;
+        RefPtr<WebGLBuffer> m_vertexAttrib0Buffer;
+        long m_vertexAttrib0BufferSize;
+        float m_vertexAttrib0BufferValue[4];
 
         RefPtr<WebGLProgram> m_currentProgram;
         RefPtr<WebGLFramebuffer> m_framebufferBinding;
@@ -389,13 +422,13 @@ class WebKitCSSMatrix;
 
         // Helpers for getParameter and others
         WebGLGetInfo getBooleanParameter(unsigned long pname);
+        WebGLGetInfo getBooleanArrayParameter(unsigned long pname);
         WebGLGetInfo getFloatParameter(unsigned long pname);
         WebGLGetInfo getIntParameter(unsigned long pname);
         WebGLGetInfo getLongParameter(unsigned long pname);
         WebGLGetInfo getUnsignedLongParameter(unsigned long pname);
         WebGLGetInfo getWebGLFloatArrayParameter(unsigned long pname);
         WebGLGetInfo getWebGLIntArrayParameter(unsigned long pname);
-        WebGLGetInfo getWebGLUnsignedByteArrayParameter(unsigned long pname);
 
         void texImage2DBase(unsigned target, unsigned level, unsigned internalformat,
                             unsigned width, unsigned height, unsigned border,
@@ -424,16 +457,23 @@ class WebKitCSSMatrix;
         WebGLTexture* getTextureBinding(unsigned long target);
 
         // Helper function to check input format/type for functions {copy}Tex{Sub}Image.
-        // Generate GL error and return false if parameters are invalid.
+        // Generates GL error and returns false if parameters are invalid.
         bool validateTexFuncFormatAndType(unsigned long format, unsigned long type);
 
         // Helper function to check input parameters for functions {copy}Tex{Sub}Image.
-        // Generate GL error and return false if parameters are invalid.
+        // Generates GL error and returns false if parameters are invalid.
         bool validateTexFuncParameters(unsigned long target, long level,
                                        unsigned long internalformat,
                                        long width, long height, long border,
                                        unsigned long format, unsigned long type);
 
+        // Helper function to validate that the given ArrayBufferView
+        // is of the correct type and contains enough data for the texImage call.
+        // Generates GL error and returns false if parameters are invalid.
+        bool validateTexFuncData(long width, long height,
+                                 unsigned long format, unsigned long type,
+                                 ArrayBufferView* pixels);
+
         // Helper function to validate mode for draw{Arrays/Elements}.
         bool validateDrawMode(unsigned long);
 
@@ -448,6 +488,29 @@ class WebKitCSSMatrix;
         // Generate GL error if parameters are illegal.
         bool validateFramebufferFuncParameters(unsigned long target, unsigned long attachment);
 
+        // Helper function to validate blend equation mode.
+        bool validateBlendEquation(unsigned long);
+
+        // Helper function to validate a GL capability.
+        bool validateCapability(unsigned long);
+
+        // Helper function to validate input parameters for uniform functions.
+        bool validateUniformParameters(const WebGLUniformLocation* location, Float32Array* v, int mod);
+        bool validateUniformParameters(const WebGLUniformLocation* location, Int32Array* v, int mod);
+        bool validateUniformParameters(const WebGLUniformLocation* location, void* v, int size, int mod);
+        bool validateUniformMatrixParameters(const WebGLUniformLocation* location, bool transpose, Float32Array* v, int mod);
+        bool validateUniformMatrixParameters(const WebGLUniformLocation* location, bool transpose, void* v, int size, int mod);
+
+        // Helper functions for vertexAttribNf{v}.
+        void vertexAttribfImpl(unsigned long index, int expectedSize, float v0, float v1, float v2, float v3);
+        void vertexAttribfvImpl(unsigned long index, Float32Array* v, int expectedSize);
+        void vertexAttribfvImpl(unsigned long index, float* v, int size, int expectedSize);
+
+        // Helpers for simulating vertexAttrib0
+        void initVertexAttrib0();
+        bool simulateVertexAttrib0(long numVertex);
+        void restoreStatesAfterVertexAttrib0Simulation();
+
         friend class WebGLStateRestorer;
     };
 
diff --git a/WebCore/html/canvas/WebGLRenderingContext.idl b/WebCore/html/canvas/WebGLRenderingContext.idl
index b3793f5..1ea4c6d 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.idl
+++ b/WebCore/html/canvas/WebGLRenderingContext.idl
@@ -536,7 +536,9 @@ module html {
         WebGLActiveInfo getActiveUniform(in WebGLProgram program, in unsigned long index)
             raises (DOMException);
 
-        // WebGLShaderArray glGetAttachedShaders(GLuint program);
+        // Array getAttachedShaders(GLuint program) raises (DOMException);
+        [Custom] void getAttachedShaders(GLuint program)
+            raises (DOMException);
 
         int          getAttribLocation(in WebGLProgram program, in DOMString name);
 
diff --git a/WebCore/html/canvas/WebGLShader.cpp b/WebCore/html/canvas/WebGLShader.cpp
index a353b15..664d3cb 100644
--- a/WebCore/html/canvas/WebGLShader.cpp
+++ b/WebCore/html/canvas/WebGLShader.cpp
@@ -39,6 +39,7 @@ PassRefPtr<WebGLShader> WebGLShader::create(WebGLRenderingContext* ctx, Graphics
 
 WebGLShader::WebGLShader(WebGLRenderingContext* ctx, GraphicsContext3D::WebGLEnumType type)
     : CanvasObject(ctx)
+    , m_type(type)
 {
     setObject(context()->graphicsContext3D()->createShader(type));
 }
diff --git a/WebCore/html/canvas/WebGLShader.h b/WebCore/html/canvas/WebGLShader.h
index d4006aa..a0daa59 100644
--- a/WebCore/html/canvas/WebGLShader.h
+++ b/WebCore/html/canvas/WebGLShader.h
@@ -39,12 +39,16 @@ namespace WebCore {
         
         static PassRefPtr<WebGLShader> create(WebGLRenderingContext*, GraphicsContext3D::WebGLEnumType);
 
+        GraphicsContext3D::WebGLEnumType getType() const { return m_type; }
+
     private:
         WebGLShader(WebGLRenderingContext*, GraphicsContext3D::WebGLEnumType);
 
         virtual void _deleteObject(Platform3DObject);
 
         virtual bool isShader() const { return true; }
+
+        GraphicsContext3D::WebGLEnumType m_type;
     };
     
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorBackend.cpp b/WebCore/inspector/InspectorBackend.cpp
index 8e9e330..e8866c2 100644
--- a/WebCore/inspector/InspectorBackend.cpp
+++ b/WebCore/inspector/InspectorBackend.cpp
@@ -178,10 +178,10 @@ void InspectorBackend::disableDebugger(bool always)
         m_inspectorController->disableDebugger(always);
 }
 
-void InspectorBackend::setBreakpoint(const String& sourceID, unsigned lineNumber, bool enabled, const String& condition)
+void InspectorBackend::setBreakpoint(long callId, const String& sourceID, unsigned lineNumber, bool enabled, const String& condition)
 {
     if (m_inspectorController)
-        m_inspectorController->setBreakpoint(sourceID, lineNumber, enabled, condition);
+        m_inspectorController->setBreakpoint(callId, sourceID, lineNumber, enabled, condition);
 }
 
 void InspectorBackend::removeBreakpoint(const String& sourceID, unsigned lineNumber)
diff --git a/WebCore/inspector/InspectorBackend.h b/WebCore/inspector/InspectorBackend.h
index ce5dd99..035abf6 100644
--- a/WebCore/inspector/InspectorBackend.h
+++ b/WebCore/inspector/InspectorBackend.h
@@ -80,7 +80,7 @@ public:
     void enableDebugger(bool always);
     void disableDebugger(bool always);
 
-    void setBreakpoint(const String& sourceID, unsigned lineNumber, bool enabled, const String& condition);
+    void setBreakpoint(long callId, const String& sourceID, unsigned lineNumber, bool enabled, const String& condition);
     void removeBreakpoint(const String& sourceID, unsigned lineNumber);
     void activateBreakpoints();
     void deactivateBreakpoints();
diff --git a/WebCore/inspector/InspectorBackend.idl b/WebCore/inspector/InspectorBackend.idl
index eaacaf0..b4a68cf 100644
--- a/WebCore/inspector/InspectorBackend.idl
+++ b/WebCore/inspector/InspectorBackend.idl
@@ -55,7 +55,7 @@ module core {
         void enableDebugger(in boolean always);
         void disableDebugger(in boolean always);
 
-        void setBreakpoint(in DOMString sourceID, in unsigned long lineNumber, in boolean enabled, in DOMString condition);
+        void setBreakpoint(in long callId, in DOMString sourceID, in unsigned long lineNumber, in boolean enabled, in DOMString condition);
         void removeBreakpoint(in DOMString sourceID, in unsigned long lineNumber);
         void activateBreakpoints();
         void deactivateBreakpoints();
diff --git a/WebCore/inspector/InspectorController.cpp b/WebCore/inspector/InspectorController.cpp
index 5020634..2256041 100644
--- a/WebCore/inspector/InspectorController.cpp
+++ b/WebCore/inspector/InspectorController.cpp
@@ -24,7 +24,7 @@
  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
  * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -163,6 +163,11 @@ String md5Base16(const String& string)
     return String(result.data(), result.size());
 }
 
+String formatBreakpointId(const String& sourceID, unsigned lineNumber)
+{
+    return String::format("%s:%d", sourceID.utf8().data(), lineNumber);
+}
+
 }
 
 InspectorController::InspectorController(Page* page, InspectorClient* client)
@@ -712,6 +717,7 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
         m_sourceIDToURL.clear();
         m_scriptIDToContent.clear();
         m_stickyBreakpoints.clear();
+        m_breakpointsMapping.clear();
         m_breakpointsLoaded = false;
 #endif
 #if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
@@ -1735,19 +1741,27 @@ PassRefPtr<SerializedScriptValue> InspectorController::currentCallFrames()
     return injectedScript.callFrames();
 }
 
-void InspectorController::setBreakpoint(const String& sourceID, unsigned lineNumber, bool enabled, const String& condition)
+void InspectorController::setBreakpoint(long callId, const String& sourceID, unsigned lineNumber, bool enabled, const String& condition)
 {
     ScriptBreakpoint breakpoint(enabled, condition);
-    ScriptDebugServer::shared().setBreakpoint(sourceID, lineNumber, breakpoint);
+    unsigned actualLineNumber = 0;
+    bool success = ScriptDebugServer::shared().setBreakpoint(sourceID, breakpoint, lineNumber, &actualLineNumber);
+    m_frontend->didSetBreakpoint(callId, success, actualLineNumber);
+    if (!success)
+        return;
+
     String url = m_sourceIDToURL.get(sourceID);
     if (url.isEmpty())
         return;
 
+    String breakpointId = formatBreakpointId(sourceID, actualLineNumber);
+    m_breakpointsMapping.set(breakpointId, actualLineNumber);
+
     String key = md5Base16(url);
     HashMap<String, SourceBreakpoints>::iterator it = m_stickyBreakpoints.find(key);
     if (it == m_stickyBreakpoints.end())
         it = m_stickyBreakpoints.set(key, SourceBreakpoints()).first;
-    it->second.set(lineNumber, breakpoint);
+    it->second.set(actualLineNumber, breakpoint);
     saveBreakpoints();
 }
 
@@ -1759,9 +1773,18 @@ void InspectorController::removeBreakpoint(const String& sourceID, unsigned line
     if (url.isEmpty())
         return;
 
+    String breakpointId = formatBreakpointId(sourceID, lineNumber);
+    HashMap<String, unsigned>::iterator mappingIt = m_breakpointsMapping.find(breakpointId);
+    if (mappingIt == m_breakpointsMapping.end())
+        return;
+    unsigned stickyLine = mappingIt->second;
+    m_breakpointsMapping.remove(mappingIt);
+
     HashMap<String, SourceBreakpoints>::iterator it = m_stickyBreakpoints.find(md5Base16(url));
-    if (it != m_stickyBreakpoints.end())
-        it->second.remove(lineNumber);
+    if (it == m_stickyBreakpoints.end())
+        return;
+
+    it->second.remove(stickyLine);
     saveBreakpoints();
 }
 
@@ -1781,10 +1804,16 @@ void InspectorController::didParseSource(const String& sourceID, const String& u
     HashMap<String, SourceBreakpoints>::iterator it = m_stickyBreakpoints.find(md5Base16(url));
     if (it != m_stickyBreakpoints.end()) {
         for (SourceBreakpoints::iterator breakpointIt = it->second.begin(); breakpointIt != it->second.end(); ++breakpointIt) {
-            if (firstLine <= breakpointIt->first) {
-                ScriptDebugServer::shared().setBreakpoint(sourceID, breakpointIt->first, breakpointIt->second);
-                m_frontend->restoredBreakpoint(sourceID, url, breakpointIt->first, breakpointIt->second.enabled, breakpointIt->second.condition);
-            }
+            int lineNumber = breakpointIt->first;
+            if (firstLine > lineNumber)
+                continue;
+            unsigned actualLineNumber = 0;
+            bool success = ScriptDebugServer::shared().setBreakpoint(sourceID, breakpointIt->second, lineNumber, &actualLineNumber);
+            if (!success)
+                continue;
+            m_frontend->restoredBreakpoint(sourceID, url, actualLineNumber, breakpointIt->second.enabled, breakpointIt->second.condition);
+            String breakpointId = formatBreakpointId(sourceID, actualLineNumber);
+            m_breakpointsMapping.set(breakpointId, lineNumber);
         }
     }
     m_sourceIDToURL.set(sourceID, url);
diff --git a/WebCore/inspector/InspectorController.h b/WebCore/inspector/InspectorController.h
index b2d1d5a..4c94d6d 100644
--- a/WebCore/inspector/InspectorController.h
+++ b/WebCore/inspector/InspectorController.h
@@ -289,7 +289,7 @@ private:
     void deleteCookie(const String& cookieName, const String& domain);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-    void setBreakpoint(const String& sourceID, unsigned lineNumber, bool enabled, const String& condition);
+    void setBreakpoint(long callId, const String& sourceID, unsigned lineNumber, bool enabled, const String& condition);
     void removeBreakpoint(const String& sourceID, unsigned lineNumber);
 
     typedef HashMap<unsigned int, RefPtr<ScriptProfile> > ProfilesMap;
@@ -384,6 +384,7 @@ private:
     HashMap<String, String> m_sourceIDToURL;
     HashMap<String, String> m_scriptIDToContent;
     HashMap<String, SourceBreakpoints> m_stickyBreakpoints;
+    HashMap<String, unsigned> m_breakpointsMapping;
     bool m_breakpointsLoaded;
 
     bool m_profilerEnabled;
diff --git a/WebCore/inspector/InspectorFrontend.cpp b/WebCore/inspector/InspectorFrontend.cpp
index cde5a70..fee4630 100644
--- a/WebCore/inspector/InspectorFrontend.cpp
+++ b/WebCore/inspector/InspectorFrontend.cpp
@@ -321,6 +321,16 @@ void InspectorFrontend::debuggerWasDisabled()
     callSimpleFunction("debuggerWasDisabled");
 }
 
+void InspectorFrontend::didSetBreakpoint(long callId, bool success, unsigned line)
+{
+    ScriptFunctionCall function(m_webInspector, "dispatch");
+    function.appendArgument("didSetBreakpoint");
+    function.appendArgument(callId);
+    function.appendArgument(success);
+    function.appendArgument(line);
+    function.call();
+}
+
 void InspectorFrontend::parsedScriptSource(const String& sourceID, const String& url, const String& data, int firstLine, int scriptWorldType)
 {
     ScriptFunctionCall function(m_webInspector, "dispatch"); 
diff --git a/WebCore/inspector/InspectorFrontend.h b/WebCore/inspector/InspectorFrontend.h
index 0b19983..e02b661 100644
--- a/WebCore/inspector/InspectorFrontend.h
+++ b/WebCore/inspector/InspectorFrontend.h
@@ -101,6 +101,8 @@ namespace WebCore {
         void debuggerWasEnabled();
         void debuggerWasDisabled();
 
+        void didSetBreakpoint(long callId, bool success, unsigned line);
+
         void parsedScriptSource(const String& sourceID, const String& url, const String& data, int firstLine, int scriptWorldType);
         void restoredBreakpoint(const String& sourceID, const String& url, int line, bool enabled, const String& condition);
         void failedToParseScriptSource(const String& url, const String& data, int firstLine, int errorLine, const String& errorMessage);
diff --git a/WebCore/inspector/front-end/BreakpointManager.js b/WebCore/inspector/front-end/BreakpointManager.js
index 4f6965a..709a9c2 100644
--- a/WebCore/inspector/front-end/BreakpointManager.js
+++ b/WebCore/inspector/front-end/BreakpointManager.js
@@ -36,39 +36,36 @@ WebInspector.BreakpointManager.prototype = {
         if (this._breakpoints[breakpoint.id])
             return;
         if (this._oneTimeBreakpoint)
-            this._removeBreakpointFromBackend(this._oneTimeBreakpoint);
+            InspectorBackend.removeBreakpoint(this._oneTimeBreakpoint.sourceID, this._oneTimeBreakpoint.line);
         this._oneTimeBreakpoint = breakpoint;
         // FIXME(40669): one time breakpoint will be persisted in inspector settings if not hit.
-        this._saveBreakpointOnBackend(breakpoint);
+        this._setBreakpointOnBackend(breakpoint, true);
     },
 
     removeOneTimeBreakpoint: function()
     {
         if (this._oneTimeBreakpoint) {
-            this._removeBreakpointFromBackend(this._oneTimeBreakpoint);
+            InspectorBackend.removeBreakpoint(this._oneTimeBreakpoint.sourceID, this._oneTimeBreakpoint.line);
             delete this._oneTimeBreakpoint;
         }
     },
 
-    addBreakpoint: function(sourceID, sourceURL, line, enabled, condition)
+    setBreakpoint: function(sourceID, sourceURL, line, enabled, condition)
     {
-        var breakpoint = this._addBreakpoint(sourceID, sourceURL, line, enabled, condition);
+        var breakpoint = this._setBreakpoint(sourceID, sourceURL, line, enabled, condition);
         if (breakpoint)
-            this._saveBreakpointOnBackend(breakpoint);
+            this._setBreakpointOnBackend(breakpoint);
     },
 
     restoredBreakpoint: function(sourceID, sourceURL, line, enabled, condition)
     {
-        this._addBreakpoint(sourceID, sourceURL, line, enabled, condition);
+        this._setBreakpoint(sourceID, sourceURL, line, enabled, condition);
     },
 
     removeBreakpoint: function(breakpoint)
     {
-        if (!(breakpoint.id in this._breakpoints))
-            return;
-        delete this._breakpoints[breakpoint.id];
-        this._removeBreakpointFromBackend(breakpoint);
-        this.dispatchEventToListeners("breakpoint-removed", breakpoint);
+        if (this._removeBreakpoint(breakpoint))
+            InspectorBackend.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
     },
 
     breakpointsForSourceID: function(sourceID)
@@ -97,7 +94,7 @@ WebInspector.BreakpointManager.prototype = {
         delete this._oneTimeBreakpoint;
     },
 
-    _addBreakpoint: function(sourceID, sourceURL, line, enabled, condition)
+    _setBreakpoint: function(sourceID, sourceURL, line, enabled, condition)
     {
         var breakpoint = new WebInspector.Breakpoint(this, sourceID, sourceURL, line, enabled, condition);
         if (this._breakpoints[breakpoint.id])
@@ -109,14 +106,36 @@ WebInspector.BreakpointManager.prototype = {
         return breakpoint;
     },
 
-    _saveBreakpointOnBackend: function(breakpoint)
-    {
-        InspectorBackend.setBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.enabled, breakpoint.condition);
-    },
-
-    _removeBreakpointFromBackend: function(breakpoint)
+    _removeBreakpoint: function(breakpoint)
     {
-        InspectorBackend.removeBreakpoint(breakpoint.sourceID, breakpoint.line);
+        if (!(breakpoint.id in this._breakpoints))
+            return false;
+        breakpoint.removeAllListeners();
+        delete breakpoint._breakpointManager;
+        delete this._breakpoints[breakpoint.id];
+        this.dispatchEventToListeners("breakpoint-removed", breakpoint);
+        return true;
+    },
+
+    _setBreakpointOnBackend: function(breakpoint, isOneTime)
+    {
+        function didSetBreakpoint(success, line)
+        {
+            if (success && line == breakpoint.line)
+                return;
+            if (isOneTime) {
+                if (success)
+                    this._oneTimeBreakpoint.line = line;
+                else
+                    delete this._oneTimeBreakpoint;
+            } else {
+                this._removeBreakpoint(breakpoint);
+                if (success)
+                    this._setBreakpoint(breakpoint.sourceID, breakpoint.sourceURL, line, breakpoint.enabled, breakpoint.condition);
+            }
+        }
+        var callbackId = WebInspector.Callback.wrap(didSetBreakpoint.bind(this));
+        InspectorBackend.setBreakpoint(callbackId, breakpoint.sourceID, breakpoint.line, breakpoint.enabled, breakpoint.condition);
     }
 }
 
@@ -145,7 +164,7 @@ WebInspector.Breakpoint.prototype = {
             return;
 
         this._enabled = x;
-        this._breakpointManager._saveBreakpointOnBackend(this);
+        this._breakpointManager._setBreakpointOnBackend(this);
         if (this._enabled)
             this.dispatchEventToListeners("enabled");
         else
@@ -187,9 +206,11 @@ WebInspector.Breakpoint.prototype = {
 
         this._condition = c;
         if (this.enabled)
-            this._breakpointManager._saveBreakpointOnBackend(this);
+            this._breakpointManager._setBreakpointOnBackend(this);
         this.dispatchEventToListeners("condition-changed");
     }
 }
 
 WebInspector.Breakpoint.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.didSetBreakpoint = WebInspector.Callback.processCallback;
diff --git a/WebCore/inspector/front-end/ElementsPanel.js b/WebCore/inspector/front-end/ElementsPanel.js
index c8eb3dd..e176112 100644
--- a/WebCore/inspector/front-end/ElementsPanel.js
+++ b/WebCore/inspector/front-end/ElementsPanel.js
@@ -1028,7 +1028,8 @@ WebInspector.ElementsPanel.prototype = {
     updateStyles: function(forceUpdate)
     {
         var stylesSidebarPane = this.sidebarPanes.styles;
-        if (!stylesSidebarPane.expanded || !stylesSidebarPane.needsUpdate)
+        var computedStylePane = this.sidebarPanes.computedStyle;
+        if ((!stylesSidebarPane.expanded && !computedStylePane.expanded) || !stylesSidebarPane.needsUpdate)
             return;
 
         stylesSidebarPane.update(this.focusedDOMNode, null, forceUpdate);
diff --git a/WebCore/inspector/front-end/InjectedScript.js b/WebCore/inspector/front-end/InjectedScript.js
index 26495e8..5d9d065 100644
--- a/WebCore/inspector/front-end/InjectedScript.js
+++ b/WebCore/inspector/front-end/InjectedScript.js
@@ -121,27 +121,6 @@ InjectedScript.getProperties = function(objectProxy, ignoreHasOwnProperty, abbre
     if (!ignoreHasOwnProperty && object.__proto__)
         propertyNames.push("__proto__");
 
-    if (jsEngine === "v8") {
-        // Check if the object is a scope.
-        if (InjectedScript._isScopeProxy(objectProxy)) {
-            propertyNames = [];
-            for (var name in object)
-                propertyNames.push(name);
-        } else {
-            // FIXME(http://crbug.com/41243): Object.getOwnPropertyNames may return duplicated names.
-            var a = [];
-            propertyNames.sort();
-            var prev;
-            for (var i = 0; i < propertyNames.length; i++) {
-                var n = propertyNames[i];
-                if (n != prev)
-                    a.push(n);
-                prev = n;
-            }
-            propertyNames = a;
-        }
-    }
-    
     // Go over properties, prepare results.
     for (var i = 0; i < propertyNames.length; ++i) {
         var propertyName = propertyNames[i];
@@ -171,12 +150,6 @@ InjectedScript.getProperties = function(objectProxy, ignoreHasOwnProperty, abbre
     return properties;
 }
 
-InjectedScript._isScopeProxy = function(objectProxy)
-{
-    var objectId = objectProxy.objectId;
-    return typeof objectId === "object" && !objectId.thisObject;
-} 
-
 InjectedScript.setPropertyValue = function(objectProxy, propertyName, expression)
 {
     var object = InjectedScript._resolveObject(objectProxy);
@@ -217,7 +190,7 @@ InjectedScript._populatePropertyNames = function(object, resultSet)
         try {
             var names = Object.getOwnPropertyNames(o);
             for (var i = 0; i < names.length; ++i)
-                resultSet[names[i] + ""] = true;
+                resultSet[names[i]] = true;
         } catch (e) {
         }
     }
diff --git a/WebCore/inspector/front-end/InspectorBackendStub.js b/WebCore/inspector/front-end/InspectorBackendStub.js
index 1ae32b5..761e876 100644
--- a/WebCore/inspector/front-end/InspectorBackendStub.js
+++ b/WebCore/inspector/front-end/InspectorBackendStub.js
@@ -165,8 +165,9 @@ WebInspector.InspectorBackendStub.prototype = {
         WebInspector.debuggerWasDisabled();
     },
 
-    setBreakpoint: function(sourceID, line, enabled, condition)
+    setBreakpoint: function(callId, sourceID, line, enabled, condition)
     {
+        WebInspector.didSetBreakpoint(callId, true, line);
     },
 
     removeBreakpoint: function(sourceID, line)
diff --git a/WebCore/inspector/front-end/Object.js b/WebCore/inspector/front-end/Object.js
index 27e2144..5872b8b 100644
--- a/WebCore/inspector/front-end/Object.js
+++ b/WebCore/inspector/front-end/Object.js
@@ -27,7 +27,8 @@ WebInspector.Object = function() {
 }
 
 WebInspector.Object.prototype = {
-    addEventListener: function(eventType, listener, thisObject) {
+    addEventListener: function(eventType, listener, thisObject)
+    {
         if (!("_listeners" in this))
             this._listeners = {};
         if (!(eventType in this._listeners))
@@ -35,7 +36,8 @@ WebInspector.Object.prototype = {
         this._listeners[eventType].push({ thisObject: thisObject, listener: listener });
     },
 
-    removeEventListener: function(eventType, listener, thisObject) {
+    removeEventListener: function(eventType, listener, thisObject)
+    {
         if (!("_listeners" in this) || !(eventType in this._listeners))
             return;
         var listeners = this._listeners[eventType];
@@ -50,7 +52,13 @@ WebInspector.Object.prototype = {
             delete this._listeners[eventType];
     },
 
-    dispatchEventToListeners: function(eventType, eventData) {
+    removeAllListeners: function()
+    {
+        delete this._listeners;
+    },
+
+    dispatchEventToListeners: function(eventType, eventData)
+    {
         if (!("_listeners" in this) || !(eventType in this._listeners))
             return;
 
diff --git a/WebCore/inspector/front-end/ScriptView.js b/WebCore/inspector/front-end/ScriptView.js
index 1883fb3..c576510 100644
--- a/WebCore/inspector/front-end/ScriptView.js
+++ b/WebCore/inspector/front-end/ScriptView.js
@@ -96,7 +96,7 @@ WebInspector.ScriptView.prototype = {
 
     _addBreakpoint: function(line)
     {
-        WebInspector.breakpointManager.addBreakpoint(this.script.sourceID, this.script.sourceURL, line, true, "");
+        WebInspector.breakpointManager.setBreakpoint(this.script.sourceID, this.script.sourceURL, line, true, "");
     },
 
     _editLineComplete: function(newBody)
diff --git a/WebCore/inspector/front-end/ScriptsPanel.js b/WebCore/inspector/front-end/ScriptsPanel.js
index c23db14..5563b93 100644
--- a/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/WebCore/inspector/front-end/ScriptsPanel.js
@@ -224,9 +224,9 @@ WebInspector.ScriptsPanel.prototype = {
     
     hide: function()
     {
-        WebInspector.Panel.prototype.hide.call(this);
         if (this.visibleView)
             this.visibleView.hide();
+        WebInspector.Panel.prototype.hide.call(this);
     },
 
     get searchableViews()
@@ -364,9 +364,10 @@ WebInspector.ScriptsPanel.prototype = {
             }
             for (var i = 0; i < breakpoints.length; ++i) {
                 var breakpoint = breakpoints[i];
+                var newLine = breakpoint.line;
                 if (success && breakpoint.line >= line)
-                    breakpoint.line += linesCountToShift;
-                WebInspector.breakpointManager.addBreakpoint(breakpoint);
+                    newLine += linesCountToShift;
+                WebInspector.breakpointManager.setBreakpoint(sourceID, breakpoint.url, newLine, breakpoint.enabled, breakpoint.condition);
             }
         };
         var callbackId = WebInspector.Callback.wrap(mycallback.bind(this))
diff --git a/WebCore/inspector/front-end/SourceFrame.js b/WebCore/inspector/front-end/SourceFrame.js
index f221086..73c3e2a 100644
--- a/WebCore/inspector/front-end/SourceFrame.js
+++ b/WebCore/inspector/front-end/SourceFrame.js
@@ -56,10 +56,18 @@ WebInspector.SourceFrame.prototype = {
         this._visible = visible;
         this._createViewerIfNeeded();
         
-        if (!visible) {
+        if (visible) {
+            if (this._textViewer && this._scrollTop)
+                this._textViewer.element.scrollTop = this._scrollTop;
+            if (this._textViewer && this._scrollLeft)
+                this._textViewer.element.scrollLeft = this._scrollLeft;
+        } else {
             this._hidePopup();
-            if (this._textViewer)
+            if (this._textViewer) {
+                this._scrollTop = this._textViewer.element.scrollTop;
+                this._scrollLeft = this._textViewer.element.scrollLeft;
                 this._textViewer.freeCachedElements();
+            }
         }
     },
 
diff --git a/WebCore/inspector/front-end/SourceView.js b/WebCore/inspector/front-end/SourceView.js
index e4d7fed..1bf8194 100644
--- a/WebCore/inspector/front-end/SourceView.js
+++ b/WebCore/inspector/front-end/SourceView.js
@@ -58,8 +58,8 @@ WebInspector.SourceView.prototype = {
 
     hide: function()
     {
-        WebInspector.View.prototype.hide.call(this);
         this.sourceFrame.visible = false;
+        WebInspector.View.prototype.hide.call(this);
         if (this.localSourceFrame)
             this.localSourceFrame.visible = false;
         this._currentSearchResultIndex = -1;
@@ -127,7 +127,7 @@ WebInspector.SourceView.prototype = {
     _addBreakpoint: function(line)
     {
         var sourceID = this._sourceIDForLine(line);
-        WebInspector.breakpointManager.addBreakpoint(sourceID, this.resource.url, line, true, "");
+        WebInspector.breakpointManager.setBreakpoint(sourceID, this.resource.url, line, true, "");
     },
 
     _removeBreakpoint: function(breakpoint)
diff --git a/WebCore/inspector/front-end/TextViewer.js b/WebCore/inspector/front-end/TextViewer.js
index 4709a59..13b2836 100644
--- a/WebCore/inspector/front-end/TextViewer.js
+++ b/WebCore/inspector/front-end/TextViewer.js
@@ -551,28 +551,24 @@ WebInspector.TextViewer.prototype = {
             return { line: lineNumber, column: this._textModel.lineLength(lineNumber) };
 
         var column = 0;
-        if (lineRow.chunk) {
-            // This is chunk.
-            var text = lineRow.lastChild.textContent;
+        var node = lineRow.lastChild.traverseNextTextNode(lineRow.lastChild);
+        while (node && node !== container) {
+            column += node.textContent.length;
+            node = node.traverseNextTextNode(lineRow.lastChild);
+        }
+
+        // This may be chunk and chunks may contain \n.
+        if (node === container && offset) {
+            var text = node.textContent;
             for (var i = 0; i < offset; ++i) {
                 if (text.charAt(i) === "\n") {
                     lineNumber++;
                     column = 0;
                 } else
-                    column++; 
+                    column++;
             }
-            return { line: lineNumber, column: column };
-        }
-
-        // This is individul line.
-        var column = 0;
-        var node = lineRow.lastChild.traverseNextTextNode(lineRow.lastChild);
-        while (node && node !== container) {
-            column += node.textContent.length;
-            node = node.traverseNextTextNode(lineRow.lastChild);
         }
-        column += offset;
-        return { line: lineRow.lineNumber, column: column };
+        return { line: lineNumber, column: column };
     },
 
     _appendSpan: function(element, content, className)
diff --git a/WebCore/loader/CachedScript.cpp b/WebCore/loader/CachedScript.cpp
index 466a5e9..c96427c 100644
--- a/WebCore/loader/CachedScript.cpp
+++ b/WebCore/loader/CachedScript.cpp
@@ -37,6 +37,7 @@ namespace WebCore {
 
 CachedScript::CachedScript(const String& url, const String& charset)
     : CachedResource(url, Script)
+    , m_scriptHasBOMs(SourceCouldHaveBOMs)
     , m_decoder(TextResourceDecoder::create("application/javascript", charset))
     , m_decodedDataDeletionTimer(this, &CachedScript::decodedDataDeletionTimerFired)
 {
@@ -78,6 +79,11 @@ const String& CachedScript::script()
     if (!m_script && m_data) {
         m_script = m_decoder->decode(m_data->data(), encodedSize());
         m_script += m_decoder->flush();
+        if (m_scriptHasBOMs != SourceHasNoBOMs && m_script.length()) {
+            bool hasBOMs = false;
+            m_script = String(m_script.impl()->copyStringWithoutBOMs(m_scriptHasBOMs == SourceHasBOMs, hasBOMs));
+            m_scriptHasBOMs = hasBOMs ? SourceHasBOMs : SourceHasNoBOMs;
+        }
         setDecodedSize(m_script.length() * sizeof(UChar));
     }
 
diff --git a/WebCore/loader/CachedScript.h b/WebCore/loader/CachedScript.h
index 13afa89..2374409 100644
--- a/WebCore/loader/CachedScript.h
+++ b/WebCore/loader/CachedScript.h
@@ -59,6 +59,7 @@ namespace WebCore {
         void decodedDataDeletionTimerFired(Timer<CachedScript>*);
 
         String m_script;
+        enum { SourceHasNoBOMs, SourceCouldHaveBOMs, SourceHasBOMs } m_scriptHasBOMs;
         RefPtr<TextResourceDecoder> m_decoder;
         Timer<CachedScript> m_decodedDataDeletionTimer;
     };
diff --git a/WebCore/loader/DocumentLoader.cpp b/WebCore/loader/DocumentLoader.cpp
index 990c48a..fcc1826 100644
--- a/WebCore/loader/DocumentLoader.cpp
+++ b/WebCore/loader/DocumentLoader.cpp
@@ -39,6 +39,7 @@
 #include "CachedPage.h"
 #include "DocLoader.h"
 #include "Document.h"
+#include "DocumentParser.h"
 #include "Event.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -50,7 +51,6 @@
 #include "PlatformString.h"
 #include "Settings.h"
 #include "SharedBuffer.h"
-#include "XMLDocumentParser.h"
 
 #include <wtf/Assertions.h>
 #include <wtf/unicode/Unicode.h>
diff --git a/WebCore/loader/DocumentWriter.cpp b/WebCore/loader/DocumentWriter.cpp
index 2ea1afd..d99f340 100644
--- a/WebCore/loader/DocumentWriter.cpp
+++ b/WebCore/loader/DocumentWriter.cpp
@@ -38,12 +38,14 @@
 #include "FrameView.h"
 #include "PlaceholderDocument.h"
 #include "PluginDocument.h"
+#include "RawDataDocumentParser.h"
+#include "ScriptableDocumentParser.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "Settings.h"
 #include "SinkDocument.h"
 #include "TextResourceDecoder.h"
-#include "DocumentParser.h"
+
 
 namespace WebCore {
 
@@ -73,10 +75,10 @@ void DocumentWriter::replaceDocument(const String& source)
             m_frame->document()->setParseMode(Document::Strict);
         }
 
-        // FIXME: If we wanted to support the <img src='javascript:'imagedata'>
-        // case then we would need to call addData(char*, int) instead.
+        // FIXME: This should call DocumentParser::appendBytes instead of append
+        // to support RawDataDocumentParsers.
         if (DocumentParser* parser = m_frame->document()->parser())
-            parser->write(source, true);
+            parser->append(source);
     }
 
     end();
@@ -143,21 +145,8 @@ void DocumentWriter::begin(const KURL& url, bool dispatch, SecurityOrigin* origi
         m_frame->view()->setContentsSize(IntSize());
 }
 
-void DocumentWriter::addData(const char* str, int len, bool flush)
+TextResourceDecoder* DocumentWriter::createDecoderIfNeeded()
 {
-    if (len == 0 && !flush)
-        return;
-
-    if (len == -1)
-        len = strlen(str);
-
-    DocumentParser* parser = m_frame->document()->parser();
-    if (parser && parser->wantsRawData()) {
-        if (len > 0)
-            parser->writeRawData(str, len);
-        return;
-    }
-    
     if (!m_decoder) {
         if (Settings* settings = m_frame->settings()) {
             m_decoder = TextResourceDecoder::create(m_mimeType,
@@ -187,24 +176,28 @@ void DocumentWriter::addData(const char* str, int len, bool flush)
         }
         m_frame->document()->setDecoder(m_decoder.get());
     }
+    return m_decoder.get();
+}
 
-    String decoded = m_decoder->decode(str, len);
-    if (flush)
-        decoded += m_decoder->flush();
-    if (decoded.isEmpty())
-        return;
-
+void DocumentWriter::reportDataRecieved()
+{
+    ASSERT(m_decoder);
     if (!m_receivedData) {
         m_receivedData = true;
         if (m_decoder->encoding().usesVisualOrdering())
             m_frame->document()->setVisuallyOrdered();
         m_frame->document()->recalcStyle(Node::Force);
     }
+}
 
-    if (parser) {
-        ASSERT(!parser->wantsRawData());
-        parser->write(decoded, true);
-    }
+void DocumentWriter::addData(const char* str, int len, bool flush)
+{
+    if (len == -1)
+        len = strlen(str);
+
+    DocumentParser* parser = m_frame->document()->parser();
+    if (parser)
+        parser->appendBytes(this, str, len, flush);
 }
 
 void DocumentWriter::end()
diff --git a/WebCore/loader/DocumentWriter.h b/WebCore/loader/DocumentWriter.h
index 6644093..b1007ef 100644
--- a/WebCore/loader/DocumentWriter.h
+++ b/WebCore/loader/DocumentWriter.h
@@ -67,6 +67,10 @@ public:
 
     void setDecoder(TextResourceDecoder*);
 
+    // Exposed for DoucmentParser::appendBytes
+    TextResourceDecoder* createDecoderIfNeeded();
+    void reportDataRecieved();
+
 private:
     PassRefPtr<Document> createDocument(const KURL&);
 
diff --git a/WebCore/loader/FTPDirectoryDocument.cpp b/WebCore/loader/FTPDirectoryDocument.cpp
index 2a19fa3..9315e45 100644
--- a/WebCore/loader/FTPDirectoryDocument.cpp
+++ b/WebCore/loader/FTPDirectoryDocument.cpp
@@ -52,7 +52,7 @@ class FTPDirectoryDocumentParser : public LegacyHTMLDocumentParser {
 public:
     FTPDirectoryDocumentParser(HTMLDocument*);
 
-    virtual void write(const SegmentedString&, bool appendData);
+    virtual void append(const SegmentedString&);
     virtual void finish();
     
     virtual bool isWaitingForScripts() const { return false; }
@@ -100,7 +100,7 @@ FTPDirectoryDocumentParser::FTPDirectoryDocumentParser(HTMLDocument* document)
     , m_size(254)
     , m_buffer(static_cast<UChar*>(fastMalloc(sizeof(UChar) * m_size)))
     , m_dest(m_buffer)
-{    
+{
 }    
 
 void FTPDirectoryDocumentParser::appendEntry(const String& filename, const String& size, const String& date, bool isDirectory)
@@ -301,11 +301,8 @@ bool FTPDirectoryDocumentParser::loadDocumentTemplate()
         LOG_ERROR("Could not load templateData");
         return false;
     }
-    
-    // Tokenize the template as an HTML document synchronously
-    setForceSynchronous(true);
-    LegacyHTMLDocumentParser::write(String(templateDocumentData->data(), templateDocumentData->size()), true);
-    setForceSynchronous(false);
+
+    LegacyHTMLDocumentParser::insert(String(templateDocumentData->data(), templateDocumentData->size()));
     
     RefPtr<Element> tableElement = document()->getElementById("ftpDirectoryTable");
     if (!tableElement)
@@ -354,8 +351,8 @@ void FTPDirectoryDocumentParser::createBasicDocument()
     bodyElement->appendChild(m_tableElement, ec);
 }
 
-void FTPDirectoryDocumentParser::write(const SegmentedString& s, bool /*appendData*/)
-{    
+void FTPDirectoryDocumentParser::append(const SegmentedString& source)
+{
     // Make sure we have the table element to append to by loading the template set in the pref, or
     // creating a very basic document with the appropriate table
     if (!m_tableElement) {
@@ -367,7 +364,7 @@ void FTPDirectoryDocumentParser::write(const SegmentedString& s, bool /*appendDa
     bool foundNewLine = false;
     
     m_dest = m_buffer;
-    SegmentedString str = s;
+    SegmentedString str = source;
     while (!str.isEmpty()) {
         UChar c = *str;
         
diff --git a/WebCore/loader/FrameLoader.cpp b/WebCore/loader/FrameLoader.cpp
index 1fbf2ee..540e0f7 100644
--- a/WebCore/loader/FrameLoader.cpp
+++ b/WebCore/loader/FrameLoader.cpp
@@ -3438,7 +3438,7 @@ KURL FrameLoader::originalRequestURL() const
 
 String FrameLoader::referrer() const
 {
-    return documentLoader()->request().httpReferrer();
+    return m_documentLoader ? m_documentLoader->request().httpReferrer() : "";
 }
 
 void FrameLoader::dispatchDocumentElementAvailable()
diff --git a/WebCore/loader/ImageDocument.cpp b/WebCore/loader/ImageDocument.cpp
index 49f54e2..b1e33f4 100644
--- a/WebCore/loader/ImageDocument.cpp
+++ b/WebCore/loader/ImageDocument.cpp
@@ -84,7 +84,7 @@ public:
     }
 
 private:
-    virtual bool writeRawData(const char* data, int len);
+    virtual void appendBytes(DocumentWriter*, const char*, int, bool);
     virtual void finish();
 };
 
@@ -118,19 +118,17 @@ static float pageZoomFactor(Document* document)
     return view ? view->pageZoomFactor() : 1;
 }
 
-bool ImageDocumentParser::writeRawData(const char*, int)
+void ImageDocumentParser::appendBytes(DocumentWriter*, const char*, int, bool)
 {
     Frame* frame = document()->frame();
     Settings* settings = frame->settings();
     if (!frame->loader()->client()->allowImages(!settings || settings->areImagesEnabled()))
-        return false;
+        return;
 
     CachedImage* cachedImage = document()->cachedImage();
     cachedImage->data(frame->loader()->documentLoader()->mainResourceData(), false);
 
     document()->imageChanged();
-    
-    return false;
 }
 
 void ImageDocumentParser::finish()
diff --git a/WebCore/loader/MediaDocument.cpp b/WebCore/loader/MediaDocument.cpp
index 97ca783..97e1775 100644
--- a/WebCore/loader/MediaDocument.cpp
+++ b/WebCore/loader/MediaDocument.cpp
@@ -54,7 +54,7 @@ public:
     }
 
 private:
-    virtual bool writeRawData(const char* data, int len);
+    virtual void appendBytes(DocumentWriter*, const char*, int, bool);
 
     void createDocumentStructure();
 
@@ -90,16 +90,15 @@ void MediaDocumentParser::createDocumentStructure()
 
     frame->loader()->activeDocumentLoader()->mainResourceLoader()->setShouldBufferData(false);
 }
-    
-bool MediaDocumentParser::writeRawData(const char*, int)
+
+void MediaDocumentParser::appendBytes(DocumentWriter*, const char*, int, bool)
 {
     ASSERT(!m_mediaElement);
     if (m_mediaElement)
-        return false;
-        
+        return;
+
     createDocumentStructure();
     finish();
-    return false;
 }
     
 MediaDocument::MediaDocument(Frame* frame, const KURL& url)
diff --git a/WebCore/loader/PluginDocument.cpp b/WebCore/loader/PluginDocument.cpp
index 12ab746..cca6894 100644
--- a/WebCore/loader/PluginDocument.cpp
+++ b/WebCore/loader/PluginDocument.cpp
@@ -52,7 +52,7 @@ public:
     static Widget* pluginWidgetFromDocument(Document*);
 
 private:
-    virtual bool writeRawData(const char* data, int len);
+    virtual void appendBytes(DocumentWriter*, const char*, int, bool);
 
     void createDocumentStructure();
 
@@ -98,30 +98,30 @@ void PluginDocumentParser::createDocumentStructure()
     
     body->appendChild(embedElement, ec);    
 }
-    
-bool PluginDocumentParser::writeRawData(const char*, int)
+
+void PluginDocumentParser::appendBytes(DocumentWriter*, const char*, int, bool)
 {
     ASSERT(!m_embedElement);
     if (m_embedElement)
-        return false;
-    
+        return;
+
     createDocumentStructure();
 
-    if (Frame* frame = document()->frame()) {
-        Settings* settings = frame->settings();
-        if (settings && frame->loader()->subframeLoader()->allowPlugins(NotAboutToInstantiatePlugin)) {
-            document()->updateLayout();
+    Frame* frame = document()->frame();
+    if (!frame)
+        return;
+    Settings* settings = frame->settings();
+    if (!settings || !frame->loader()->subframeLoader()->allowPlugins(NotAboutToInstantiatePlugin))
+        return;
 
-            if (RenderWidget* renderer = toRenderWidget(m_embedElement->renderer())) {
-                frame->loader()->client()->redirectDataToPlugin(renderer->widget());
-                frame->loader()->activeDocumentLoader()->mainResourceLoader()->setShouldBufferData(false);
-            }
+    document()->updateLayout();
 
-            finish();
-        }
+    if (RenderWidget* renderer = toRenderWidget(m_embedElement->renderer())) {
+        frame->loader()->client()->redirectDataToPlugin(renderer->widget());
+        frame->loader()->activeDocumentLoader()->mainResourceLoader()->setShouldBufferData(false);
     }
 
-    return false;
+    finish();
 }
 
 PluginDocument::PluginDocument(Frame* frame, const KURL& url)
diff --git a/WebCore/loader/SinkDocument.cpp b/WebCore/loader/SinkDocument.cpp
index e149981..fb0ab94 100644
--- a/WebCore/loader/SinkDocument.cpp
+++ b/WebCore/loader/SinkDocument.cpp
@@ -30,6 +30,18 @@
 
 namespace WebCore {
 
+class SinkDocumentParser : public RawDataDocumentParser {
+public:
+    SinkDocumentParser(SinkDocument* document)
+        : RawDataDocumentParser(document)
+    {
+    }
+
+private:
+    // Ignore all data.
+    virtual void appendBytes(DocumentWriter*, const char*, int, bool) { }
+};
+
 SinkDocument::SinkDocument(Frame* frame, const KURL& url)
     : HTMLDocument(frame, url)
 {
@@ -38,9 +50,7 @@ SinkDocument::SinkDocument(Frame* frame, const KURL& url)
 
 DocumentParser* SinkDocument::createParser()
 {
-    // The basic RawDataDocumentParser does nothing with the data
-    // which is sufficient for our purposes here.
-    return new RawDataDocumentParser(this);
+    return new SinkDocumentParser(this);
 }
 
 } // namespace WebCore
diff --git a/WebCore/loader/SubresourceLoader.cpp b/WebCore/loader/SubresourceLoader.cpp
index d37bb1c..9c2959b 100644
--- a/WebCore/loader/SubresourceLoader.cpp
+++ b/WebCore/loader/SubresourceLoader.cpp
@@ -66,7 +66,7 @@ PassRefPtr<SubresourceLoader> SubresourceLoader::create(Frame* frame, Subresourc
         return 0;
 
     FrameLoader* fl = frame->loader();
-    if (securityCheck == DoSecurityCheck && (fl->state() == FrameStateProvisional || fl->activeDocumentLoader()->isStopping()))
+    if (securityCheck == DoSecurityCheck && (fl->state() == FrameStateProvisional || !fl->activeDocumentLoader() || fl->activeDocumentLoader()->isStopping()))
         return 0;
 
     ResourceRequest newRequest = request;
diff --git a/WebCore/loader/TextDocument.cpp b/WebCore/loader/TextDocument.cpp
index 3360aca..6b53084 100644
--- a/WebCore/loader/TextDocument.cpp
+++ b/WebCore/loader/TextDocument.cpp
@@ -25,12 +25,12 @@
 #include "config.h"
 #include "TextDocument.h"
 
+#include "DecodedDataDocumentParser.h"
 #include "Element.h"
 #include "HTMLNames.h"
 #include "HTMLViewSourceDocument.h"
 #include "SegmentedString.h"
 #include "Text.h"
-#include "XMLDocumentParser.h"
 
 using namespace std;
 
@@ -38,18 +38,20 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-class TextDocumentParser : public DocumentParser {
+// FIXME: TextDocumentParser could just be an HTMLDocumentParser
+// which started the Tokenizer in the PlainText state.
+class TextDocumentParser : public DecodedDataDocumentParser {
 public:
     TextDocumentParser(Document*);
     virtual ~TextDocumentParser();
     TextDocumentParser(HTMLViewSourceDocument*);
 
 private:
-    virtual void write(const SegmentedString&, bool appendData);
+    virtual void insert(const SegmentedString&);
+    virtual void append(const SegmentedString&);
     virtual void finish();
     virtual bool finishWasCalled();
-    virtual bool isWaitingForScripts() const;
-    
+
     inline void checkBuffer(int len = 10)
     {
         if ((m_dest - m_buffer) > m_size - len) {
@@ -62,6 +64,7 @@ private:
         }
     }
 
+private:
     Element* m_preElement;
 
     bool m_skipLF;
@@ -72,7 +75,7 @@ private:
 };
 
 TextDocumentParser::TextDocumentParser(Document* document)
-    : DocumentParser(document)
+    : DecodedDataDocumentParser(document)
     , m_preElement(0)
     , m_skipLF(false)
 {    
@@ -83,7 +86,7 @@ TextDocumentParser::TextDocumentParser(Document* document)
 }    
 
 TextDocumentParser::TextDocumentParser(HTMLViewSourceDocument* document)
-    : DocumentParser(document, true)
+    : DecodedDataDocumentParser(document, true)
     , m_preElement(0)
     , m_skipLF(false)
 {    
@@ -99,7 +102,12 @@ TextDocumentParser::~TextDocumentParser()
     ASSERT(!m_buffer);
 }
 
-void TextDocumentParser::write(const SegmentedString& s, bool)
+void TextDocumentParser::insert(const SegmentedString&)
+{
+    ASSERT_NOT_REACHED();
+}
+
+void TextDocumentParser::append(const SegmentedString& s)
 {
     ExceptionCode ec;
 
@@ -162,12 +170,14 @@ void TextDocumentParser::write(const SegmentedString& s, bool)
 void TextDocumentParser::finish()
 {
     if (!m_preElement)
-        write(SegmentedString(), true); // Create document structure for an empty text document.
+        append(SegmentedString()); // Create document structure for an empty text document.
     m_preElement = 0;
     fastFree(m_buffer);
     m_buffer = 0;
     m_dest = 0;
 
+    // FIXME: Should this call finishParsing even if m_parserStopped is true?
+    // See equivalent implementation in RawDataDocumentParser.
     document()->finishedParsing();
 }
 
@@ -178,12 +188,6 @@ bool TextDocumentParser::finishWasCalled()
     return false;
 }
 
-bool TextDocumentParser::isWaitingForScripts() const
-{
-    // A text document is never waiting for scripts
-    return false;
-}
-
 TextDocument::TextDocument(Frame* frame, const KURL& url)
     : HTMLDocument(frame, url)
 {
diff --git a/WebCore/manual-tests/animation-with-transition.html b/WebCore/manual-tests/animation-with-transition.html
new file mode 100644
index 0000000..37a7589
--- /dev/null
+++ b/WebCore/manual-tests/animation-with-transition.html
@@ -0,0 +1,60 @@
+<html>
+<head>
+  <meta http-equiv="Content-type" content="text/html; charset=utf-8">
+  <title>simple-animation</title>
+  <style type="text/css" media="screen">
+    div {
+      position: relative;
+      left: 10px;
+      top: 10px;
+      width: 200px;
+      height: 200px;
+      background-color: #696;
+      -webkit-transition: left 5s, top 5s;
+    }
+    
+    .animate {
+      -webkit-animation-name: simple;
+      -webkit-animation-duration: 2s;
+      -webkit-animation-timing-function: linear;
+      -webkit-animation-fill-mode: backwards;
+    }
+    
+    @-webkit-keyframes simple {
+      50% {
+        left: 300px;
+      }
+      100% {
+        left: 80px;
+      }
+    }
+    
+    
+  </style>
+  <script type="text/javascript" charset="utf-8">
+    
+    function doTransition() {
+      var div = document.querySelector("div");
+      div.style.left = "200px";
+    }
+    
+    function doAnimation() {
+      var div = document.querySelector("div");
+      div.className = "animate";
+    }
+    
+  </script>
+</head>
+<body>
+  <p>Testing setting an animation while a transition is running, in the
+    case where the animation synthesizes the initial keyframe</p>
+  <p>
+    Start the transition, then start the animation.</p>
+  <p>
+    <a href="https://bugs.webkit.org/show_bug.cgi?id=41188">https://bugs.webkit.org/show_bug.cgi?id=41188</a>
+  </p>
+  <button onclick="doTransition();">Transition</button>
+  <button onclick="doAnimation();">Set Animation</button>
+<div></div>
+</body>
+</html>
diff --git a/WebCore/manual-tests/partially-opaque-form-elements.html b/WebCore/manual-tests/partially-opaque-form-elements.html
new file mode 100644
index 0000000..b525c64
--- /dev/null
+++ b/WebCore/manual-tests/partially-opaque-form-elements.html
@@ -0,0 +1,27 @@
+<html>
+<style>
+    body { opacity: 0.5; }
+</style>
+<body> 
+<p><b>BUG ID:</b> <a href="https://bugs.webkit.org/show_bug.cgi?id=41113">Bugzilla bug 41113</a> [WinCairo] Text box backgrounds do not render in partially opaque layers</p>
+
+<div style="background-color:skyblue; padding:3px;">
+In the next paragraph you should see a partially opaque sequence including:
+<ol>
+<li>The word "Before"</li>
+<li>A checkbox</li>
+<li>A radio button</li>
+<li>The world "After"</li>
+</ol>
+If this test is failing you might only see the word "Before."
+</div>
+
+<p>
+Before
+<input value="Checkbox" type="checkbox">
+<input value="Radio" type="radio">
+After
+</p>
+
+</body> 
+</html>
diff --git a/WebCore/manual-tests/partially-opaque-text-input.html b/WebCore/manual-tests/partially-opaque-text-input.html
new file mode 100644
index 0000000..bef147e
--- /dev/null
+++ b/WebCore/manual-tests/partially-opaque-text-input.html
@@ -0,0 +1,25 @@
+<html>
+<style>
+    body { opacity: 0.5; }
+</style>
+<body> 
+<p><b>BUG ID:</b> <a href="https://bugs.webkit.org/show_bug.cgi?id=41113">Bugzilla bug 41113</a> [WinCairo] Text box backgrounds do not render in partially opaque layers</p>
+
+<div style="background-color:skyblue; padding:3px;">
+In the next paragraph you should see a partially opaque sequence including:
+<ol>
+<li>The word "Before"</li>
+<li>A text box</li>
+<li>The world "After"</li>
+</ol>
+If this test is failing you will not see the text box border.
+</div>
+
+<p>
+Before
+<input type="text"/>
+After
+</p>
+
+</body> 
+</html>
diff --git a/WebCore/manual-tests/win/contextmenu-key.html b/WebCore/manual-tests/win/contextmenu-key.html
new file mode 100644
index 0000000..7d6f734
--- /dev/null
+++ b/WebCore/manual-tests/win/contextmenu-key.html
@@ -0,0 +1,112 @@
+<!DOCTYPE html>
+<html>
+<head>
+<style>
+
+#outer {
+    overflow: auto;
+    width: 200px;
+    height: 200px;
+}
+
+#inner {
+    position: relative;
+    height: 400px;
+}
+
+#inner:focus {
+    background-color: lightblue;
+}
+
+#inner:active {
+    background-color: blue;
+}
+
+#h, #h2 {
+    background: rgba(255, 255, 255, 0);
+}
+
+#h {
+    position: absolute;
+    height: 200px;
+    width: 200px;
+}
+
+#h2 {
+    position: absolute;
+    top: 200px;
+    height: 200px;
+    width: 100%;
+}
+
+#h:hover,
+#h2:hover {
+    background: pink;
+}
+
+#h:active,
+#h2:active {
+    background: red;
+}
+
+pre {
+    position: absolute;
+    left: 250px;
+    top: 80px;
+}
+
+</style>
+</head>
+<body>
+
+<p>Manual test for <a href="https://bugs.webkit.org/show_bug.cgi?id=38129">bug 38129</a></p>
+
+<p>Click the div below and press the context menu key on your keyboard (Shift+F10 also works)</p>
+
+<div id=outer>
+    <div id=inner tabindex=0>
+        <div id=h2></div>
+    </div>
+</div>
+
+<div id=h></div>
+
+<pre></pre>
+
+<script>
+
+function cs(el)
+{
+    if (window.getComputedStyle)
+        return window.getComputedStyle(el, '');
+    return el.currentStyle;
+}
+
+document.addEventListener('contextmenu', function(e)
+{
+    var inner = document.querySelector('#inner');
+    var outer = document.querySelector('#outer');
+    var h = document.querySelector('#h');
+    var h2 = document.querySelector('#h2');
+    var result = [];
+
+    result.push(e.target, document.querySelector('#inner'));
+    result.push(cs(inner, '').backgroundColor, 'rgb(0, 0, 255)');
+    result.push(cs(h, '').backgroundColor, 'rgba(255, 255, 255, 0)');
+    result.push(cs(h2, '').backgroundColor, 'rgba(255, 255, 255, 0)');
+
+    var s = '';
+    for (var i = 0; i < result.length; i += 2) {
+        s += result[i] + ' == ' + result[i + 1] + ' - ' +
+            (result[i] == result[i + 1] ? 'PASS' : 'FAIL') + '<br>';
+    }
+
+    document.querySelector('pre').innerHTML = s;
+
+    return true;
+}, false);
+
+</script>
+
+</body>
+</html>
diff --git a/WebCore/mathml/RenderMathMLSubSup.cpp b/WebCore/mathml/RenderMathMLSubSup.cpp
index af25980..45ad000 100644
--- a/WebCore/mathml/RenderMathMLSubSup.cpp
+++ b/WebCore/mathml/RenderMathMLSubSup.cpp
@@ -102,31 +102,31 @@ void RenderMathMLSubSup::addChild(RenderObject* child, RenderObject* beforeChild
     }
 }
 
-void  RenderMathMLSubSup::stretchToHeight(int height)
+void RenderMathMLSubSup::stretchToHeight(int height)
 {
     RenderObject* base = firstChild();
     if (!base)
         return;
     
-    if (base->isRenderMathMLBlock()) {
-        RenderMathMLBlock* block = toRenderMathMLBlock(base);
+    if (base->firstChild()->isRenderMathMLBlock()) {
+        RenderMathMLBlock* block = toRenderMathMLBlock(base->firstChild());
         block->stretchToHeight(static_cast<int>(gSubSupStretch * height));
-    }
-    if (height > 0 && m_kind == SubSup && m_scripts) {
-        RenderObject* script = m_scripts->firstChild();
-        if (script) {
-            // Calculate the script height without the container margins.
-            RenderObject* top = script;
-            int topHeight = getBoxModelObjectHeight(top->firstChild());
-            int topAdjust = topHeight / gTopAdjustDivisor;
-            top->style()->setMarginTop(Length(-topAdjust, Fixed));
-            top->style()->setMarginBottom(Length(height - topHeight + topAdjust, Fixed));
-            if (top->isBoxModelObject()) {
-                RenderBoxModelObject* topBox = toRenderBoxModelObject(top);
-                topBox->updateBoxModelInfoFromStyle();
+        if (height > 0 && m_kind == SubSup && m_scripts) {
+            RenderObject* script = m_scripts->firstChild();
+            if (script) {
+                // Calculate the script height without the container margins.
+                RenderObject* top = script;
+                int topHeight = getBoxModelObjectHeight(top->firstChild());
+                int topAdjust = topHeight / gTopAdjustDivisor;
+                top->style()->setMarginTop(Length(-topAdjust, Fixed));
+                top->style()->setMarginBottom(Length(height - topHeight + topAdjust, Fixed));
+                if (top->isBoxModelObject()) {
+                    RenderBoxModelObject* topBox = toRenderBoxModelObject(top);
+                    topBox->updateBoxModelInfoFromStyle();
+                }
+                m_scripts->setNeedsLayoutAndPrefWidthsRecalc();
+                m_scripts->markContainingBlocksForLayout();
             }
-            m_scripts->setNeedsLayoutAndPrefWidthsRecalc();
-            m_scripts->markContainingBlocksForLayout();
         }
     }
     updateBoxModelInfoFromStyle();
diff --git a/WebCore/page/ChromeClient.h b/WebCore/page/ChromeClient.h
index 6e20969..660ec68 100644
--- a/WebCore/page/ChromeClient.h
+++ b/WebCore/page/ChromeClient.h
@@ -43,6 +43,7 @@ class NSResponder;
 namespace WebCore {
 
     class AtomicString;
+    class Element;
     class FileChooser;
     class FloatRect;
     class Frame;
@@ -146,6 +147,7 @@ namespace WebCore {
         // End methods used by HostWindow.
 
         virtual void scrollbarsModeDidChange() const = 0;
+        virtual void missingPluginButtonClicked(Element*) const { }
         virtual void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags) = 0;
 
         virtual void setToolTip(const String&, TextDirection) = 0;
diff --git a/WebCore/page/DOMWindow.cpp b/WebCore/page/DOMWindow.cpp
index d234973..f050a80 100644
--- a/WebCore/page/DOMWindow.cpp
+++ b/WebCore/page/DOMWindow.cpp
@@ -65,6 +65,7 @@
 #include "NotificationCenter.h"
 #include "Page.h"
 #include "PageGroup.h"
+#include "Performance.h"
 #include "PlatformScreen.h"
 #include "PlatformString.h"
 #include "Screen.h"
@@ -442,6 +443,12 @@ void DOMWindow::clear()
         m_navigator->disconnectFrame();
     m_navigator = 0;
 
+#if ENABLE(WEB_TIMING)
+    if (m_performance)
+        m_performance->disconnectFrame();
+    m_performance = 0;
+#endif
+
     if (m_location)
         m_location->disconnectFrame();
     m_location = 0;
@@ -566,6 +573,15 @@ Navigator* DOMWindow::navigator() const
     return m_navigator.get();
 }
 
+#if ENABLE(WEB_TIMING)
+Performance* DOMWindow::webkitPerformance() const
+{
+    if (!m_performance)
+        m_performance = Performance::create(m_frame);
+    return m_performance.get();
+}
+#endif
+
 Location* DOMWindow::location() const
 {
     if (!m_location)
diff --git a/WebCore/page/DOMWindow.h b/WebCore/page/DOMWindow.h
index 4765b31..beb2f7d 100644
--- a/WebCore/page/DOMWindow.h
+++ b/WebCore/page/DOMWindow.h
@@ -60,6 +60,11 @@ namespace WebCore {
     class Navigator;
     class Node;
     class NotificationCenter;
+
+#if ENABLE(WEB_TIMING)
+    class Performance;
+#endif
+
     class PostMessageTimer;
     class ScheduledAction;
     class SerializedScriptValue;
@@ -125,6 +130,9 @@ namespace WebCore {
         BarInfo* toolbar() const;
         Navigator* navigator() const;
         Navigator* clientInformation() const { return navigator(); }
+#if ENABLE(WEB_TIMING)
+        Performance* webkitPerformance() const;
+#endif
         Location* location() const;
 
         DOMSelection* getSelection();
@@ -356,6 +364,9 @@ namespace WebCore {
         BarInfo* optionalToolbar() const { return m_toolbar.get(); }
         Console* optionalConsole() const { return m_console.get(); }
         Navigator* optionalNavigator() const { return m_navigator.get(); }
+#if ENABLE(WEB_TIMING)
+        Performance* optionalWebkitPerformance() const { return m_performance.get(); }
+#endif
         Location* optionalLocation() const { return m_location.get(); }
         StyleMedia* optionalMedia() const { return m_media.get(); }
 #if ENABLE(DOM_STORAGE)
@@ -393,6 +404,9 @@ namespace WebCore {
         mutable RefPtr<BarInfo> m_toolbar;
         mutable RefPtr<Console> m_console;
         mutable RefPtr<Navigator> m_navigator;
+#if ENABLE(WEB_TIMING)
+        mutable RefPtr<Performance> m_performance;
+#endif
         mutable RefPtr<Location> m_location;
         mutable RefPtr<StyleMedia> m_media;
 #if ENABLE(DOM_STORAGE)
diff --git a/WebCore/page/DOMWindow.idl b/WebCore/page/DOMWindow.idl
index 5b1000a..20eab8b 100644
--- a/WebCore/page/DOMWindow.idl
+++ b/WebCore/page/DOMWindow.idl
@@ -195,6 +195,11 @@ module window {
             raises(DOMException);
 #endif
 
+#if defined(ENABLE_WEB_TIMING) && ENABLE_WEB_TIMING
+        // FIXME: Remove vendor prefix.
+        readonly attribute Performance webkitPerformance;
+#endif
+
         // Timers
         [Custom] long setTimeout(in TimeoutHandler handler, in long timeout);
         // [Custom] long setTimeout(in TimeoutHandler handler, in long timeout, arguments...);
@@ -456,6 +461,10 @@ module window {
         attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLRenderingContextConstructor WebGLRenderingContext;
         attribute TextMetricsConstructor TextMetrics;
 
+#if !defined(V8_BINDING) || !V8_BINDING
+        attribute DOMStringMapConstructor DOMStringMap;
+#endif
+
         attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] ArrayBufferConstructor ArrayBuffer; // Usable with new operator
         attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Int8ArrayConstructor Int8Array; // Usable with new operator
         attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Uint8ArrayConstructor Uint8Array; // Usable with new operator
@@ -706,7 +715,7 @@ module window {
         attribute SVGFEColorMatrixElementConstructor SVGFEColorMatrixElement;
         attribute SVGFEComponentTransferElementConstructor SVGFEComponentTransferElement;
         attribute SVGFECompositeElementConstructor SVGFECompositeElement;
-//      attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
+        attribute SVGFEConvolveMatrixElementConstructor SVGFEConvolveMatrixElement;
         attribute SVGFEDiffuseLightingElementConstructor SVGFEDiffuseLightingElement;
         attribute SVGFEDisplacementMapElementConstructor SVGFEDisplacementMapElement;
         attribute SVGFEDistantLightElementConstructor SVGFEDistantLightElement;
@@ -752,3 +761,4 @@ module window {
     };
 
 }
+
diff --git a/WebCore/page/EventHandler.cpp b/WebCore/page/EventHandler.cpp
index c28b1a5..9fde92f 100644
--- a/WebCore/page/EventHandler.cpp
+++ b/WebCore/page/EventHandler.cpp
@@ -2035,10 +2035,84 @@ bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
     }
 #endif
 
-    swallowEvent = dispatchMouseEvent(eventNames().contextmenuEvent, mev.targetNode(), true, 0, event, true);
+    swallowEvent = dispatchMouseEvent(eventNames().contextmenuEvent, mev.targetNode(), true, 0, event, false);
     
     return swallowEvent;
 }
+
+bool EventHandler::sendContextMenuEventForKey()
+{
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+
+    Document* doc = m_frame->document();
+    if (!doc)
+        return false;
+
+    static const int kContextMenuMargin = 1;
+
+#if OS(WINDOWS)
+    int rightAligned = ::GetSystemMetrics(SM_MENUDROPALIGNMENT);
+#else
+    int rightAligned = 0;
+#endif
+    IntPoint location;
+
+    Node* focusedNode = doc->focusedNode();
+    SelectionController* selectionController = m_frame->selection();
+    Position start = selectionController->selection().start();
+
+    if (start.node() && (selectionController->rootEditableElement() || selectionController->isRange())) {
+        RenderObject* renderer = start.node()->renderer();
+        if (!renderer)
+            return false;
+
+        RefPtr<Range> selection = selectionController->toNormalizedRange();
+        IntRect firstRect = m_frame->firstRectForRange(selection.get());
+
+        int x = rightAligned ? firstRect.right() : firstRect.x();
+        location = IntPoint(x, firstRect.bottom());
+    } else if (focusedNode) {
+        RenderBoxModelObject* box = focusedNode->renderBoxModelObject();
+        IntRect clippedRect = box->absoluteClippedOverflowRect();
+        location = clippedRect.bottomLeft();
+    } else {
+        location = IntPoint(
+            rightAligned ? view->contentsWidth() - kContextMenuMargin : kContextMenuMargin,
+            kContextMenuMargin);
+    }
+
+    m_frame->view()->setCursor(pointerCursor());
+
+    IntPoint position = view->contentsToWindow(location);
+    IntPoint globalPosition = view->contentsToScreen(IntRect(location, IntSize())).location();
+
+    Node* targetNode = doc->focusedNode();
+    if (!targetNode)
+        targetNode = doc;
+
+    // Use the focused node as the target for hover and active.
+    HitTestResult result(position);
+    result.setInnerNode(targetNode);
+    HitTestRequest request(HitTestRequest::Active);
+    doc->renderView()->layer()->updateHoverActiveState(request, result);
+    doc->updateStyleIfNeeded();
+   
+    // The contextmenu event is a mouse event even when invoked using the keyboard.
+    // This is required for web compatibility.
+
+#if OS(WINDOWS)
+    MouseEventType eventType = MouseEventReleased;
+#else
+    MouseEventType eventType = MouseEventPressed;
+#endif
+
+    PlatformMouseEvent mouseEvent(position, globalPosition, RightButton, eventType, 1, false, false, false, false, WTF::currentTime());
+
+    return dispatchMouseEvent(eventNames().contextmenuEvent, targetNode, true, 0, mouseEvent, false);
+}
+
 #endif // ENABLE(CONTEXT_MENUS)
 
 void EventHandler::scheduleHoverStateUpdate()
diff --git a/WebCore/page/EventHandler.h b/WebCore/page/EventHandler.h
index bf2003e..d24d803 100644
--- a/WebCore/page/EventHandler.h
+++ b/WebCore/page/EventHandler.h
@@ -161,6 +161,7 @@ public:
 
 #if ENABLE(CONTEXT_MENUS)
     bool sendContextMenuEvent(const PlatformMouseEvent&);
+    bool sendContextMenuEventForKey();
 #endif
 
     void setMouseDownMayStartAutoscroll() { m_mouseDownMayStartAutoscroll = true; }
diff --git a/WebCore/page/FocusController.cpp b/WebCore/page/FocusController.cpp
index e9f180b..6ecdffd 100644
--- a/WebCore/page/FocusController.cpp
+++ b/WebCore/page/FocusController.cpp
@@ -503,7 +503,7 @@ void FocusController::deepFindFocusableNodeInDirection(Node* container, Node* fo
         if (!innerDocument)
             return;
 
-        descendantOfContainer = innerDocument == focusedNode->document();
+        descendantOfContainer = isNodeDeepDescendantOfDocument(focusedNode, innerDocument);
         firstChild = innerDocument->firstChild();
 
     // Scrollable block elements (e.g. <div>, etc)
diff --git a/WebCore/page/Frame.cpp b/WebCore/page/Frame.cpp
index 186ac62..5ae666e 100644
--- a/WebCore/page/Frame.cpp
+++ b/WebCore/page/Frame.cpp
@@ -156,6 +156,7 @@ inline Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoader
     , m_isDisconnected(false)
     , m_excludeFromTextSearch(false)
 {
+    ASSERT(page);
     AtomicString::init();
     HTMLNames::init();
     QualifiedName::init();
diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index 1508e07..dfbe7a2 100644
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -694,8 +694,12 @@ void FrameView::layout(bool allowSubtree)
         RenderObject* rootRenderer = documentElement ? documentElement->renderer() : 0;
         Node* body = document->body();
         if (body && body->renderer()) {
+<<<<<<< HEAD
             if (body->hasTagName(framesetTag) && !m_frame->settings()->frameFlatteningEnabled()) {
 #if !defined(ANDROID_FLATTEN_IFRAME) && !defined(ANDROID_FLATTEN_FRAMESET)
+=======
+            if (body->hasTagName(framesetTag) && m_frame->settings() && !m_frame->settings()->frameFlatteningEnabled()) {
+>>>>>>> webkit.org at r62496
                 body->renderer()->setChildNeedsLayout(true);
                 vMode = ScrollbarAlwaysOff;
                 hMode = ScrollbarAlwaysOff;
@@ -1372,7 +1376,7 @@ void FrameView::scheduleRelayout()
 
     // When frame flattening is enabled, the contents of the frame affects layout of the parent frames.
     // Also invalidate parent frame starting from the owner element of this frame.
-    if (m_frame->settings()->frameFlatteningEnabled() && m_frame->ownerRenderer()) {
+    if (m_frame->settings() && m_frame->settings()->frameFlatteningEnabled() && m_frame->ownerRenderer()) {
         if (m_frame->ownerElement()->hasTagName(iframeTag) || m_frame->ownerElement()->hasTagName(frameTag))
             m_frame->ownerRenderer()->setNeedsLayout(true, true);
     }
diff --git a/WebCore/bindings/v8/custom/V8HTMLIFrameElementCustom.cpp b/WebCore/page/Navigation.cpp
index 5f22400..828f87e 100644
--- a/WebCore/bindings/v8/custom/V8HTMLIFrameElementCustom.cpp
+++ b/WebCore/page/Navigation.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2007-2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -29,27 +29,45 @@
  */
 
 #include "config.h"
-#include "V8HTMLIFrameElement.h"
+#include "Navigation.h"
 
-#include "HTMLIFrameElement.h"
-#include "HTMLNames.h" 
-#include "V8Binding.h"
-#include "V8BindingState.h"
-#include "V8Proxy.h"
+#if ENABLE(WEB_TIMING)
+
+#include "Frame.h"
 
 namespace WebCore {
 
-using namespace HTMLNames; 
+Navigation::Navigation(Frame* frame)
+    : m_frame(frame)
+{
+}
 
-void V8HTMLIFrameElement::srcAccessorSetter(v8::Local<v8::String> name, v8::Local<v8::Value> value, const v8::AccessorInfo& info)
+Frame* Navigation::frame() const
 {
-    HTMLIFrameElement* iframe = V8HTMLIFrameElement::toNative(info.Holder());
-    String v = toWebCoreStringWithNullCheck(value);
+    return m_frame;
+}
 
-    if (!V8BindingSecurity::allowSettingFrameSrcToJavascriptUrl(V8BindingState::Only(), iframe, v))
-        return;
+void Navigation::disconnectFrame()
+{
+    m_frame = 0;
+}
 
-    iframe->setAttribute(srcAttr, v); 
+unsigned short Navigation::type() const
+{
+    if (!m_frame)
+        return 0;
+
+    return 0; // FIXME
+}
+
+unsigned short Navigation::redirectCount() const
+{
+    if (!m_frame)
+        return 0;
+
+    return 0; // FIXME
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(WEB_TIMING)
diff --git a/WebKit/chromium/src/AutocompletePopupMenuClient.h b/WebCore/page/Navigation.h
index 16a3771..5e0f7e6 100644
--- a/WebKit/chromium/src/AutocompletePopupMenuClient.h
+++ b/WebCore/page/Navigation.h
@@ -28,38 +28,35 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef AutocompletePopupMenuClient_h
-#define AutocompletePopupMenuClient_h
- 
-#include "SuggestionsPopupMenuClient.h"
+#ifndef Navigation_h
+#define Navigation_h
+
+#if ENABLE(WEB_TIMING)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
-class HTMLInputElement;
-}
 
-namespace WebKit {
-class WebString;
-template <typename T> class WebVector;
+class Frame;
 
-// The Autocomplete suggestions popup menu client, used to display a list of
-// autocomplete suggestions.
-class AutocompletePopupMenuClient : public SuggestionsPopupMenuClient {
+class Navigation : public RefCounted<Navigation> {
 public:
-    // SuggestionsPopupMenuClient implementation:
-    virtual unsigned getSuggestionsCount() const;
-    virtual WebString getSuggestion(unsigned listIndex) const;
-    virtual void removeSuggestionAtIndex(unsigned listIndex);
+    static PassRefPtr<Navigation> create(Frame* frame) { return adoptRef(new Navigation(frame)); }
 
-    void initialize(WebCore::HTMLInputElement*,
-                    const WebVector<WebString>& suggestions,
-                    int defaultSuggestionIndex);
+    Frame* frame() const;
+    void disconnectFrame();
 
-    void setSuggestions(const WebVector<WebString>&);
+    unsigned short type() const;
+    unsigned short redirectCount() const;
 
 private:
-    Vector<WebCore::String> m_suggestions;
+    Navigation(Frame*);
+
+    Frame* m_frame;
 };
 
-} // namespace WebKit
+}
 
-#endif
+#endif // !ENABLE(WEB_TIMING)
+#endif // !defined(Navigation_h)
diff --git a/WebCore/page/Navigation.idl b/WebCore/page/Navigation.idl
new file mode 100644
index 0000000..3ec20ad
--- /dev/null
+++ b/WebCore/page/Navigation.idl
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    // See: http://dev.w3.org/2006/webapi/WebTiming/
+    interface [Conditional=WEB_TIMING, OmitConstructor] Navigation {
+        const unsigned short NAVIGATION_OTHER = 0;
+        const unsigned short NAVIGATION_LINK = 1;
+        const unsigned short NAVIGATION_FORWARD_BACK = 2;
+        const unsigned short NAVIGATION_BROWSER = 3;
+        const unsigned short NAVIGATION_NEW_WINDOW = 4;
+        const unsigned short NAVIGATION_RELOAD = 5;
+        const unsigned short NAVIGATION_FRAME = 6;
+        readonly attribute unsigned short type;
+
+        readonly attribute unsigned short redirectCount;
+    };
+
+}
diff --git a/WebKit/chromium/src/AutocompletePopupMenuClient.cpp b/WebCore/page/Performance.cpp
index ed4f670..c19ce8f 100644
--- a/WebKit/chromium/src/AutocompletePopupMenuClient.cpp
+++ b/WebCore/page/Performance.cpp
@@ -29,56 +29,56 @@
  */
 
 #include "config.h"
-#include "AutocompletePopupMenuClient.h"
+#include "Performance.h"
 
-#include "HTMLInputElement.h"
-#include "WebString.h"
-#include "WebVector.h"
+#include "Navigation.h"
+#include "Timing.h"
 
-using namespace WebCore;
+#if ENABLE(WEB_TIMING)
 
-namespace WebKit {
+#include "Frame.h"
 
-unsigned AutocompletePopupMenuClient::getSuggestionsCount() const
+namespace WebCore {
+
+Performance::Performance(Frame* frame)
+    : m_frame(frame)
 {
-    return m_suggestions.size();
 }
 
-WebString AutocompletePopupMenuClient::getSuggestion(unsigned listIndex) const
+Frame* Performance::frame() const
 {
-    ASSERT(listIndex < m_suggestions.size());
-    return m_suggestions[listIndex];
+    return m_frame;
 }
 
-void AutocompletePopupMenuClient::removeSuggestionAtIndex(unsigned listIndex)
+void Performance::disconnectFrame()
 {
-    ASSERT(listIndex < m_suggestions.size());
-    m_suggestions.remove(listIndex);
+    if (m_navigation) {
+        m_navigation->disconnectFrame();
+        m_navigation = 0;
+    }
+    if (m_timing) {
+        m_timing->disconnectFrame();
+        m_timing = 0;
+    }
+    m_frame = 0;
 }
 
-void AutocompletePopupMenuClient::initialize(
-    HTMLInputElement* textField,
-    const WebVector<WebString>& suggestions,
-    int defaultSuggestionIndex)
+Navigation* Performance::navigation() const
 {
-    ASSERT(defaultSuggestionIndex < static_cast<int>(suggestions.size()));
-
-    // The suggestions must be set before initializing the
-    // SuggestionsPopupMenuClient.
-    setSuggestions(suggestions);
+    if (!m_navigation)
+        m_navigation = Navigation::create(m_frame);
 
-    SuggestionsPopupMenuClient::initialize(textField, defaultSuggestionIndex);
+    return m_navigation.get();
 }
 
-void AutocompletePopupMenuClient::setSuggestions(const WebVector<WebString>& suggestions)
+Timing* Performance::timing() const
 {
-    m_suggestions.clear();
-    for (size_t i = 0; i < suggestions.size(); ++i)
-        m_suggestions.append(suggestions[i]);
+    if (!m_timing)
+        m_timing = Timing::create(m_frame);
 
-    // Try to preserve selection if possible.
-    if (getSelectedIndex() >= static_cast<int>(suggestions.size()))
-        setSelectedIndex(-1);
+    return m_timing.get();
 }
 
-} // namespace WebKit
+} // namespace WebCore
+
+#endif // ENABLE(WEB_TIMING)
diff --git a/WebCore/page/Performance.h b/WebCore/page/Performance.h
new file mode 100644
index 0000000..f317076
--- /dev/null
+++ b/WebCore/page/Performance.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Performance_h
+#define Performance_h
+
+#if ENABLE(WEB_TIMING)
+
+#include "Navigation.h"
+#include "Timing.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class Performance : public RefCounted<Performance> {
+public:
+    static PassRefPtr<Performance> create(Frame* frame) { return adoptRef(new Performance(frame)); }
+
+    Frame* frame() const;
+    void disconnectFrame();
+
+    Navigation* navigation() const;
+    Timing* timing() const;
+
+private:
+    Performance(Frame*);
+
+    mutable RefPtr<Navigation> m_navigation;
+    mutable RefPtr<Timing> m_timing;
+    Frame* m_frame;
+};
+
+}
+
+#endif // !ENABLE(WEB_TIMING)
+#endif // !defined(Performance_h)
diff --git a/WebCore/page/Performance.idl b/WebCore/page/Performance.idl
new file mode 100644
index 0000000..3885e2c
--- /dev/null
+++ b/WebCore/page/Performance.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    // See: http://dev.w3.org/2006/webapi/WebTiming/
+    interface [Conditional=WEB_TIMING, OmitConstructor] Performance {
+        readonly attribute Navigation navigation;
+        readonly attribute Timing timing;
+    };
+
+}
diff --git a/WebCore/page/PrintContext.cpp b/WebCore/page/PrintContext.cpp
index 28c52bd..cc3707e 100644
--- a/WebCore/page/PrintContext.cpp
+++ b/WebCore/page/PrintContext.cpp
@@ -207,8 +207,11 @@ String PrintContext::pageProperty(Frame* frame, const char* propertyName, int pa
     RefPtr<RenderStyle> style = document->styleForPage(pageNumber);
 
     // Implement formatters for properties we care about.
-    if (!strcmp(propertyName, "margin-left"))
+    if (!strcmp(propertyName, "margin-left")) {
+        if (style->marginLeft().isAuto())
+            return String("auto");
         return String::format("%d", style->marginLeft().rawValue());
+    }
     if (!strcmp(propertyName, "line-height"))
         return String::format("%d", style->lineHeight().rawValue());
     if (!strcmp(propertyName, "font-size"))
@@ -224,16 +227,11 @@ bool PrintContext::isPageBoxVisible(Frame* frame, int pageNumber)
     return frame->document()->isPageBoxVisible(pageNumber);
 }
 
-String PrintContext::pageAreaRectInPixels(Frame* frame, int pageNumber)
-{
-    IntRect pageArea = frame->document()->pageAreaRectInPixels(pageNumber);
-    return String::format("(%d,%d,%d,%d)", pageArea.x(), pageArea.y(), pageArea.width(), pageArea.height());
-}
-
-String PrintContext::preferredPageSizeInPixels(Frame* frame, int pageNumber)
+String PrintContext::pageSizeAndMarginsInPixels(Frame* frame, int pageNumber, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft)
 {
-    IntSize pageSize = frame->document()->preferredPageSizeInPixels(pageNumber);
-    return String::format("(%d,%d)", pageSize.width(), pageSize.height());
+    IntSize pageSize(width, height);
+    frame->document()->pageSizeAndMarginsInPixels(pageNumber, pageSize, marginTop, marginRight, marginBottom, marginLeft);
+    return String::format("(%d, %d) %d %d %d %d", pageSize.width(), pageSize.height(), marginTop, marginRight, marginBottom, marginLeft);
 }
 
 int PrintContext::numberOfPages(Frame* frame, const FloatSize& pageSizeInPixels)
diff --git a/WebCore/page/PrintContext.h b/WebCore/page/PrintContext.h
index 81a9b76..1080c29 100644
--- a/WebCore/page/PrintContext.h
+++ b/WebCore/page/PrintContext.h
@@ -57,8 +57,7 @@ public:
     static int pageNumberForElement(Element*, const FloatSize& pageSizeInPixels);
     static String pageProperty(Frame* frame, const char* propertyName, int pageNumber);
     static bool isPageBoxVisible(Frame* frame, int pageNumber);
-    static String pageAreaRectInPixels(Frame* frame, int pageNumber);
-    static String preferredPageSizeInPixels(Frame* frame, int pageNumber);
+    static String pageSizeAndMarginsInPixels(Frame* frame, int pageNumber, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft);
     static int numberOfPages(Frame*, const FloatSize& pageSizeInPixels);
 
 protected:
diff --git a/WebCore/page/Settings.cpp b/WebCore/page/Settings.cpp
index 503b938..d7bba08 100644
--- a/WebCore/page/Settings.cpp
+++ b/WebCore/page/Settings.cpp
@@ -145,11 +145,16 @@ Settings::Settings(Page* page)
     , m_loadDeferringEnabled(true)
     , m_tiledBackingStoreEnabled(false)
     , m_html5ParserEnabled(true)
+    , m_html5TreeBuilderEnabled(false) // Will be deleted soon, do not use.
     , m_paginateDuringLayoutEnabled(false)
+<<<<<<< HEAD
 #ifdef ANDROID_PLUGINS
     , m_pluginsOnDemand(false)
 #endif
 
+=======
+    , m_dnsPrefetchingEnabled(true)
+>>>>>>> webkit.org at r62496
 {
     // A Frame may not have been created yet, so we initialize the AtomicString 
     // hash before trying to use it.
@@ -723,6 +728,11 @@ void Settings::setUsesEncodingDetector(bool usesEncodingDetector)
     m_usesEncodingDetector = usesEncodingDetector;
 }
 
+void Settings::setDNSPrefetchingEnabled(bool dnsPrefetchingEnabled)
+{
+    m_dnsPrefetchingEnabled = dnsPrefetchingEnabled;
+}
+
 void Settings::setAllowScriptsToCloseWindows(bool allowScriptsToCloseWindows)
 {
     m_allowScriptsToCloseWindows = allowScriptsToCloseWindows;
diff --git a/WebCore/page/Settings.h b/WebCore/page/Settings.h
index 1513a7a..e22fca5 100644
--- a/WebCore/page/Settings.h
+++ b/WebCore/page/Settings.h
@@ -180,6 +180,9 @@ namespace WebCore {
         void setUsesEncodingDetector(bool);
         bool usesEncodingDetector() const { return m_usesEncodingDetector; }
 
+        void setDNSPrefetchingEnabled(bool);
+        bool dnsPrefetchingEnabled() const { return m_dnsPrefetchingEnabled; }
+
         void setUserStyleSheetLocation(const KURL&);
         const KURL& userStyleSheetLocation() const { return m_userStyleSheetLocation; }
 
@@ -363,6 +366,13 @@ namespace WebCore {
         void setHTML5ParserEnabled(bool flag) { m_html5ParserEnabled = flag; }
         bool html5ParserEnabled() const { return m_html5ParserEnabled; }
 
+        // NOTE: This code will be deleted once the HTML5TreeBuilder is ready
+        // to replace LegacyHTMLTreeBuilder.  Using the HTML5DocumentParser
+        // with LegacyHTMLTreeBuilder will not be supported long-term.
+        // Setting is only for testing the new tree builder in DumpRenderTree.
+        void setHTML5TreeBuilderEnabled_DO_NOT_USE(bool flag) { m_html5TreeBuilderEnabled = flag; }
+        bool html5TreeBuilderEnabled() const { return m_html5TreeBuilderEnabled; }
+
         void setPaginateDuringLayoutEnabled(bool flag) { m_paginateDuringLayoutEnabled = flag; }
         bool paginateDuringLayoutEnabled() const { return m_paginateDuringLayoutEnabled; }
 
@@ -483,11 +493,17 @@ namespace WebCore {
         bool m_loadDeferringEnabled : 1;
         bool m_tiledBackingStoreEnabled : 1;
         bool m_html5ParserEnabled: 1;
+        bool m_html5TreeBuilderEnabled: 1; // Will be deleted soon, do not use.
         bool m_paginateDuringLayoutEnabled : 1;
+<<<<<<< HEAD
 #ifdef ANDROID_PLUGINS
         bool m_pluginsOnDemand : 1;
 #endif
 
+=======
+        bool m_dnsPrefetchingEnabled : 1;
+    
+>>>>>>> webkit.org at r62496
 #if USE(SAFARI_THEME)
         static bool gShouldPaintNativeControls;
 #endif
diff --git a/WebCore/page/SpatialNavigation.cpp b/WebCore/page/SpatialNavigation.cpp
index 58b70e4..e748d12 100644
--- a/WebCore/page/SpatialNavigation.cpp
+++ b/WebCore/page/SpatialNavigation.cpp
@@ -546,4 +546,24 @@ bool isScrollableContainerNode(Node* node)
     return false;
 }
 
+bool isNodeDeepDescendantOfDocument(Node* node, Document* baseDocument)
+{
+    if (!node || !baseDocument)
+        return false;
+
+    bool descendant = baseDocument == node->document();
+
+    Element* currentElement = static_cast<Element*>(node);
+    while (!descendant) {
+        Element* documentOwner = currentElement->document()->ownerElement();
+        if (!documentOwner)
+            break;
+
+        descendant = documentOwner->document() == baseDocument;
+        currentElement = documentOwner;
+    }
+
+    return descendant;
+}
+
 } // namespace WebCore
diff --git a/WebCore/page/SpatialNavigation.h b/WebCore/page/SpatialNavigation.h
index 78419a7..d3dcaba 100644
--- a/WebCore/page/SpatialNavigation.h
+++ b/WebCore/page/SpatialNavigation.h
@@ -133,6 +133,7 @@ void scrollIntoView(Element*);
 bool hasOffscreenRect(Node*);
 bool isInRootDocument(Node*);
 bool isScrollableContainerNode(Node*);
+bool isNodeDeepDescendantOfDocument(Node*, Document*);
 
 } // namspace WebCore
 
diff --git a/WebCore/page/Timing.cpp b/WebCore/page/Timing.cpp
new file mode 100644
index 0000000..dcd0fb7
--- /dev/null
+++ b/WebCore/page/Timing.cpp
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Timing.h"
+
+#if ENABLE(WEB_TIMING)
+
+#include "Frame.h"
+
+namespace WebCore {
+
+Timing::Timing(Frame* frame)
+    : m_frame(frame)
+{
+}
+
+Frame* Timing::frame() const
+{
+    return m_frame;
+}
+
+void Timing::disconnectFrame()
+{
+    m_frame = 0;
+}
+
+unsigned long Timing::navigationStart() const
+{
+    if (!m_frame)
+        return 0;
+
+    return 0; // FIXME
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_TIMING)
diff --git a/WebCore/page/Timing.h b/WebCore/page/Timing.h
new file mode 100644
index 0000000..7b66d66
--- /dev/null
+++ b/WebCore/page/Timing.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Timing_h
+#define Timing_h
+
+#if ENABLE(WEB_TIMING)
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class Frame;
+
+class Timing : public RefCounted<Timing> {
+public:
+    static PassRefPtr<Timing> create(Frame* frame) { return adoptRef(new Timing(frame)); }
+
+    Frame* frame() const;
+    void disconnectFrame();
+
+    unsigned long navigationStart() const;
+
+private:
+    Timing(Frame*);
+
+    Frame* m_frame;
+};
+
+}
+
+#endif // !ENABLE(WEB_TIMING)
+#endif // !defined(Timing_h)
diff --git a/WebKit/chromium/public/WebCompositionCommand.h b/WebCore/page/Timing.idl
index bda1eb1..01b72bc 100644
--- a/WebKit/chromium/public/WebCompositionCommand.h
+++ b/WebCore/page/Timing.idl
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -28,18 +28,12 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCompositionCommand_h
-#define WebCompositionCommand_h
+module window {
 
-namespace WebKit {
+    // See: http://dev.w3.org/2006/webapi/WebTiming/
+    interface [Conditional=WEB_TIMING, OmitConstructor] Timing {
+        readonly attribute unsigned long navigationStart;
+        // FIXME: Implement remainder of interface.
+    };
 
-// DEPRECATED.
-enum WebCompositionCommand {
-    WebCompositionCommandDiscard,
-    WebCompositionCommandSet,
-    WebCompositionCommandConfirm,
-};
-
-} // namespace WebKit
-
-#endif
+}
diff --git a/WebCore/page/XSSAuditor.cpp b/WebCore/page/XSSAuditor.cpp
index 33a0951..22506b2 100644
--- a/WebCore/page/XSSAuditor.cpp
+++ b/WebCore/page/XSSAuditor.cpp
@@ -362,7 +362,11 @@ bool XSSAuditor::findInRequest(Frame* frame, const FindTask& task) const
     if (task.string.isEmpty())
         return false;
 
-    FormData* formDataObj = frame->loader()->documentLoader()->originalRequest().httpBody();
+    DocumentLoader *documentLoader = frame->loader()->documentLoader();
+    if (!documentLoader)
+        return false;
+
+    FormData* formDataObj = documentLoader->originalRequest().httpBody();
     const bool hasFormData = formDataObj && !formDataObj->isEmpty();
     String pageURL = frame->document()->url().string();
 
diff --git a/WebCore/platform/BlobItem.cpp b/WebCore/platform/BlobItem.cpp
index f98e466..a12dd08 100644
--- a/WebCore/platform/BlobItem.cpp
+++ b/WebCore/platform/BlobItem.cpp
@@ -33,6 +33,7 @@
 
 #include "FileSystem.h"
 #include "UUID.h"
+#include <wtf/Assertions.h>
 
 namespace WebCore {
 
@@ -124,67 +125,87 @@ StringBlobItem::StringBlobItem(const CString& text)
 {
 }
 
-CString StringBlobItem::convertToCString(const String& text, LineEnding ending, TextEncoding encoding)
+// Normalize all line-endings to CRLF.
+static CString convertToCRLF(const CString& from)
 {
-    CString from = encoding.encode(text.characters(), text.length(), EntitiesForUnencodables);
-    CString result = from;
-
-    if (ending == EndingTransparent)
-        return result;
-
-    if (ending == EndingNative) {
-#if OS(WINDOWS)
-        ending = EndingCRLF;
-#else
-        ending = EndingLF;
-#endif
+    unsigned newLen = 0;
+    const char* p = from.data();
+    while (char c = *p++) {
+        if (c == '\r') {
+            // Safe to look ahead because of trailing '\0'.
+            if (*p != '\n') {
+                // Turn CR into CRLF.
+                newLen += 2;
+            }
+        } else if (c == '\n') {
+            // Turn LF into CRLF.
+            newLen += 2;
+        } else {
+            // Leave other characters alone.
+            newLen += 1;
+        }
     }
+    if (newLen == from.length())
+        return from;
 
-    const char* endingChars = (ending == EndingCRLF) ? "\r\n" : ((ending == EndingCR) ? "\r" : "\n");
-
-    int endingLength = (ending == EndingCRLF) ? 2 : 1;
-    int needFix = 0;
-
-    // Calculate the final length.
-    int calculatedLength = from.length();
-    const char* p = from.data();
+    // Make a copy of the string.
+    p = from.data();
+    char* q;
+    CString result = CString::newUninitialized(newLen, q);
     while (char c = *p++) {
         if (c == '\r') {
             // Safe to look ahead because of trailing '\0'.
-            if (*p == '\n' && ending != EndingCRLF) {
-                p++;
-                calculatedLength += (endingLength - 2);
-                ++needFix;
-            } else if (ending != EndingCR) {
-                calculatedLength += (endingLength - 1);
-                ++needFix;
+            if (*p != '\n') {
+                // Turn CR into CRLF.
+                *q++ = '\r';
+                *q++ = '\n';
             }
-        } else if (c == '\n' && ending != EndingLF) {
-            calculatedLength += (endingLength - 1);
-            ++needFix;
+        } else if (c == '\n') {
+            // Turn LF into CRLF.
+            *q++ = '\r';
+            *q++ = '\n';
+        } else {
+            // Leave other characters alone.
+            *q++ = c;
         }
     }
+    return result;
+}
 
+// Normalize all line-endings to CR or LF.
+static CString convertToCROrLF(const CString& from, bool toCR)
+{
+    unsigned newLen = 0;
+    bool needFix = false;
+    const char* p = from.data();
+    char fromEndingChar = toCR ? '\n' : '\r';
+    char toEndingChar = toCR ? '\r' : '\n';
+    while (char c = *p++) {
+        if (c == '\r' && *p == '\n') {
+            // Turn CRLF into CR or LF.
+            p++;
+            needFix = true;
+        } else if (c == fromEndingChar) {
+            // Turn CR/LF into LF/CR.
+            needFix = true;
+        }
+        newLen += 1;
+    }
     if (!needFix)
-        return result;
+        return from;
 
-    // Convert the endings and create a data buffer.
+    // Make a copy of the string.
     p = from.data();
     char* q;
-    result = CString::newUninitialized(calculatedLength, q);
+    CString result = CString::newUninitialized(newLen, q);
     while (char c = *p++) {
-        if (c == '\r') {
-            if (*p == '\n' && ending != EndingCRLF) {
-                p++;
-                memcpy(q, endingChars, endingLength);
-                q += endingLength;
-            } else if (*p != '\n' && ending != EndingCR) {
-                memcpy(q, endingChars, endingLength);
-                q += endingLength;
-            }
-        } else if (c == '\n' && ending != EndingLF) {
-            memcpy(q, endingChars, endingLength);
-            q += endingLength;
+        if (c == '\r' && *p == '\n') {
+            // Turn CRLF or CR into CR or LF.
+            p++;
+            *q++ = toEndingChar;
+        } else if (c == fromEndingChar) {
+            // Turn CR/LF into LF/CR.
+            *q++ = toEndingChar;
         } else {
             // Leave other characters alone.
             *q++ = c;
@@ -193,6 +214,35 @@ CString StringBlobItem::convertToCString(const String& text, LineEnding ending,
     return result;
 }
 
+CString StringBlobItem::convertToCString(const String& text, LineEnding ending, TextEncoding encoding)
+{
+    CString from = encoding.encode(text.characters(), text.length(), EntitiesForUnencodables);
+
+    if (ending == EndingNative) {
+#if OS(WINDOWS)
+        ending = EndingCRLF;
+#else
+        ending = EndingLF;
+#endif
+    }
+
+    switch (ending) {
+    case EndingTransparent:
+        return from;
+    case EndingCRLF:
+        return convertToCRLF(from);
+    case EndingCR:
+        return convertToCROrLF(from, true);
+    case EndingLF:
+        return convertToCROrLF(from, false);
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    ASSERT_NOT_REACHED();
+    return from;
+}
+
 // ByteArrayBlobItem ----------------------------------------------------------
 
 PassRefPtr<BlobItem> ByteArrayBlobItem::create(const char* data, size_t size)
diff --git a/WebCore/platform/DragData.h b/WebCore/platform/DragData.h
index eda7e7e..9bad699 100644
--- a/WebCore/platform/DragData.h
+++ b/WebCore/platform/DragData.h
@@ -52,10 +52,17 @@ typedef struct IDataObject* DragDataRef;
 #elif PLATFORM(WX)
 typedef class wxDataObject* DragDataRef;
 #elif PLATFORM(GTK)
+<<<<<<< HEAD
 // FIXME: this should probably be something gdk-specific
 typedef void* DragDataRef;
 #elif defined ANDROID
 typedef void* DragDataRef;
+=======
+namespace WebCore {
+class DataObjectGtk;
+}
+typedef WebCore::DataObjectGtk* DragDataRef;
+>>>>>>> webkit.org at r62496
 #elif PLATFORM(CHROMIUM)
 #include "DragDataRef.h"
 #elif PLATFORM(HAIKU)
diff --git a/WebCore/platform/Scrollbar.cpp b/WebCore/platform/Scrollbar.cpp
index fc4b2f1..119a9dc 100644
--- a/WebCore/platform/Scrollbar.cpp
+++ b/WebCore/platform/Scrollbar.cpp
@@ -40,6 +40,12 @@
 
 using namespace std;
 
+#if PLATFORM(CHROMIUM) && OS(LINUX)
+// The position of the scrollbar thumb affects the appearance of the steppers, so
+// when the thumb moves, we have to invalidate them for painting.
+#define THUMB_POSITION_AFFECTS_BUTTONS
+#endif
+
 namespace WebCore {
 
 #if !PLATFORM(GTK) && !PLATFORM(EFL)
@@ -139,9 +145,9 @@ bool Scrollbar::scroll(ScrollDirection direction, ScrollGranularity granularity,
     float step = 0;
     if ((direction == ScrollUp && m_orientation == VerticalScrollbar) || (direction == ScrollLeft && m_orientation == HorizontalScrollbar))
         step = -1;
-    else if ((direction == ScrollDown && m_orientation == VerticalScrollbar) || (direction == ScrollRight && m_orientation == HorizontalScrollbar)) 
+    else if ((direction == ScrollDown && m_orientation == VerticalScrollbar) || (direction == ScrollRight && m_orientation == HorizontalScrollbar))
         step = 1;
-    
+
     if (granularity == ScrollByLine)
         step *= m_lineStep;
     else if (granularity == ScrollByPage)
@@ -150,20 +156,29 @@ bool Scrollbar::scroll(ScrollDirection direction, ScrollGranularity granularity,
         step *= m_totalSize;
     else if (granularity == ScrollByPixel)
         step *= m_pixelStep;
-        
+
     float newPos = m_currentPos + step * multiplier;
     float maxPos = m_totalSize - m_visibleSize;
     return setCurrentPos(max(min(newPos, maxPos), 0.0f));
 }
 
-void Scrollbar::updateThumbPosition()
+void Scrollbar::updateThumb()
 {
+#ifdef THUMB_POSITION_AFFECTS_BUTTONS
+    invalidate();
+#else
     theme()->invalidateParts(this, ForwardTrackPart | BackTrackPart | ThumbPart);
+#endif
+}
+
+void Scrollbar::updateThumbPosition()
+{
+    updateThumb();
 }
 
 void Scrollbar::updateThumbProportion()
 {
-    theme()->invalidateParts(this, ForwardTrackPart | BackTrackPart | ThumbPart);
+    updateThumb();
 }
 
 void Scrollbar::paint(GraphicsContext* context, const IntRect& damageRect)
@@ -172,7 +187,7 @@ void Scrollbar::paint(GraphicsContext* context, const IntRect& damageRect)
         invalidate();
         return;
     }
-        
+
     if (context->paintingDisabled() || !frameRect().intersects(damageRect))
         return;
 
diff --git a/WebCore/platform/Scrollbar.h b/WebCore/platform/Scrollbar.h
index 87310c3..6b3cd0d 100644
--- a/WebCore/platform/Scrollbar.h
+++ b/WebCore/platform/Scrollbar.h
@@ -130,6 +130,7 @@ private:
 protected:
     Scrollbar(ScrollbarClient*, ScrollbarOrientation, ScrollbarControlSize, ScrollbarTheme* = 0);
 
+    void updateThumb();
     virtual void updateThumbPosition();
     virtual void updateThumbProportion();
 
diff --git a/WebCore/platform/TreeShared.h b/WebCore/platform/TreeShared.h
index b844e5f..6e60656 100644
--- a/WebCore/platform/TreeShared.h
+++ b/WebCore/platform/TreeShared.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -23,17 +23,23 @@
 
 #include <wtf/Assertions.h>
 #include <wtf/Noncopyable.h>
-#ifndef NDEBUG
 #include <wtf/Threading.h>
-#endif
 
 namespace WebCore {
 
-template<class T> class TreeShared : public Noncopyable {
+#ifndef NDEBUG
+template<typename T> class TreeShared;
+template<typename T> void adopted(TreeShared<T>*);
+#endif
+
+template<typename T> class TreeShared : public Noncopyable {
 public:
     TreeShared(int initialRefCount = 1)
         : m_refCount(initialRefCount)
         , m_parent(0)
+#ifndef NDEBUG
+        , m_adoptionIsRequired(initialRefCount == 1)
+#endif
     {
         ASSERT(isMainThread());
 #ifndef NDEBUG
@@ -46,6 +52,7 @@ public:
         ASSERT(isMainThread());
         ASSERT(!m_refCount);
         ASSERT(m_deletionHasBegun);
+        ASSERT(!m_adoptionIsRequired);
     }
 
     void ref()
@@ -53,6 +60,7 @@ public:
         ASSERT(isMainThread());
         ASSERT(!m_deletionHasBegun);
         ASSERT(!m_inRemovedLastRefFunction);
+        ASSERT(!m_adoptionIsRequired);
         ++m_refCount;
     }
 
@@ -62,6 +70,7 @@ public:
         ASSERT(m_refCount >= 0);
         ASSERT(!m_deletionHasBegun);
         ASSERT(!m_inRemovedLastRefFunction);
+        ASSERT(!m_adoptionIsRequired);
         if (--m_refCount <= 0 && !m_parent) {
 #ifndef NDEBUG
             m_inRemovedLastRefFunction = true;
@@ -100,6 +109,10 @@ public:
 #endif
 
 private:
+#ifndef NDEBUG
+    friend void adopted<>(TreeShared<T>*);
+#endif
+
     virtual void removedLastRef()
     {
 #ifndef NDEBUG
@@ -110,8 +123,24 @@ private:
 
     int m_refCount;
     T* m_parent;
+#ifndef NDEBUG
+    bool m_adoptionIsRequired;
+#endif
 };
 
+#ifndef NDEBUG
+
+template<typename T> inline void adopted(TreeShared<T>* object)
+{
+    if (!object)
+        return;
+    ASSERT(!object->m_deletionHasBegun);
+    ASSERT(!object->m_inRemovedLastRefFunction);
+    object->m_adoptionIsRequired = false;
+}
+
+#endif
+
 }
 
 #endif // TreeShared.h
diff --git a/WebCore/platform/Widget.h b/WebCore/platform/Widget.h
index d6ff597..45da67a 100644
--- a/WebCore/platform/Widget.h
+++ b/WebCore/platform/Widget.h
@@ -73,6 +73,10 @@ class BView;
 typedef BView* PlatformWidget;
 #endif
 
+#if PLATFORM(BREWMP)
+typedef void* PlatformWidget;
+#endif
+
 #if PLATFORM(CHROMIUM)
 #include "PlatformWidget.h"
 #endif
diff --git a/WebCore/platform/android/RenderThemeAndroid.cpp b/WebCore/platform/android/RenderThemeAndroid.cpp
index d20df98..7249507 100644
--- a/WebCore/platform/android/RenderThemeAndroid.cpp
+++ b/WebCore/platform/android/RenderThemeAndroid.cpp
@@ -61,7 +61,7 @@ const int listboxPadding = 5;
 // the color of selection in TextViews in the system.
 const RGBA32 selectionColor = makeRGB(255, 146, 0);
 
-static SkCanvas* getCanvasFromInfo(const RenderObject::PaintInfo& info)
+static SkCanvas* getCanvasFromInfo(const PaintInfo& info)
 {
     return info.context->platformContext()->mCanvas;
 }
@@ -209,13 +209,13 @@ void RenderThemeAndroid::adjustButtonStyle(CSSStyleSelector*, RenderStyle* style
     style->setMinHeight(Length(style->fontSize() + buttonPadding, Fixed));
 }
 
-bool RenderThemeAndroid::paintCheckbox(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect)
+bool RenderThemeAndroid::paintCheckbox(RenderObject* obj, const PaintInfo& info, const IntRect& rect)
 {
     RenderSkinRadio::Draw(getCanvasFromInfo(info), obj->node(), rect, true);
     return false;
 }
 
-bool RenderThemeAndroid::paintButton(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect)
+bool RenderThemeAndroid::paintButton(RenderObject* obj, const PaintInfo& info, const IntRect& rect)
 {
     // If it is a disabled button, simply paint it to the master picture.
     Node* node = obj->node();
@@ -230,6 +230,7 @@ bool RenderThemeAndroid::paintButton(RenderObject* obj, const RenderObject::Pain
     return false;
 }
 
+<<<<<<< HEAD
 #if ENABLE(VIDEO)
 
 String RenderThemeAndroid::extraMediaControlsStyleSheet()
@@ -320,6 +321,9 @@ void RenderThemeAndroid::adjustSliderThumbSize(RenderObject* o) const
 #endif
 
 bool RenderThemeAndroid::paintRadio(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect)
+=======
+bool RenderThemeAndroid::paintRadio(RenderObject* obj, const PaintInfo& info, const IntRect& rect)
+>>>>>>> webkit.org at r62496
 {
     RenderSkinRadio::Draw(getCanvasFromInfo(info), obj->node(), rect, false);
     return false;
@@ -342,7 +346,7 @@ void RenderThemeAndroid::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle* st
     addIntrinsicMargins(style);
 }
 
-bool RenderThemeAndroid::paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
+bool RenderThemeAndroid::paintTextField(RenderObject*, const PaintInfo&, const IntRect&)
 {
     return true;    
 }
@@ -352,7 +356,7 @@ void RenderThemeAndroid::adjustTextAreaStyle(CSSStyleSelector*, RenderStyle* sty
     addIntrinsicMargins(style);
 }
 
-bool RenderThemeAndroid::paintTextArea(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect)
+bool RenderThemeAndroid::paintTextArea(RenderObject* obj, const PaintInfo& info, const IntRect& rect)
 {
     if (!obj->isListBox())
         return true;
@@ -412,7 +416,7 @@ void RenderThemeAndroid::adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*
     addIntrinsicMargins(style);
 }
 
-bool RenderThemeAndroid::paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
+bool RenderThemeAndroid::paintSearchField(RenderObject*, const PaintInfo&, const IntRect&)
 {
     return true;    
 }
@@ -441,14 +445,14 @@ void RenderThemeAndroid::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* sty
     addIntrinsicMargins(style);
 }
 
-bool RenderThemeAndroid::paintCombo(RenderObject* obj, const RenderObject::PaintInfo& info,  const IntRect& rect)
+bool RenderThemeAndroid::paintCombo(RenderObject* obj, const PaintInfo& info,  const IntRect& rect)
 {
   if (obj->style() && !obj->style()->visitedDependentColor(CSSPropertyBackgroundColor).alpha())
         return true;
     return RenderSkinCombo::Draw(getCanvasFromInfo(info), obj->node(), rect.x(), rect.y(), rect.width(), rect.height());
 }
 
-bool RenderThemeAndroid::paintMenuList(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect) 
+bool RenderThemeAndroid::paintMenuList(RenderObject* obj, const PaintInfo& info, const IntRect& rect) 
 { 
     return paintCombo(obj, info, rect);
 }
@@ -474,7 +478,7 @@ void RenderThemeAndroid::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyl
     adjustMenuListStyleCommon(style, e);
 }
 
-bool RenderThemeAndroid::paintMenuListButton(RenderObject* obj, const RenderObject::PaintInfo& info, const IntRect& rect) 
+bool RenderThemeAndroid::paintMenuListButton(RenderObject* obj, const PaintInfo& info, const IntRect& rect) 
 {
     return paintCombo(obj, info, rect);
 }
diff --git a/WebCore/platform/android/RenderThemeAndroid.h b/WebCore/platform/android/RenderThemeAndroid.h
index 3d7ac77..26047be 100644
--- a/WebCore/platform/android/RenderThemeAndroid.h
+++ b/WebCore/platform/android/RenderThemeAndroid.h
@@ -74,9 +74,10 @@ public:
     virtual int minimumMenuListSize(RenderStyle*) const { return 0; }
 
 protected:
-    virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintCheckbox(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void setCheckboxSize(RenderStyle*) const;
 
+<<<<<<< HEAD
 #if ENABLE(VIDEO)
     virtual String extraMediaControlsStyleSheet();
     virtual void adjustSliderThumbSize(RenderObject* o) const;
@@ -91,28 +92,31 @@ protected:
 #endif
 
     virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+=======
+    virtual bool paintRadio(RenderObject*, const PaintInfo&, const IntRect&);
+>>>>>>> webkit.org at r62496
     virtual void setRadioSize(RenderStyle*) const;
 
     virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, WebCore::Element*) const;
-    virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, WebCore::Element*) const;
-    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, WebCore::Element*) const;
-    virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&);
     
-    bool paintCombo(RenderObject*, const RenderObject::PaintInfo&,  const IntRect&);
+    bool paintCombo(RenderObject*, const PaintInfo&,  const IntRect&);
 
     virtual void adjustListboxStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
     virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
     
     virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
 
 private:
     RenderThemeAndroid();
diff --git a/WebCore/platform/brew/WidgetBrew.cpp b/WebCore/platform/brew/WidgetBrew.cpp
new file mode 100644
index 0000000..5aff731
--- /dev/null
+++ b/WebCore/platform/brew/WidgetBrew.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2009 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Widget.h"
+
+#include "Cursor.h"
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "NotImplemented.h"
+
+namespace WebCore {
+
+Widget::Widget(PlatformWidget widget)
+{
+    init(widget);
+}
+
+Widget::~Widget()
+{
+}
+
+IntRect Widget::frameRect() const
+{
+    return m_frame;
+}
+
+void Widget::setFrameRect(const IntRect& rect)
+{
+    m_frame = rect;
+}
+
+void Widget::setFocus(bool)
+{
+}
+
+void Widget::setCursor(const Cursor& cursor)
+{
+}
+
+void Widget::show()
+{
+}
+
+void Widget::hide()
+{
+}
+
+void Widget::paint(GraphicsContext* p, IntRect const& r)
+{
+    notImplemented();
+}
+
+void Widget::setIsSelected(bool)
+{
+    notImplemented();
+}
+
+} // namespace WebCore
+
diff --git a/WebCore/platform/chromium/ChromiumBridge.h b/WebCore/platform/chromium/ChromiumBridge.h
index 3e9406d..3284aae 100644
--- a/WebCore/platform/chromium/ChromiumBridge.h
+++ b/WebCore/platform/chromium/ChromiumBridge.h
@@ -1,10 +1,10 @@
 /*
  * Copyright (c) 2010, Google Inc. All rights reserved.
- * 
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -38,6 +38,7 @@
 #include "PasteboardPrivate.h"
 #include "PluginData.h"
 
+#include <wtf/HashSet.h>
 #include <wtf/Vector.h>
 
 typedef struct NPObject NPObject;
@@ -60,6 +61,7 @@ typedef struct HFONT__* HFONT;
 
 namespace WebCore {
 
+    class ClipboardData;
     class Color;
     class Cursor;
     class Document;
@@ -91,13 +93,19 @@ namespace WebCore {
         static String clipboardReadPlainText(PasteboardPrivate::ClipboardBuffer);
         static void clipboardReadHTML(PasteboardPrivate::ClipboardBuffer, String*, KURL*);
 
-        // Only the clipboardRead functions take a buffer argument because 
+        // Only the clipboardRead functions take a buffer argument because
         // Chromium currently uses a different technique to write to alternate
         // clipboard buffers.
         static void clipboardWriteSelection(const String&, const KURL&, const String&, bool);
         static void clipboardWritePlainText(const String&);
         static void clipboardWriteURL(const KURL&, const String&);
         static void clipboardWriteImage(NativeImagePtr, const KURL&, const String&);
+        static void clipboardWriteData(ClipboardData*);
+
+        // Interface for handling copy and paste, drag and drop, and selection copy.
+        static HashSet<String> clipboardReadAvailableTypes(PasteboardPrivate::ClipboardBuffer, bool* containsFilenames);
+        static bool clipboardReadData(PasteboardPrivate::ClipboardBuffer, const String& type, String& data, String& metadata);
+        static Vector<String> clipboardReadFilenames(PasteboardPrivate::ClipboardBuffer);
 
         // Cookies ------------------------------------------------------------
         static void setCookies(const Document*, const KURL&, const String& value);
diff --git a/WebCore/platform/chromium/ClipboardChromium.cpp b/WebCore/platform/chromium/ClipboardChromium.cpp
index 29f9620..8aad8aa 100644
--- a/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -495,8 +495,11 @@ void ClipboardChromium::writeURL(const KURL& url, const String& title, Frame*)
 {
     if (!m_dataObject)
         return;
+    ASSERT(!url.isEmpty());
     m_dataObject->url = url;
     m_dataObject->urlTitle = title;
+    m_dataObject->uriList.clear();
+    m_dataObject->uriList.append(url);
 
     // The URL can also be used as plain text.
     m_dataObject->plainText = url.string();
diff --git a/WebCore/platform/chromium/PasteboardPrivate.h b/WebCore/platform/chromium/PasteboardPrivate.h
index 95cc697..1de7fe3 100644
--- a/WebCore/platform/chromium/PasteboardPrivate.h
+++ b/WebCore/platform/chromium/PasteboardPrivate.h
@@ -33,8 +33,7 @@
 
 namespace WebCore {
 
-    class PasteboardPrivate
-    {
+    class PasteboardPrivate {
     public:
         enum ClipboardFormat {
             HTMLFormat,
@@ -44,6 +43,7 @@ namespace WebCore {
         enum ClipboardBuffer {
             StandardBuffer,
             SelectionBuffer,
+            DragBuffer,
         };
     };
 
diff --git a/WebCore/platform/chromium/PopupMenuChromium.cpp b/WebCore/platform/chromium/PopupMenuChromium.cpp
index e8ab333..7e3a2a0 100644
--- a/WebCore/platform/chromium/PopupMenuChromium.cpp
+++ b/WebCore/platform/chromium/PopupMenuChromium.cpp
@@ -53,6 +53,7 @@
 #include "ScrollbarTheme.h"
 #include "StringTruncator.h"
 #include "SystemTime.h"
+#include "UserGestureIndicator.h"
 
 #include <wtf/CurrentTime.h>
 
@@ -451,30 +452,35 @@ void PopupContainer::layout()
 
 bool PopupContainer::handleMouseDownEvent(const PlatformMouseEvent& event)
 {
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
     return m_listBox->handleMouseDownEvent(
         constructRelativeMouseEvent(event, this, m_listBox.get()));
 }
 
 bool PopupContainer::handleMouseMoveEvent(const PlatformMouseEvent& event)
 {
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
     return m_listBox->handleMouseMoveEvent(
         constructRelativeMouseEvent(event, this, m_listBox.get()));
 }
 
 bool PopupContainer::handleMouseReleaseEvent(const PlatformMouseEvent& event)
 {
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
     return m_listBox->handleMouseReleaseEvent(
         constructRelativeMouseEvent(event, this, m_listBox.get()));
 }
 
 bool PopupContainer::handleWheelEvent(const PlatformWheelEvent& event)
 {
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
     return m_listBox->handleWheelEvent(
         constructRelativeWheelEvent(event, this, m_listBox.get()));
 }
 
 bool PopupContainer::handleKeyEvent(const PlatformKeyboardEvent& event)
 {
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
     return m_listBox->handleKeyEvent(event);
 }
 
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromium.cpp b/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
index a6720a1..cf3ca6f 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
@@ -75,6 +75,24 @@ IntRect ScrollbarThemeChromium::forwardButtonRect(Scrollbar* scrollbar, Scrollba
     return IntRect(x, y, size.width(), size.height());
 }
 
+IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
+{
+    IntSize bs = buttonSize(scrollbar);
+    // The buttons at the top and bottom of the scrollbar are square, so the
+    // thickness of the scrollbar is also their height.
+    int thickness = scrollbarThickness(scrollbar->controlSize());
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        // Once the scrollbar becomes smaller than the natural size of the
+        // two buttons, the track disappears.
+        if (scrollbar->width() < 2 * thickness)
+            return IntRect();
+        return IntRect(scrollbar->x() + bs.width(), scrollbar->y(), scrollbar->width() - 2 * bs.width(), thickness);
+    }
+    if (scrollbar->height() < 2 * thickness)
+        return IntRect();
+    return IntRect(scrollbar->x(), scrollbar->y() + bs.height(), thickness, scrollbar->height() - 2 * bs.height());
+}
+
 void ScrollbarThemeChromium::paintTrackBackground(GraphicsContext* context, Scrollbar* scrollbar, const IntRect& rect)
 {
     // Just assume a forward track part.  We only paint the track as a single piece when there is no thumb.
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
index 3a1a652..a9cff9f 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
@@ -40,6 +40,9 @@
 
 namespace WebCore {
 
+static const int scrollbarThicknessValue = 15;
+static const int buttonLength = 14;
+
 ScrollbarTheme* ScrollbarTheme::nativeTheme()
 {
     static ScrollbarThemeChromiumLinux theme;
@@ -48,7 +51,7 @@ ScrollbarTheme* ScrollbarTheme::nativeTheme()
 
 int ScrollbarThemeChromiumLinux::scrollbarThickness(ScrollbarControlSize controlSize)
 {
-    return 15;
+    return scrollbarThicknessValue;
 }
 
 static void drawVertLine(SkCanvas* canvas, int x, int y1, int y2, const SkPaint& paint)
@@ -120,7 +123,7 @@ static SkColor outlineColor(SkScalar* hsv1, SkScalar* hsv2)
     //
     // The following code has been tested to look OK with all of the
     // default GTK themes.
-    SkScalar minDiff = clamp((hsv1[1] + hsv2[1]) * 1.2, 0.2, 0.5);
+    SkScalar minDiff = clamp((hsv1[1] + hsv2[1]) * 1.2, 0.28, 0.5);
     SkScalar diff = clamp(fabs(hsv1[2] - hsv2[2]) / 2, minDiff, 0.5);
 
     if (hsv1[2] + hsv2[2] > 1.0)
@@ -129,15 +132,6 @@ static SkColor outlineColor(SkScalar* hsv1, SkScalar* hsv2)
     return saturateAndBrighten(hsv2, -0.2, diff);
 }
 
-IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
-{
-    IntSize bs = buttonSize(scrollbar);
-    int thickness = scrollbarThickness(scrollbar->controlSize());
-    if (scrollbar->orientation() == HorizontalScrollbar)
-        return IntRect(scrollbar->x() + bs.width(), scrollbar->y(), scrollbar->width(), thickness);
-    return IntRect(scrollbar->x(), scrollbar->y() + bs.height(), thickness, scrollbar->height());
-}
-
 void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
 {
     SkCanvas* const canvas = gc->platformContext()->canvas();
@@ -145,22 +139,155 @@ void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, Scrollbar
     SkIRect skrect;
 
     skrect.set(rect.x(), rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
-    SkScalar track_hsv[3];
-    SkColorToHSV(RenderThemeChromiumLinux::trackColor(), track_hsv);
-    paint.setColor(saturateAndBrighten(track_hsv, 0, 0));
+    SkScalar trackHSV[3];
+    SkColorToHSV(RenderThemeChromiumLinux::trackColor(), trackHSV);
+    paint.setColor(saturateAndBrighten(trackHSV, 0, 0));
     canvas->drawIRect(skrect, paint);
 
-    SkScalar thumb_hsv[3];
+    SkScalar thumbHSV[3];
     SkColorToHSV(RenderThemeChromiumLinux::thumbInactiveColor(),
-                 thumb_hsv);
+                 thumbHSV);
 
-    paint.setColor(outlineColor(track_hsv, thumb_hsv));
+    paint.setColor(outlineColor(trackHSV, thumbHSV));
     drawBox(canvas, rect, paint);
 }
 
 void ScrollbarThemeChromiumLinux::paintButton(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
-    // We don't use buttons
+    SkCanvas* const canvas = gc->platformContext()->canvas();
+    static const int widthMiddle = scrollbarThicknessValue / 2 + 1;
+    static const int lengthMiddle = buttonLength / 2 + 1;
+    SkPaint paint;
+    enum {
+        North,
+        East,
+        South,
+        West,
+    } direction;
+
+    if (scrollbar->orientation() == HorizontalScrollbar) {
+        if (part == BackButtonStartPart)
+            direction = West;
+        else
+            direction = East;
+    } else {
+        if (part == BackButtonStartPart)
+            direction = North;
+        else
+            direction = South;
+    }
+
+    // Determine if the button can be pressed.
+    bool enabled = false;
+    if (((direction == West || direction == North) && scrollbar->currentPos())
+        || (direction == East || direction == South) && scrollbar->currentPos() != scrollbar->maximum())
+        enabled = true;
+
+    // Calculate button color.
+    SkScalar trackHSV[3];
+    SkColorToHSV(RenderThemeChromiumLinux::trackColor(), trackHSV);
+    SkColor buttonColor = saturateAndBrighten(trackHSV, 0, 0.2);
+    SkColor backgroundColor = buttonColor;
+    if (part == scrollbar->pressedPart()) {
+        SkScalar buttonHSV[3];
+        SkColorToHSV(buttonColor, buttonHSV);
+        buttonColor = saturateAndBrighten(buttonHSV, 0, -0.1);
+    } else if (part == scrollbar->hoveredPart() && enabled) {
+        SkScalar buttonHSV[3];
+        SkColorToHSV(buttonColor, buttonHSV);
+        buttonColor = saturateAndBrighten(buttonHSV, 0, 0.05);
+    }
+
+    SkIRect skrect;
+    skrect.set(rect.x(), rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
+    // Paint the background (the area visible behind the rounded corners).
+    paint.setColor(backgroundColor);
+    canvas->drawIRect(skrect, paint);
+
+    // Paint the button's outline and fill the middle
+    SkPath outline;
+    switch (direction) {
+    case North:
+        outline.moveTo(rect.x() + 0.5, rect.y() + rect.height() + 0.5);
+        outline.rLineTo(0, -(rect.height() - 2));
+        outline.rLineTo(2, -2);
+        outline.rLineTo(rect.width() - 5, 0);
+        outline.rLineTo(2, 2);
+        outline.rLineTo(0, rect.height() - 2);
+        break;
+    case South:
+        outline.moveTo(rect.x() + 0.5, rect.y() - 0.5);
+        outline.rLineTo(0, rect.height() - 2);
+        outline.rLineTo(2, 2);
+        outline.rLineTo(rect.width() - 5, 0);
+        outline.rLineTo(2, -2);
+        outline.rLineTo(0, -(rect.height() - 2));
+        break;
+    case East:
+        outline.moveTo(rect.x() - 0.5, rect.y() + 0.5);
+        outline.rLineTo(rect.width() - 2, 0);
+        outline.rLineTo(2, 2);
+        outline.rLineTo(0, rect.height() - 5);
+        outline.rLineTo(-2, 2);
+        outline.rLineTo(-(rect.width() - 2), 0);
+        break;
+    case West:
+        outline.moveTo(rect.x() + rect.width() + 0.5, rect.y() + 0.5);
+        outline.rLineTo(-(rect.width() - 2), 0);
+        outline.rLineTo(-2, 2);
+        outline.rLineTo(0, rect.height() - 5);
+        outline.rLineTo(2, 2);
+        outline.rLineTo(rect.width() - 2, 0);
+        break;
+    }
+    outline.close();
+
+    paint.setStyle(SkPaint::kFill_Style);
+    paint.setColor(buttonColor);
+    canvas->drawPath(outline, paint);
+
+    paint.setAntiAlias(true);
+    paint.setStyle(SkPaint::kStroke_Style);
+    SkScalar thumbHSV[3];
+    SkColorToHSV(RenderThemeChromiumLinux::thumbInactiveColor(), thumbHSV);
+    paint.setColor(outlineColor(trackHSV, thumbHSV));
+    canvas->drawPath(outline, paint);
+
+    // If the button is disabled, the arrow is drawn with the outline color.
+    if (enabled)
+        paint.setColor(SK_ColorBLACK);
+
+    paint.setAntiAlias(false);
+    paint.setStyle(SkPaint::kFill_Style);
+
+    SkPath path;
+    // The constants in this block of code are hand-tailored to produce good
+    // looking arrows without anti-aliasing.
+    switch (direction) {
+    case North:
+        path.moveTo(rect.x() + widthMiddle - 4, rect.y() + lengthMiddle + 2);
+        path.rLineTo(7, 0);
+        path.rLineTo(-4, -4);
+        break;
+    case South:
+        path.moveTo(rect.x() + widthMiddle - 4, rect.y() + lengthMiddle - 3);
+        path.rLineTo(7, 0);
+        path.rLineTo(-4, 4);
+        break;
+    case East:
+        path.moveTo(rect.x() + lengthMiddle - 3, rect.y() + widthMiddle - 4);
+        path.rLineTo(0, 7);
+        path.rLineTo(4, -4);
+        break;
+    case West:
+        path.moveTo(rect.x() + lengthMiddle + 1, rect.y() + widthMiddle - 5);
+        path.rLineTo(0, 9);
+        path.rLineTo(-4, -4);
+        break;
+    }
+    path.close();
+
+    canvas->drawPath(path, paint);
 }
 
 void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect)
@@ -224,8 +351,11 @@ bool ScrollbarThemeChromiumLinux::shouldCenterOnThumb(Scrollbar*, const Platform
 
 IntSize ScrollbarThemeChromiumLinux::buttonSize(Scrollbar* scrollbar)
 {
-    // On Linux, we don't use buttons
-    return IntSize(0, 0);
+    if (scrollbar->orientation() == VerticalScrollbar)
+        return IntSize(scrollbarThicknessValue, buttonLength);
+
+    // HorizontalScrollbar
+    return IntSize(buttonLength, scrollbarThicknessValue);
 }
 
 int ScrollbarThemeChromiumLinux::minimumThumbLength(Scrollbar* scrollbar)
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp b/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
index d84ad5e..ba7e97b 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumWin.cpp
@@ -57,24 +57,6 @@ static const int kMacScrollbarSize[3] = { 15, 11, 15 };
 static const int kOffEndMultiplier = 3;
 static const int kOffSideMultiplier = 8;
 
-IntRect ScrollbarThemeChromium::trackRect(Scrollbar* scrollbar, bool)
-{
-    IntSize bs = buttonSize(scrollbar);
-    // The buttons at the top and bottom of the scrollbar are square, so the
-    // thickness of the scrollbar is also their height.
-    int thickness = scrollbarThickness(scrollbar->controlSize());
-    if (scrollbar->orientation() == HorizontalScrollbar) {
-        // Once the scrollbar becomes smaller than the natural size of the
-        // two buttons, the track disappears.
-        if (scrollbar->width() < 2 * thickness)
-            return IntRect();
-        return IntRect(scrollbar->x() + bs.width(), scrollbar->y(), scrollbar->width() - 2 * bs.width(), thickness);
-    }
-    if (scrollbar->height() < 2 * thickness)
-        return IntRect();
-    return IntRect(scrollbar->x(), scrollbar->y() + bs.height(), thickness, scrollbar->height() - 2 * bs.height());
-}
-
 int ScrollbarThemeChromiumWin::scrollbarThickness(ScrollbarControlSize controlSize)
 {
     static int thickness;
diff --git a/WebCore/platform/efl/RenderThemeEfl.cpp b/WebCore/platform/efl/RenderThemeEfl.cpp
index 6ed7599..d5a5365 100644
--- a/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -254,7 +254,7 @@ void RenderThemeEfl::applyEdjeStateFromForm(Evas_Object* o, ControlStates states
     }
 }
 
-bool RenderThemeEfl::paintThemePart(RenderObject* o, FormType type, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintThemePart(RenderObject* o, FormType type, const PaintInfo& i, const IntRect& rect)
 {
     struct ThemePartCacheEntry* ce;
     Eina_List* updates;
@@ -746,7 +746,7 @@ void RenderThemeEfl::adjustCheckboxStyle(CSSStyleSelector* selector, RenderStyle
         style->setHeight(desc->min.height());
 }
 
-bool RenderThemeEfl::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintCheckbox(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintThemePart(o, CheckBox, i, rect);
 }
@@ -767,7 +767,7 @@ void RenderThemeEfl::adjustRadioStyle(CSSStyleSelector* selector, RenderStyle* s
         style->setHeight(desc->min.height());
 }
 
-bool RenderThemeEfl::paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintRadio(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintThemePart(o, RadioButton, i, rect);
 }
@@ -790,7 +790,7 @@ void RenderThemeEfl::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle*
     }
 }
 
-bool RenderThemeEfl::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintThemePart(o, Button, i, rect);
 }
@@ -808,7 +808,7 @@ void RenderThemeEfl::adjustMenuListStyle(CSSStyleSelector* selector, RenderStyle
     style->setBackgroundColor(m_comboTextBackgroundColor);
 }
 
-bool RenderThemeEfl::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintThemePart(o, ComboBox, i, rect);
 }
@@ -826,7 +826,7 @@ void RenderThemeEfl::adjustTextFieldStyle(CSSStyleSelector* selector, RenderStyl
     style->setBackgroundColor(m_entryTextBackgroundColor);
 }
 
-bool RenderThemeEfl::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintTextField(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintThemePart(o, TextField, i, rect);
 }
@@ -836,7 +836,7 @@ void RenderThemeEfl::adjustTextAreaStyle(CSSStyleSelector* selector, RenderStyle
     adjustTextFieldStyle(selector, style, e);
 }
 
-bool RenderThemeEfl::paintTextArea(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeEfl::paintTextArea(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintTextField(o, i, r);
 }
@@ -852,7 +852,7 @@ void RenderThemeEfl::adjustSearchFieldDecorationStyle(CSSStyleSelector* selector
     style->setWhiteSpace(PRE);
 }
 
-bool RenderThemeEfl::paintSearchFieldDecoration(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintSearchFieldDecoration(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintThemePart(o, SearchFieldDecoration, i, rect);
 }
@@ -868,7 +868,7 @@ void RenderThemeEfl::adjustSearchFieldResultsButtonStyle(CSSStyleSelector* selec
     style->setWhiteSpace(PRE);
 }
 
-bool RenderThemeEfl::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintSearchFieldResultsButton(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintThemePart(o, SearchFieldResultsButton, i, rect);
 }
@@ -884,7 +884,7 @@ void RenderThemeEfl::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* s
     style->setWhiteSpace(PRE);
 }
 
-bool RenderThemeEfl::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintSearchFieldResultsDecoration(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintThemePart(o, SearchFieldResultsDecoration, i, rect);
 }
@@ -900,7 +900,7 @@ void RenderThemeEfl::adjustSearchFieldCancelButtonStyle(CSSStyleSelector* select
     style->setWhiteSpace(PRE);
 }
 
-bool RenderThemeEfl::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintThemePart(o, SearchFieldCancelButton, i, rect);
 }
@@ -918,7 +918,7 @@ void RenderThemeEfl::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderSt
     style->setBackgroundColor(m_searchTextBackgroundColor);
 }
 
-bool RenderThemeEfl::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeEfl::paintSearchField(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintThemePart(o, SearchField, i, rect);
 }
diff --git a/WebCore/platform/efl/RenderThemeEfl.h b/WebCore/platform/efl/RenderThemeEfl.h
index 22e0608..9753a76 100644
--- a/WebCore/platform/efl/RenderThemeEfl.h
+++ b/WebCore/platform/efl/RenderThemeEfl.h
@@ -103,37 +103,37 @@ public:
     virtual void systemFont(int propId, FontDescription&) const;
 
     virtual void adjustCheckboxStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintCheckbox(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustRadioStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintRadio(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&);
 
 private:
     void createCanvas();
@@ -142,7 +142,7 @@ private:
     void applyPartDescriptions();
     const char* edjeGroupFromFormType(FormType type) const;
     void applyEdjeStateFromForm(Evas_Object* o, ControlStates states);
-    bool paintThemePart(RenderObject* o, FormType type, const RenderObject::PaintInfo& i, const IntRect& rect);
+    bool paintThemePart(RenderObject* o, FormType type, const PaintInfo& i, const IntRect& rect);
 
     Page* m_page;
     Color m_activeSelectionBackgroundColor;
diff --git a/WebCore/platform/efl/SharedTimerEfl.cpp b/WebCore/platform/efl/SharedTimerEfl.cpp
index 122c8c3..437de64 100644
--- a/WebCore/platform/efl/SharedTimerEfl.cpp
+++ b/WebCore/platform/efl/SharedTimerEfl.cpp
@@ -45,7 +45,7 @@ void setSharedTimerFiredFunction(void (*func)())
     g_timerFunction = func;
 }
 
-static int timerEvent(void*)
+static Eina_Bool timerEvent(void*)
 {
     if (g_timerFunction)
         g_timerFunction();
diff --git a/WebCore/platform/graphics/FloatRect.h b/WebCore/platform/graphics/FloatRect.h
index b265121..2b23576 100644
--- a/WebCore/platform/graphics/FloatRect.h
+++ b/WebCore/platform/graphics/FloatRect.h
@@ -143,6 +143,7 @@ public:
 #if PLATFORM(QT)
     FloatRect(const QRectF&);
     operator QRectF() const;
+    FloatRect normalized() const;
 #endif
 
 #if PLATFORM(WX) && USE(WXGC)
diff --git a/WebCore/platform/graphics/GlyphMetricsMap.h b/WebCore/platform/graphics/GlyphMetricsMap.h
index 5e13afe..82e234b 100644
--- a/WebCore/platform/graphics/GlyphMetricsMap.h
+++ b/WebCore/platform/graphics/GlyphMetricsMap.h
@@ -29,6 +29,7 @@
 #ifndef GlyphMetricsMap_h
 #define GlyphMetricsMap_h
 
+#include <wtf/FixedArray.h>
 #include <wtf/HashMap.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/unicode/Unicode.h>
@@ -61,7 +62,7 @@ public:
 private:
     struct GlyphMetricsPage {
         static const size_t size = 256; // Usually covers Latin-1 in a single page.
-        T m_metrics[size];
+        FixedArray<T, size> m_metrics;
 
         T metricsForGlyph(Glyph glyph) const { return m_metrics[glyph % size]; }
         void setMetricsForGlyph(Glyph glyph, const T& metrics)
diff --git a/WebCore/platform/graphics/Gradient.h b/WebCore/platform/graphics/Gradient.h
index b526e51..c4ac01b 100644
--- a/WebCore/platform/graphics/Gradient.h
+++ b/WebCore/platform/graphics/Gradient.h
@@ -94,7 +94,7 @@ namespace WebCore {
         void getColor(float value, float* r, float* g, float* b, float* a) const;
 
         bool isRadial() const { return m_radial; }
-        bool isZeroSize() const { return m_p0.x() == m_p1.x() && m_p0.y() == m_p1.y(); }
+        bool isZeroSize() const { return m_p0.x() == m_p1.x() && m_p0.y() == m_p1.y() && (!m_radial || m_r0 == m_r1); }
 
 #if OS(WINCE) && !PLATFORM(QT)
         const FloatPoint& p0() const { return m_p0; }
diff --git a/WebCore/platform/graphics/GraphicsContext.h b/WebCore/platform/graphics/GraphicsContext.h
index 8bcfc06..457368b 100644
--- a/WebCore/platform/graphics/GraphicsContext.h
+++ b/WebCore/platform/graphics/GraphicsContext.h
@@ -274,6 +274,7 @@ namespace WebCore {
         void clipOutRoundedRect(const IntRect&, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight);
         void clipPath(WindRule);
         void clipToImageBuffer(const FloatRect&, const ImageBuffer*);
+        void clipConvexPolygon(size_t numPoints, const FloatPoint*);
 
         int textDrawingMode();
         void setTextDrawingMode(int);
diff --git a/WebCore/platform/graphics/GraphicsContext3D.cpp b/WebCore/platform/graphics/GraphicsContext3D.cpp
index dc70734..79f6ecf 100644
--- a/WebCore/platform/graphics/GraphicsContext3D.cpp
+++ b/WebCore/platform/graphics/GraphicsContext3D.cpp
@@ -30,6 +30,7 @@
 
 #include "GraphicsContext3D.h"
 
+#include "ArrayBufferView.h"
 #include "Image.h"
 #include "ImageData.h"
 
@@ -118,6 +119,7 @@ bool GraphicsContext3D::extractImageData(ImageData* imageData,
                     kSourceFormatRGBA8,
                     width,
                     height,
+                    0,
                     format,
                     type,
                     premultiplyAlpha ? kAlphaDoPremultiply : kAlphaDoNothing,
@@ -138,6 +140,72 @@ bool GraphicsContext3D::extractImageData(ImageData* imageData,
     return true;
 }
 
+bool GraphicsContext3D::extractTextureData(unsigned int width, unsigned int height,
+                                           unsigned int format, unsigned int type,
+                                           unsigned int unpackAlignment,
+                                           bool flipY, bool premultiplyAlpha,
+                                           ArrayBufferView* pixels,
+                                           Vector<uint8_t>& data)
+{
+    // Assumes format, type, etc. have already been validated.
+    SourceDataFormat sourceDataFormat = kSourceFormatRGBA8;
+    switch (type) {
+    case UNSIGNED_BYTE:
+        switch (format) {
+        case RGBA:
+            sourceDataFormat = kSourceFormatRGBA8;
+            break;
+        case RGB:
+            sourceDataFormat = kSourceFormatRGB8;
+            break;
+        case ALPHA:
+            sourceDataFormat = kSourceFormatA8;
+            break;
+        case LUMINANCE:
+            sourceDataFormat = kSourceFormatR8;
+            break;
+        case LUMINANCE_ALPHA:
+            sourceDataFormat = kSourceFormatRA8;
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+        break;
+    case UNSIGNED_SHORT_5_5_5_1:
+        sourceDataFormat = kSourceFormatRGBA5551;
+        break;
+    case UNSIGNED_SHORT_4_4_4_4:
+        sourceDataFormat = kSourceFormatRGBA4444;
+        break;
+    case UNSIGNED_SHORT_5_6_5:
+        sourceDataFormat = kSourceFormatRGB565;
+        break;
+    default:
+        ASSERT_NOT_REACHED();
+    }
+
+    // Resize the output buffer.
+    unsigned long componentsPerPixel, bytesPerComponent;
+    if (!computeFormatAndTypeParameters(format, type,
+                                        &componentsPerPixel,
+                                        &bytesPerComponent))
+        return false;
+    unsigned long bytesPerPixel = componentsPerPixel * bytesPerComponent;
+    data.resize(width * height * bytesPerPixel);
+
+    if (!packPixels(static_cast<uint8_t*>(pixels->baseAddress()),
+                    sourceDataFormat,
+                    width, height, unpackAlignment,
+                    format, type,
+                    (premultiplyAlpha ? kAlphaDoPremultiply : kAlphaDoNothing),
+                    data.data()))
+        return false;
+    // The pixel data is now tightly packed.
+    if (flipY)
+        flipVertically(data.data(), width, height, bytesPerPixel, 1);
+    return true;
+}
+
 void GraphicsContext3D::flipVertically(void* imageData,
                                        unsigned int width,
                                        unsigned int height,
@@ -150,7 +218,7 @@ void GraphicsContext3D::flipVertically(void* imageData,
     unsigned int totalRowBytes = validRowBytes;
     unsigned int remainder = validRowBytes % unpackAlignment;
     if (remainder)
-        totalRowBytes += remainder;
+        totalRowBytes += (unpackAlignment - remainder);
     uint8_t* tempRow = new uint8_t[validRowBytes];
     uint8_t* data = static_cast<uint8_t*>(imageData);
     for (unsigned i = 0; i < height / 2; i++) {
@@ -171,6 +239,14 @@ namespace {
 //----------------------------------------------------------------------
 // Pixel unpacking routines.
 
+void unpackRGBA8ToRGBA8(const uint8_t* source, uint8_t* destination)
+{
+    destination[0] = source[0];
+    destination[1] = source[1];
+    destination[2] = source[2];
+    destination[3] = source[3];
+}
+
 void unpackRGB8ToRGBA8(const uint8_t* source, uint8_t* destination)
 {
     destination[0] = source[0];
@@ -187,6 +263,67 @@ void unpackBGRA8ToRGBA8(const uint8_t* source, uint8_t* destination)
     destination[3] = source[3];
 }
 
+void unpackRGBA5551ToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    uint16_t packedValue = source[0];
+    uint8_t r = packedValue >> 11;
+    uint8_t g = (packedValue >> 6) & 0x1F;
+    uint8_t b = (packedValue >> 1) & 0x1F;
+    destination[0] = (r << 3) | (r & 0x7);
+    destination[1] = (g << 3) | (g & 0x7);
+    destination[2] = (b << 3) | (b & 0x7);
+    destination[3] = (packedValue & 0x1) ? 0xFF : 0x0;
+}
+
+void unpackRGBA4444ToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    uint16_t packedValue = source[0];
+    uint8_t r = packedValue >> 12;
+    uint8_t g = (packedValue >> 8) & 0x0F;
+    uint8_t b = (packedValue >> 4) & 0x0F;
+    uint8_t a = packedValue & 0x0F;
+    destination[0] = r << 4 | r;
+    destination[1] = g << 4 | g;
+    destination[2] = b << 4 | b;
+    destination[3] = a << 4 | a;
+}
+
+void unpackRGB565ToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    uint16_t packedValue = source[0];
+    uint8_t r = packedValue >> 11;
+    uint8_t g = (packedValue >> 5) & 0x3F;
+    uint8_t b = packedValue & 0x1F;
+    destination[0] = (r << 3) | (r & 0x7);
+    destination[1] = (g << 2) | (g & 0x3);
+    destination[2] = (b << 3) | (b & 0x7);
+    destination[3] = 0xFF;
+}
+
+void unpackR8ToRGBA8(const uint8_t* source, uint8_t* destination)
+{
+    destination[0] = source[0];
+    destination[1] = source[0];
+    destination[2] = source[0];
+    destination[3] = 0xFF;
+}
+
+void unpackRA8ToRGBA8(const uint8_t* source, uint8_t* destination)
+{
+    destination[0] = source[0];
+    destination[1] = source[0];
+    destination[2] = source[0];
+    destination[3] = source[1];
+}
+
+void unpackA8ToRGBA8(const uint8_t* source, uint8_t* destination)
+{
+    destination[0] = 0x0;
+    destination[1] = 0x0;
+    destination[2] = 0x0;
+    destination[3] = source[0];
+}
+
 //----------------------------------------------------------------------
 // Pixel packing routines.
 //
@@ -401,51 +538,141 @@ void packRGBA8ToUnsignedShort565Unmultiply(const uint8_t* source, uint16_t* dest
 } // anonymous namespace
 
 // This is used whenever unpacking is necessary; i.e., the source data
-// is not in RGBA8 format.
+// is not in RGBA8 format, or the unpack alignment specifies that rows
+// are not tightly packed.
 template<typename SourceType, typename DestType,
          void unpackingFunc(const SourceType*, uint8_t*),
          void packingFunc(const uint8_t*, DestType*)>
 static void doUnpackingAndPacking(const SourceType* sourceData,
-                                  unsigned int numElements,
+                                  unsigned int width,
+                                  unsigned int height,
                                   unsigned int sourceElementsPerPixel,
+                                  unsigned int sourceElementsPerRow,
                                   DestType* destinationData,
                                   unsigned int destinationElementsPerPixel)
 {
-    const SourceType* endPointer = sourceData + numElements;
-    uint8_t temporaryRGBAData[4];
-    while (sourceData < endPointer) {
-        unpackingFunc(sourceData, temporaryRGBAData);
-        packingFunc(temporaryRGBAData, destinationData);
-        sourceData += sourceElementsPerPixel;
-        destinationData += destinationElementsPerPixel;
+    if (!sourceElementsPerRow) {
+        unsigned int numElements = width * height * sourceElementsPerPixel;
+        const SourceType* endPointer = sourceData + numElements;
+        uint8_t temporaryRGBAData[4];
+        while (sourceData < endPointer) {
+            unpackingFunc(sourceData, temporaryRGBAData);
+            packingFunc(temporaryRGBAData, destinationData);
+            sourceData += sourceElementsPerPixel;
+            destinationData += destinationElementsPerPixel;
+        }
+    } else {
+        uint8_t temporaryRGBAData[4];
+        for (unsigned int y = 0; y < height; ++y) {
+            const SourceType* currentSource = sourceData;
+            for (unsigned int x = 0; x < width; ++x) {
+                unpackingFunc(currentSource, temporaryRGBAData);
+                packingFunc(temporaryRGBAData, destinationData);
+                currentSource += sourceElementsPerPixel;
+                destinationData += destinationElementsPerPixel;
+            }
+            sourceData += sourceElementsPerRow;
+        }
+    }
+}
+
+template<typename SourceType>
+static void computeIncrementParameters(unsigned int width,
+                                       unsigned int bytesPerPixel,
+                                       unsigned int unpackAlignment,
+                                       unsigned int* sourceElementsPerPixel,
+                                       unsigned int* sourceElementsPerRow)
+{
+    unsigned int elementSizeInBytes = sizeof(SourceType);
+    ASSERT(elementSizeInBytes <= bytesPerPixel);
+    unsigned int validRowBytes = width * bytesPerPixel;
+    unsigned int totalRowBytes = validRowBytes;
+    if (unpackAlignment) {
+        unsigned int remainder = validRowBytes % unpackAlignment;
+        if (remainder)
+            totalRowBytes += (unpackAlignment - remainder);
     }
+    *sourceElementsPerPixel = bytesPerPixel / elementSizeInBytes;
+    if (validRowBytes == totalRowBytes)
+        *sourceElementsPerRow = 0;
+    else
+        *sourceElementsPerRow = totalRowBytes / elementSizeInBytes;
 }
 
-// This handles all conversions with a faster path for RGBA8 source data.
-template<typename SourceType, typename DestType, void packingFunc(const SourceType*, DestType*)>
-static void doPacking(const SourceType* sourceData,
+// This handles all conversions with a faster path for tightly packed RGBA8 source data.
+template<typename DestType, void packingFunc(const uint8_t*, DestType*)>
+static void doPacking(const void* sourceData,
                       GraphicsContext3D::SourceDataFormat sourceDataFormat,
-                      unsigned int numElements,
-                      unsigned int sourceElementsPerPixel,
+                      unsigned int width,
+                      unsigned int height,
+                      unsigned int sourceUnpackAlignment,
                       DestType* destinationData,
                       unsigned int destinationElementsPerPixel)
 {
     switch (sourceDataFormat) {
     case GraphicsContext3D::kSourceFormatRGBA8: {
-        const SourceType* endPointer = sourceData + numElements;
-        while (sourceData < endPointer) {
-            packingFunc(sourceData, destinationData);
-            sourceData += sourceElementsPerPixel;
-            destinationData += destinationElementsPerPixel;
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint8_t>(width, 4, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        if (!sourceElementsPerRow) {
+            const uint8_t* source = static_cast<const uint8_t*>(sourceData);
+            unsigned int numElements = width * height * 4;
+            const uint8_t* endPointer = source + numElements;
+            while (source < endPointer) {
+                packingFunc(source, destinationData);
+                source += sourceElementsPerPixel;
+                destinationData += destinationElementsPerPixel;
+            }
+        } else {
+            doUnpackingAndPacking<uint8_t, DestType, unpackRGBA8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
         }
         break;
     }
     case GraphicsContext3D::kSourceFormatRGB8: {
-        doUnpackingAndPacking<SourceType, DestType, unpackRGB8ToRGBA8, packingFunc>(sourceData, numElements, sourceElementsPerPixel, destinationData, destinationElementsPerPixel);
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint8_t>(width, 3, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint8_t, DestType, unpackRGB8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
         break;
     }
     case GraphicsContext3D::kSourceFormatBGRA8: {
-        doUnpackingAndPacking<SourceType, DestType, unpackBGRA8ToRGBA8, packingFunc>(sourceData, numElements, sourceElementsPerPixel, destinationData, destinationElementsPerPixel);
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint8_t>(width, 4, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint8_t, DestType, unpackBGRA8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatRGBA5551: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackRGBA5551ToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatRGBA4444: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackRGBA4444ToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatRGB565: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackRGB565ToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatR8: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint8_t>(width, 1, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint8_t, DestType, unpackR8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatRA8: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint8_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint8_t, DestType, unpackRA8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatA8: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint8_t>(width, 1, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint8_t, DestType, unpackA8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
         break;
     }
     }
@@ -455,46 +682,45 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
                                    GraphicsContext3D::SourceDataFormat sourceDataFormat,
                                    unsigned int width,
                                    unsigned int height,
+                                   unsigned int sourceUnpackAlignment,
                                    unsigned int destinationFormat,
                                    unsigned int destinationType,
                                    AlphaOp alphaOp,
                                    void* destinationData)
 {
-    unsigned int sourceElementsPerPixel = 4;
-    unsigned int numElements = width * height * sourceElementsPerPixel;
     switch (destinationType) {
     case UNSIGNED_BYTE: {
         uint8_t* destination = static_cast<uint8_t*>(destinationData);
-        if (sourceDataFormat == kSourceFormatRGBA8 && destinationFormat == RGBA && alphaOp == kAlphaDoNothing) {
+        if (sourceDataFormat == kSourceFormatRGBA8 && destinationFormat == RGBA && sourceUnpackAlignment <= 4 && alphaOp == kAlphaDoNothing) {
             // No conversion necessary.
-            memcpy(destinationData, sourceData, numElements);
+            memcpy(destinationData, sourceData, width * height * 4);
             break;
         }
         switch (destinationFormat) {
         case RGB:
             switch (alphaOp) {
             case kAlphaDoNothing:
-                doPacking<uint8_t, uint8_t, packRGBA8ToRGB8>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 3);
+                doPacking<uint8_t, packRGBA8ToRGB8>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 3);
                 break;
             case kAlphaDoPremultiply:
-                doPacking<uint8_t, uint8_t, packRGBA8ToRGB8Premultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 3);
+                doPacking<uint8_t, packRGBA8ToRGB8Premultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 3);
                 break;
             case kAlphaDoUnmultiply:
-                doPacking<uint8_t, uint8_t, packRGBA8ToRGB8Unmultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 3);
+                doPacking<uint8_t, packRGBA8ToRGB8Unmultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 3);
                 break;
             }
             break;
         case RGBA:
             switch (alphaOp) {
             case kAlphaDoNothing:
-                ASSERT(sourceDataFormat != kSourceFormatRGBA8); // Handled above with fast case.
-                doPacking<uint8_t, uint8_t, packRGBA8ToRGBA8>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 4);
+                ASSERT(sourceDataFormat != kSourceFormatRGBA8 || sourceUnpackAlignment > 4); // Handled above with fast case.
+                doPacking<uint8_t, packRGBA8ToRGBA8>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 4);
                 break;
             case kAlphaDoPremultiply:
-                doPacking<uint8_t, uint8_t, packRGBA8ToRGBA8Premultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 4);
+                doPacking<uint8_t, packRGBA8ToRGBA8Premultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 4);
                 break;
             case kAlphaDoUnmultiply:
-                doPacking<uint8_t, uint8_t, packRGBA8ToRGBA8Unmultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 4);
+                doPacking<uint8_t, packRGBA8ToRGBA8Unmultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 4);
                 break;
             default:
                 ASSERT_NOT_REACHED();
@@ -504,7 +730,7 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
             // From the desktop OpenGL conversion rules (OpenGL 2.1
             // specification, Table 3.15), the alpha channel is chosen
             // from the RGBA data.
-            doPacking<uint8_t, uint8_t, packRGBA8ToA8>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+            doPacking<uint8_t, packRGBA8ToA8>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
             break;
         case LUMINANCE:
             // From the desktop OpenGL conversion rules (OpenGL 2.1
@@ -512,13 +738,13 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
             // from the RGBA data.
             switch (alphaOp) {
             case kAlphaDoNothing:
-                doPacking<uint8_t, uint8_t, packRGBA8ToR8>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+                doPacking<uint8_t, packRGBA8ToR8>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
                 break;
             case kAlphaDoPremultiply:
-                doPacking<uint8_t, uint8_t, packRGBA8ToR8Premultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+                doPacking<uint8_t, packRGBA8ToR8Premultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
                 break;
             case kAlphaDoUnmultiply:
-                doPacking<uint8_t, uint8_t, packRGBA8ToR8Unmultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+                doPacking<uint8_t, packRGBA8ToR8Unmultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
                 break;
             }
             break;
@@ -528,13 +754,13 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
             // are chosen from the RGBA data.
             switch (alphaOp) {
             case kAlphaDoNothing:
-                doPacking<uint8_t, uint8_t, packRGBA8ToRA8>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 2);
+                doPacking<uint8_t, packRGBA8ToRA8>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 2);
                 break;
             case kAlphaDoPremultiply:
-                doPacking<uint8_t, uint8_t, packRGBA8ToRA8Premultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 2);
+                doPacking<uint8_t, packRGBA8ToRA8Premultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 2);
                 break;
             case kAlphaDoUnmultiply:
-                doPacking<uint8_t, uint8_t, packRGBA8ToRA8Unmultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 2);
+                doPacking<uint8_t, packRGBA8ToRA8Unmultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 2);
                 break;
             }
             break;
@@ -545,13 +771,13 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
         uint16_t* destination = static_cast<uint16_t*>(destinationData);
         switch (alphaOp) {
         case kAlphaDoNothing:
-            doPacking<uint8_t, uint16_t, packRGBA8ToUnsignedShort4444>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+            doPacking<uint16_t, packRGBA8ToUnsignedShort4444>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
             break;
         case kAlphaDoPremultiply:
-            doPacking<uint8_t, uint16_t, packRGBA8ToUnsignedShort4444Premultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+            doPacking<uint16_t, packRGBA8ToUnsignedShort4444Premultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
             break;
         case kAlphaDoUnmultiply:
-            doPacking<uint8_t, uint16_t, packRGBA8ToUnsignedShort4444Unmultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+            doPacking<uint16_t, packRGBA8ToUnsignedShort4444Unmultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
             break;
         }
         break;
@@ -560,13 +786,13 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
         uint16_t* destination = static_cast<uint16_t*>(destinationData);
         switch (alphaOp) {
         case kAlphaDoNothing:
-            doPacking<uint8_t, uint16_t, packRGBA8ToUnsignedShort5551>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+            doPacking<uint16_t, packRGBA8ToUnsignedShort5551>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
             break;
         case kAlphaDoPremultiply:
-            doPacking<uint8_t, uint16_t, packRGBA8ToUnsignedShort5551Premultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+            doPacking<uint16_t, packRGBA8ToUnsignedShort5551Premultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
             break;
         case kAlphaDoUnmultiply:
-            doPacking<uint8_t, uint16_t, packRGBA8ToUnsignedShort5551Unmultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+            doPacking<uint16_t, packRGBA8ToUnsignedShort5551Unmultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
             break;
         }
         break;
@@ -575,13 +801,13 @@ bool GraphicsContext3D::packPixels(const uint8_t* sourceData,
         uint16_t* destination = static_cast<uint16_t*>(destinationData);
         switch (alphaOp) {
         case kAlphaDoNothing:
-            doPacking<uint8_t, uint16_t, packRGBA8ToUnsignedShort565>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+            doPacking<uint16_t, packRGBA8ToUnsignedShort565>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
             break;
         case kAlphaDoPremultiply:
-            doPacking<uint8_t, uint16_t, packRGBA8ToUnsignedShort565Premultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+            doPacking<uint16_t, packRGBA8ToUnsignedShort565Premultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
             break;
         case kAlphaDoUnmultiply:
-            doPacking<uint8_t, uint16_t, packRGBA8ToUnsignedShort565Unmultiply>(sourceData, sourceDataFormat, numElements, sourceElementsPerPixel, destination, 1);
+            doPacking<uint16_t, packRGBA8ToUnsignedShort565Unmultiply>(sourceData, sourceDataFormat, width, height, sourceUnpackAlignment, destination, 1);
             break;
         }
         break;
diff --git a/WebCore/platform/graphics/GraphicsContext3D.h b/WebCore/platform/graphics/GraphicsContext3D.h
index 981459f..882362f 100644
--- a/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/WebCore/platform/graphics/GraphicsContext3D.h
@@ -436,9 +436,7 @@ namespace WebCore {
         PlatformGraphicsContext3D platformGraphicsContext3D() const;
         Platform3DObject platformTexture() const;
 #if USE(ACCELERATED_COMPOSITING)
-        // FIXME: Stubbed out for now. Must be implemented to get WebGL working with
-        // accelerated compositing.
-        PlatformLayer* platformLayer() const { return 0; }
+        PlatformLayer* platformLayer() const;
 #endif
 #elif PLATFORM(QT)
         PlatformGraphicsContext3D platformGraphicsContext3D();
@@ -455,7 +453,7 @@ namespace WebCore {
 #endif
         void makeContextCurrent();
 
-#if PLATFORM(MAC)
+#if PLATFORM(MAC) || PLATFORM(CHROMIUM)
         // With multisampling on, blit from multisampleFBO to regular FBO.
         void prepareTexture();
 #endif
@@ -500,6 +498,18 @@ namespace WebCore {
                               bool premultiplyAlpha,
                               Vector<uint8_t>& data);
 
+        // Helper function which extracts the user-supplied texture
+        // data, applying the flipY and premultiplyAlpha parameters.
+        // If the data is not tightly packed according to the passed
+        // unpackAlignment, the output data will be tightly packed.
+        // Returns true if successful, false if any error occurred.
+        bool extractTextureData(unsigned int width, unsigned int height,
+                                unsigned int format, unsigned int type,
+                                unsigned int unpackAlignment,
+                                bool flipY, bool premultiplyAlpha,
+                                ArrayBufferView* pixels,
+                                Vector<uint8_t>& data);
+
         // Flips the given image data vertically, in-place.
         void flipVertically(void* imageData,
                             unsigned int width,
@@ -514,7 +524,13 @@ namespace WebCore {
         enum SourceDataFormat {
             kSourceFormatRGBA8,
             kSourceFormatRGB8,
-            kSourceFormatBGRA8
+            kSourceFormatBGRA8,
+            kSourceFormatRGBA5551,
+            kSourceFormatRGBA4444,
+            kSourceFormatRGB565,
+            kSourceFormatR8,
+            kSourceFormatRA8,
+            kSourceFormatA8
         };
 
         //----------------------------------------------------------------------
@@ -573,6 +589,8 @@ namespace WebCore {
         bool getActiveAttrib(WebGLProgram* program, unsigned long index, ActiveInfo&);
         bool getActiveUniform(WebGLProgram* program, unsigned long index, ActiveInfo&);
 
+        void getAttachedShaders(WebGLProgram* program, int maxCount, int* count, unsigned int* shaders);
+
         int  getAttribLocation(WebGLProgram*, const String& name);
 
         void getBooleanv(unsigned long pname, unsigned char* value);
@@ -758,12 +776,14 @@ namespace WebCore {
 
         // Helper for getImageData which implements packing of pixel
         // data into the specified OpenGL destination format and type.
-        // Source data must be in RGBA format with no gaps between
-        // rows. Destination data will have no gaps between rows.
+        // A sourceUnpackAlignment of zero indicates that the source
+        // data is tightly packed. Non-zero values may take a slow path.
+        // Destination data will have no gaps between rows.
         bool packPixels(const uint8_t* sourceData,
                         SourceDataFormat sourceDataFormat,
                         unsigned int width,
                         unsigned int height,
+                        unsigned int sourceUnpackAlignment,
                         unsigned int destinationFormat,
                         unsigned int destinationType,
                         AlphaOp alphaOp,
diff --git a/WebCore/platform/graphics/GraphicsLayer.h b/WebCore/platform/graphics/GraphicsLayer.h
index 4338d89..b5797fd 100644
--- a/WebCore/platform/graphics/GraphicsLayer.h
+++ b/WebCore/platform/graphics/GraphicsLayer.h
@@ -343,8 +343,10 @@ public:
     virtual float accumulatedOpacity() const;
 
     // Some compositing systems may do internal batching to synchronize compositing updates
-    // with updates drawn into the window. This is a signal to flush any internal batched state.
+    // with updates drawn into the window. These methods flush internal batched state on this layer
+    // and descendant layers, and this layer only.
     virtual void syncCompositingState() { }
+    virtual void syncCompositingStateForThisLayerOnly() { }
     
     // Return a string with a human readable form of the layer tree, If debug is true 
     // pointers for the layers and timing data will be included in the returned string.
diff --git a/WebCore/platform/graphics/IntRect.h b/WebCore/platform/graphics/IntRect.h
index ad90dd9..c5990ef 100644
--- a/WebCore/platform/graphics/IntRect.h
+++ b/WebCore/platform/graphics/IntRect.h
@@ -48,7 +48,12 @@ QT_BEGIN_NAMESPACE
 class QRect;
 QT_END_NAMESPACE
 #elif PLATFORM(GTK)
+#ifdef GTK_API_VERSION_2
 typedef struct _GdkRectangle GdkRectangle;
+#else
+typedef struct _cairo_rectangle_int cairo_rectangle_int_t;
+typedef cairo_rectangle_int_t GdkRectangle;
+#endif
 #elif PLATFORM(HAIKU)
 class BRect;
 #endif
diff --git a/WebCore/platform/graphics/TextRun.h b/WebCore/platform/graphics/TextRun.h
index b5cd42a..79b6cb3 100644
--- a/WebCore/platform/graphics/TextRun.h
+++ b/WebCore/platform/graphics/TextRun.h
@@ -39,7 +39,9 @@ public:
         , m_len(len)
         , m_xpos(xpos)
         , m_padding(padding)
-        , m_glyphScale(1.0f)
+#if ENABLE(SVG)
+        , m_horizontalGlyphStretch(1)
+#endif
         , m_allowTabs(allowTabs)
         , m_rtl(rtl)
         , m_directionalOverride(directionalOverride)
@@ -59,7 +61,9 @@ public:
         , m_len(s.length())
         , m_xpos(xpos)
         , m_padding(padding)
-        , m_glyphScale(1.0f)
+#if ENABLE(SVG)
+        , m_horizontalGlyphStretch(1)
+#endif
         , m_allowTabs(allowTabs)
         , m_rtl(rtl)
         , m_directionalOverride(directionalOverride)
@@ -81,8 +85,10 @@ public:
 
     void setText(const UChar* c, int len) { m_characters = c; m_len = len; }
 
-    float glyphScale() const { return m_glyphScale; }
-    void setGlyphScale(float scale) { m_glyphScale = scale; }
+#if ENABLE(SVG)
+    float horizontalGlyphStretch() const { return m_horizontalGlyphStretch; }
+    void setHorizontalGlyphStretch(float scale) { m_horizontalGlyphStretch = scale; }
+#endif
 
     bool allowTabs() const { return m_allowTabs; }
     int xPos() const { return m_xpos; }
@@ -93,7 +99,6 @@ public:
     bool applyRunRounding() const { return m_applyRunRounding; }
     bool applyWordRounding() const { return m_applyWordRounding; }
     bool spacingDisabled() const { return m_disableSpacing; }
-    bool applyGlyphScaling() const { return m_glyphScale != 1.0f; }
 
     void disableSpacing() { m_disableSpacing = true; }
     void disableRoundingHacks() { m_applyRunRounding = m_applyWordRounding = false; }
@@ -114,7 +119,9 @@ private:
 
     int m_xpos;
     int m_padding;
-    float m_glyphScale;
+#if ENABLE(SVG)
+    float m_horizontalGlyphStretch;
+#endif
     bool m_allowTabs;
     bool m_rtl;
     bool m_directionalOverride;
diff --git a/WebCore/platform/graphics/WidthIterator.cpp b/WebCore/platform/graphics/WidthIterator.cpp
index 0814d48..827cd10 100644
--- a/WebCore/platform/graphics/WidthIterator.cpp
+++ b/WebCore/platform/graphics/WidthIterator.cpp
@@ -135,9 +135,10 @@ void WidthIterator::advance(int offset, GlyphBuffer* glyphBuffer)
         } else {
             width = fontData->widthForGlyph(glyph);
 
-            // SVG uses glyphScale(), when textLength is used to stretch/squeeze text.
-            if (m_run.applyGlyphScaling())
-                width *= m_run.glyphScale();
+#if ENABLE(SVG)
+            // SVG uses horizontalGlyphStretch(), when textLength is used to stretch/squeeze text.
+            width *= m_run.horizontalGlyphStretch();
+#endif
 
             // We special case spaces in two ways when applying word rounding.
             // First, we round spaces to an adjusted width in all fonts.
diff --git a/WebCore/platform/graphics/cairo/DrawErrorUnderline.h b/WebCore/platform/graphics/cairo/DrawErrorUnderline.h
new file mode 100644
index 0000000..9776853
--- /dev/null
+++ b/WebCore/platform/graphics/cairo/DrawErrorUnderline.h
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2004 Red Hat, Inc.
+ * Copyright (C) 2010 Brent Fulgham <bfulgham@webkit.org>
+ *
+ * Based on Pango sources (see pangocairo-render.c)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public
+ * License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#if PLATFORM(CAIRO)
+
+#include <cairo.h>
+
+//
+// Draws an error underline that looks like one of:
+//
+//              H       E                H
+//     /\      /\      /\        /\      /\               -
+//   A/  \    /  \    /  \     A/  \    /  \              |
+//    \   \  /    \  /   /D     \   \  /    \             |
+//     \   \/  C   \/   /        \   \/   C  \            | height = heightSquares * square
+//      \      /\  F   /          \  F   /\   \           |
+//       \    /  \    /            \    /  \   \G         |
+//        \  /    \  /              \  /    \  /          |
+//         \/      \/                \/      \/           -
+//         B                         B
+//         |---|
+//       unitWidth = (heightSquares - 1) * square
+//
+// The x, y, width, height passed in give the desired bounding box;
+// x/width are adjusted to make the underline a integer number of units
+// wide.
+//
+static inline void drawErrorUnderline(cairo_t* cr, double x, double y, double width, double height)
+{
+    static const double heightSquares = 2.5;
+
+    double square = height / heightSquares;
+    double halfSquare = 0.5 * square;
+
+    double unitWidth = (heightSquares - 1.0) * square;
+    int widthUnits = static_cast<int>(0.5 * (width + unitWidth) / unitWidth);
+
+    x += 0.5 * (width - widthUnits * unitWidth);
+    width = widthUnits * unitWidth;
+
+    double bottom = y + height;
+    double top = y;
+
+    // Bottom of squiggle
+    cairo_move_to(cr, x - halfSquare, top + halfSquare); // A
+
+    int i = 0;
+    for (i = 0; i < widthUnits; i += 2) {
+        double middle = x + (i + 1) * unitWidth;
+        double right = x + (i + 2) * unitWidth;
+
+        cairo_line_to(cr, middle, bottom); // B
+
+        if (i + 2 == widthUnits)
+            cairo_line_to(cr, right + halfSquare, top + halfSquare); // D
+        else if (i + 1 != widthUnits)
+            cairo_line_to(cr, right, top + square); // C
+    }
+
+    // Top of squiggle
+    for (i -= 2; i >= 0; i -= 2) {
+        double left = x + i * unitWidth;
+        double middle = x + (i + 1) * unitWidth;
+        double right = x + (i + 2) * unitWidth;
+
+        if (i + 1 == widthUnits)
+            cairo_line_to(cr, middle + halfSquare, bottom - halfSquare); // G
+        else {
+            if (i + 2 == widthUnits)
+                cairo_line_to(cr, right, top); // E
+
+            cairo_line_to(cr, middle, bottom - halfSquare); // F
+        }
+
+        cairo_line_to(cr, left, top); // H
+    }
+}
+
+#endif
diff --git a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index 50564c5..e8324a3 100644
--- a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -504,6 +504,17 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     cairo_restore(cr);
 }
 
+void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* points)
+{
+    if (paintingDisabled())
+        return;
+
+    if (numPoints <= 1)
+        return;
+    
+    // FIXME: IMPLEMENT!
+}
+
 void GraphicsContext::fillPath()
 {
     if (paintingDisabled())
@@ -632,13 +643,27 @@ void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int
     cairo_new_path(cr);
 
 #if PLATFORM(GTK)
+#ifdef GTK_API_VERSION_2
     GdkRegion* reg = gdk_region_new();
+#else
+    cairo_region_t* reg = cairo_region_create();
+#endif
+
     for (unsigned i = 0; i < rectCount; i++) {
+#ifdef GTK_API_VERSION_2
         GdkRectangle rect = rects[i];
         gdk_region_union_with_rect(reg, &rect);
+#else
+        cairo_rectangle_int_t rect = rects[i];
+        cairo_region_union_rectangle(reg, &rect);
+#endif
     }
     gdk_cairo_region(cr, reg);
+#ifdef GTK_API_VERSION_2
     gdk_region_destroy(reg);
+#else
+    cairo_region_destroy(reg);
+#endif
 
     setColor(cr, color);
     cairo_set_line_width(cr, 2.0f);
@@ -683,6 +708,10 @@ void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool pr
     setStrokeStyle(savedStrokeStyle);
 }
 
+#if !PLATFORM(GTK)
+#include "DrawErrorUnderline.h"
+#endif
+
 void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint& origin, int width, bool grammar)
 {
     if (paintingDisabled())
@@ -702,7 +731,7 @@ void GraphicsContext::drawLineForMisspellingOrBadGrammar(const IntPoint& origin,
     // We ignore most of the provided constants in favour of the platform style
     pango_cairo_show_error_underline(cr, origin.x(), origin.y(), width, cMisspellingLineThickness);
 #else
-    notImplemented();
+    drawErrorUnderline(cr, origin.x(), origin.y(), width, cMisspellingLineThickness);
 #endif
 
     cairo_restore(cr);
diff --git a/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp b/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
index 5c03a86..9f0f353 100644
--- a/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
@@ -100,7 +100,7 @@ bool GraphicsContext3D::getImageData(Image* image,
     if (!premultiplyAlpha && hasAlphaChannel)
         // FIXME: must fetch the image data before the premultiplication step.
         neededAlphaOp = kAlphaDoUnmultiply;
-    return packPixels(tempVector.data(), kSourceFormatRGBA8, width, height,
+    return packPixels(tempVector.data(), kSourceFormatRGBA8, width, height, 0,
                       format, type, neededAlphaOp, outputVector.data());
 }
 
diff --git a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index 5a903dc..a65874c 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -440,6 +440,15 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
     CGContextRestoreGState(context);
 }
 
+static void addConvexPolygonToContext(CGContextRef context, size_t numPoints, const FloatPoint* points)
+{
+    CGContextBeginPath(context);
+    CGContextMoveToPoint(context, points[0].x(), points[0].y());
+    for (size_t i = 1; i < numPoints; i++)
+        CGContextAddLineToPoint(context, points[i].x(), points[i].y());
+    CGContextClosePath(context);
+}
+
 void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points, bool antialiased)
 {
     if (paintingDisabled())
@@ -453,18 +462,25 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     if (antialiased != shouldAntialias())
         CGContextSetShouldAntialias(context, antialiased);
 
-    CGContextBeginPath(context);
-    CGContextMoveToPoint(context, points[0].x(), points[0].y());
-    for (size_t i = 1; i < npoints; i++)
-        CGContextAddLineToPoint(context, points[i].x(), points[i].y());
-    CGContextClosePath(context);
-
+    addConvexPolygonToContext(context, npoints, points);
     drawPath();
 
     if (antialiased != shouldAntialias())
         CGContextSetShouldAntialias(context, shouldAntialias());
 }
 
+void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* points)
+{
+    if (paintingDisabled())
+        return;
+
+    if (numPoints <= 1)
+        return;
+    
+    addConvexPolygonToContext(platformContext(), numPoints, points);
+    clipPath(RULE_NONZERO);
+}
+
 void GraphicsContext::applyStrokePattern()
 {
     CGContextRef cgContext = platformContext();
diff --git a/WebCore/platform/graphics/chromium/FontPlatformDataChromiumMac.mm b/WebCore/platform/graphics/chromium/FontPlatformDataChromiumMac.mm
new file mode 100644
index 0000000..41f684e
--- /dev/null
+++ b/WebCore/platform/graphics/chromium/FontPlatformDataChromiumMac.mm
@@ -0,0 +1,447 @@
+/*
+ * This file is part of the internal font implementation.
+ *
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (c) 2010 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+// This file is a clone of platform/graphics/mac/FontPlatformDataMac.mm.
+// Because we want to support loading fonts between processes in the face of
+// font loading being blocked by the sandbox, we must maintain a fork.
+// Please maintain this file by performing parallel changes to it.
+//
+// The only changes from FontPlatformDataMac should be:
+// - The functions at the top of this file for loading and caching fonts
+//   cross-process.
+// - Changes to FontPlatformData::FontPlatformData(NSFont,bool,bool)
+// - Changes to FontPlatformData::setFont()
+// - Changes to FontPlatformData::~FontPlatformData()
+// - Calls to refMemoryFont() in FontPlatformData::operator= and copy
+// constructor.
+//
+// All changes are marked with "Start/End Chromium Change"
+//
+// For all other differences, if it was introduced in this file, then the
+// maintainer forgot to include it in the list; otherwise it is an update that
+// should have been applied to this file but was not.
+
+
+// Start Chromium Change
+#import "config.h"
+#import "../graphics/mac/FontPlatformData.h"
+
+#import "ChromiumBridge.h"
+#import "PlatformString.h"
+#import "WebCoreSystemInterface.h"
+#import <AppKit/NSFont.h>
+#import <wtf/HashMap.h>
+#import <wtf/RefCounted.h>
+#import <wtf/RetainPtr.h>
+#import <wtf/Vector.h>
+
+namespace WebCore {
+
+namespace {
+
+class MemoryActivatedFont;
+typedef HashMap<ATSFontRef, MemoryActivatedFont*> FontRefMemoryFontHash;
+typedef HashMap<ATSFontContainerRef, MemoryActivatedFont*> FontContainerRefMemoryFontHash;
+
+// On 10.5, font loading is not blocked by the sandbox and thus there is no
+// need for the cross-process font loading mechanim.
+// On system versions >=10.6 cross-process font loading is required.
+bool OutOfProcessFontLoadingEnabled()
+{
+    static SInt32 systemVersion = 0;
+    if (!systemVersion) {
+        if (Gestalt(gestaltSystemVersion, &systemVersion) != noErr)
+            return false;
+    }
+
+    return systemVersion >= 0x1060;
+}
+
+FontContainerRefMemoryFontHash& fontCacheBySrcFontContainerRef()
+{
+    DEFINE_STATIC_LOCAL(FontContainerRefMemoryFontHash, srcFontRefCache, ());
+    return srcFontRefCache;
+}
+
+FontRefMemoryFontHash& fontCacheByActualFontRef()
+{
+    DEFINE_STATIC_LOCAL(FontRefMemoryFontHash, realFontRefCache, ());
+    return realFontRefCache;
+}
+
+ATSFontContainerRef fontContainerRefFromNSFont(NSFont* srcFont)
+{
+    ATSFontRef fontRef = CTFontGetPlatformFont(toCTFontRef(srcFont), 0);
+    if (!fontRef)
+        return kATSFontContainerRefUnspecified;
+    ATSFontContainerRef fontContainer = kATSFontContainerRefUnspecified;
+    if (ATSFontGetContainer(fontRef, 0, &fontContainer) != noErr)
+        return kATSFontContainerRefUnspecified;
+    return fontContainer;
+}
+
+// MemoryActivatedFont encapsulates a font loaded from another process and
+// activated from memory.
+//
+// Responsibilities:
+// * Holder for the CGFontRef & ATSFontRef belonging to the activated font.
+// * Responsible for unloading the font container when done.
+//
+// Memory Management:
+// The class is reference counted, with each instance of FontPlatformData that
+// uses this class holding a reference to it.
+// Entries in 2 hashes are maintained internally to allow quick lookup
+// of existing instances for reuse:
+// - fontCacheBySrcFontContainerRef() - key is the ATSFontContainerRef
+//   corresponding to the *original in-process NSFont* whose loading was blocked
+//   by the sandbox.
+//   This is needed to allow lookup of a pre-existing MemoryActivatedFont when
+//   creating a new FontPlatformData object.
+// - fontCacheByActualFontRef() - key is the ATSFontRef corresponding to the
+//   *new in-memory font* that we got from the browser process.
+//   This is needed so that a FontPlatformData object can refer back to the
+//   MemoryActivatedFont it's using. Currently this is only needed to release
+//   the font on FontPlatformData destruction.
+//
+// Assumptions:
+// This code assumes that an ATSFontRef is a unique identifier tied to an
+// activated font.  i.e. After we activate a font, its ATSFontRef doesn't
+// change.
+// It also assumes that the ATSFoncontainerRef for two in-memory NSFonts that
+// correspond to the same on-disk font file are always the same and don't change
+// with time.
+//
+// Flushing caches:
+// When the system notifies us of a system font cache flush, all FontDataCache
+// objects are destroyed.  This should in turn dereference all
+// MemoryActivatedFonts and thus unload all in-memory fonts.
+class MemoryActivatedFont : public RefCounted<MemoryActivatedFont> {
+public:
+    // srcFontRef - ATSFontRef belonging to the NSFont object that failed to
+    // load in-process.
+    // container - a font container corresponding to an identical font that
+    // we loaded cross-process.
+    MemoryActivatedFont(ATSFontContainerRef srcFontContainerRef, ATSFontContainerRef container)
+        : m_fontContainer(container)
+        , m_atsFontRef(kATSFontRefUnspecified)
+        , m_srcFontContainerRef(srcFontContainerRef)
+    {
+        if (!container)
+            return;
+        
+        // Count the number of fonts in the container.
+        ItemCount fontCount = 0;
+        OSStatus err = ATSFontFindFromContainer(container, kATSOptionFlagsDefault, 0, 0, &fontCount);
+        if (err != noErr || fontCount < 1)
+            return;
+
+        // For now always assume that we want the first font in the container.
+        ATSFontFindFromContainer(container, kATSOptionFlagsDefault, 1, &m_atsFontRef, 0);
+
+        if (!m_atsFontRef)
+            return;
+
+        // Cache CGFont representation of the font.
+        m_cgFont.adoptCF(CGFontCreateWithPlatformFont(&m_atsFontRef));
+        
+        if (!m_cgFont.get())
+            return;
+        
+        // Add ourselves to caches.
+        fontCacheBySrcFontContainerRef().add(m_srcFontContainerRef, this);
+        fontCacheByActualFontRef().add(m_atsFontRef, this);
+    }
+    
+    // Get cached CGFontRef corresponding to the in-memory font.
+    CGFontRef cgFont()
+    {
+        return m_cgFont.get();
+    }
+    
+    // Get cached ATSFontRef corresponding to the in-memory font.
+    ATSFontRef atsFontRef()
+    {
+        return m_atsFontRef;
+    }
+    
+    // Destructor - Unload font container from memory and remove ourselves
+    // from hashes.
+    ~MemoryActivatedFont()
+    {
+        if (m_cgFont.get()) {  // Object construction succeeded.
+            // First remove ourselves from the caches.
+            ASSERT(fontCacheBySrcFontContainerRef().contains(m_srcFontContainerRef));
+            ASSERT(fontCacheByActualFontRef().contains(m_atsFontRef));
+            
+            fontCacheBySrcFontContainerRef().remove(m_srcFontContainerRef);
+            fontCacheByActualFontRef().remove(m_atsFontRef);
+            
+            // Make sure the CGFont is destroyed before its font container.
+            m_cgFont.releaseRef();
+        }
+        
+        if (m_fontContainer != kATSFontContainerRefUnspecified)
+            ATSFontDeactivate(m_fontContainer, 0, kATSOptionFlagsDefault);
+    }
+
+private:
+    ATSFontContainerRef m_fontContainer;
+    WTF::RetainPtr<CGFontRef> m_cgFont;
+    ATSFontRef m_atsFontRef;
+    ATSFontContainerRef m_srcFontContainerRef;
+};
+
+// The only way we can tell that an in-process font has failed to load
+// is if CTFontCopyGraphicsFont() returns the LastResort font.
+bool isLastResortFont(CGFontRef cgFont)
+{
+    NSString* fontName = (NSString*)CGFontCopyPostScriptName(cgFont);
+    return [fontName isEqualToString:@"LastResort"];
+}
+
+// Given an in-process font which has failed to load, return a
+// MemoryActivatedFont* corresponding to an in-memory representation of the
+// same font loaded from the browser process.
+// The caller is responsbile for calling derefMemoryFont() on the ATSFontRef
+// of the returned font.
+// On failure this function returns 0, in which case the caller doesn't need
+// to perform any additional cleanup.
+MemoryActivatedFont* loadFontFromBrowserProcess(NSFont* nsFont)
+{
+    ATSFontContainerRef container;
+    // Send cross-process request to load font.
+    if (!ChromiumBridge::loadFont(nsFont, &container))
+        return 0;
+    
+    ATSFontContainerRef srcFontContainerRef = fontContainerRefFromNSFont(nsFont);
+    if (!srcFontContainerRef) {
+        ATSFontDeactivate(container, 0, kATSOptionFlagsDefault);
+        return 0;
+    }
+      
+    MemoryActivatedFont* font = fontCacheBySrcFontContainerRef().get(srcFontContainerRef);
+    if (!font) {
+        font = new MemoryActivatedFont(srcFontContainerRef, container);
+        if (!font->cgFont()) {
+            delete font;
+            return 0;
+        }
+    } else {
+        font->ref();
+    }
+
+    return font;
+}
+
+// deref() the MemoryActivatedFont corresponding to the given ATSFontRef.  If no
+// corresponding MemoryActivatedFont object exists, no action is performed.
+void derefMemoryFont(ATSFontRef fontRef)
+{
+    if (fontRef == kATSFontRefUnspecified)
+        return;
+    MemoryActivatedFont* font = fontCacheByActualFontRef().get(fontRef);
+    if (font)
+        font->deref();
+}
+
+// ref() the MemoryActivatedFont corresponding to the given ATSFontRef.  If no
+// corresponding MemoryActivatedFont object exists, no action is performed.
+void refMemoryFont(ATSFontRef fontRef)
+{
+    if (fontRef == kATSFontRefUnspecified)
+        return;
+    MemoryActivatedFont* font = fontCacheByActualFontRef().get(fontRef);
+    if (font)
+        font->ref();
+}
+
+// Given an NSFont, try to load a representation of that font into the cgFont
+// parameter.  If loading is blocked by the sandbox, the font may be loaded
+// cross-process.
+// If sandbox loading also fails, a fallback font is loaded.
+//
+// Considerations:
+// * cgFont must be CFReleas()ed by the caller when done.
+// 
+// Parameters:
+// * nsFont - The font we wish to load.
+// * fontSize - point size of the font we wish to load.
+// * outNSFont - The font that was actually loaded, may be different from nsFont
+//   if a fallback font was used.
+// * cgFont - on output this contains the CGFontRef corresponding to the NSFont
+//   that was picked in the end.  The caller is responsible for calling
+//   CFRelease() on this parameter when done with it.
+// * fontID - on output, the ID corresponding to nsFont.
+void loadFont(NSFont* nsFont, float fontSize, NSFont*& outNSFont, CGFontRef& cgFont, ATSUFontID& fontID)
+{
+    outNSFont = nsFont;
+    cgFont = CTFontCopyGraphicsFont(toCTFontRef(outNSFont), 0);
+    MemoryActivatedFont* memFont = 0;
+    if (OutOfProcessFontLoadingEnabled() && outNSFont && cgFont && isLastResortFont(cgFont)) {
+        // Release old CGFontRef since it points at the LastResort font which we don't want.
+        CFRelease(cgFont);
+        cgFont = 0;
+        
+        // Font loading was blocked by the Sandbox.
+        memFont = loadFontFromBrowserProcess(outNSFont);
+        if (memFont) {
+            cgFont = memFont->cgFont();
+            
+            // Need to add an extra retain so output semantics of this function
+            // are consistent.
+            CFRetain(cgFont);
+        } else {
+            // If we still can't load the font, then return Times,
+            // rather than the LastResort font.
+            outNSFont = [NSFont fontWithName:@"Times" size:fontSize];
+            cgFont = CTFontCopyGraphicsFont(toCTFontRef(outNSFont), 0);
+        }
+    }
+    
+    if (memFont) {
+        fontID = memFont->atsFontRef();
+    } else {
+        fontID = CTFontGetPlatformFont(toCTFontRef(outNSFont), 0);
+    }
+}
+
+} // namespace
+// End Chromium Change
+
+FontPlatformData::FontPlatformData(NSFont *nsFont, bool syntheticBold, bool syntheticOblique)
+    : m_syntheticBold(syntheticBold)
+    , m_syntheticOblique(syntheticOblique)
+    , m_font(nsFont)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    , m_isColorBitmapFont(CTFontGetSymbolicTraits(toCTFontRef(nsFont)) & kCTFontColorGlyphsTrait)
+#else
+    , m_isColorBitmapFont(false)
+#endif
+{
+// Start Chromium Change
+    m_size = nsFont ? [nsFont pointSize] : 0.0f;
+    CGFontRef cgFont = 0;
+    NSFont* loadedFont = 0;
+    loadFont(nsFont, m_size, loadedFont, cgFont, m_atsuFontID);
+    m_font = loadedFont;
+    if (m_font)
+        CFRetain(m_font);
+    m_cgFont.adoptCF(cgFont);
+// End Chromium Change
+}
+
+FontPlatformData::FontPlatformData(const FontPlatformData& f)
+{
+    m_font = f.m_font && f.m_font != reinterpret_cast<NSFont *>(-1) ? const_cast<NSFont *>(static_cast<const NSFont *>(CFRetain(f.m_font))) : f.m_font;
+
+    m_syntheticBold = f.m_syntheticBold;
+    m_syntheticOblique = f.m_syntheticOblique;
+    m_size = f.m_size;
+    m_cgFont = f.m_cgFont;
+    m_atsuFontID = f.m_atsuFontID;
+    m_isColorBitmapFont = f.m_isColorBitmapFont;
+    // Start Chromium Change
+    refMemoryFont(m_atsuFontID);
+    // End Chromium Change
+}
+
+FontPlatformData::~FontPlatformData()
+{
+    if (m_font && m_font != reinterpret_cast<NSFont *>(-1))
+        CFRelease(m_font);
+
+    // Start Chromium Change
+    derefMemoryFont(m_atsuFontID);
+    // End Chromium Change
+}
+
+const FontPlatformData& FontPlatformData::operator=(const FontPlatformData& f)
+{
+    m_syntheticBold = f.m_syntheticBold;
+    m_syntheticOblique = f.m_syntheticOblique;
+    m_size = f.m_size;
+    m_cgFont = f.m_cgFont;
+    m_atsuFontID = f.m_atsuFontID;
+    if (m_font == f.m_font)
+        return *this;
+    if (f.m_font && f.m_font != reinterpret_cast<NSFont *>(-1))
+        CFRetain(f.m_font);
+    if (m_font && m_font != reinterpret_cast<NSFont *>(-1))
+        CFRelease(m_font);
+    m_font = f.m_font;
+    m_isColorBitmapFont = f.m_isColorBitmapFont;
+    // Start Chromium Change
+    refMemoryFont(m_atsuFontID);
+    // End Chromium Change
+    return *this;
+}
+
+void FontPlatformData::setFont(NSFont *font)
+{
+    if (m_font == font)
+        return;
+    if (font)
+        CFRetain(font);
+    if (m_font && m_font != reinterpret_cast<NSFont *>(-1))
+        CFRelease(m_font);
+    m_font = font;
+    m_size = font ? [font pointSize] : 0.0f;
+    
+    // Start Chromium Change
+    CGFontRef cgFont = 0;
+    NSFont* loadedFont = 0;
+    loadFont(m_font, m_size, loadedFont, cgFont, m_atsuFontID);
+    
+    // If loadFont replaced m_font with a fallback font, then release the
+    // previous font to counter the retain above. Then retain the new font.
+    if (loadedFont != m_font) {
+        CFRelease(m_font);
+        m_font = loadedFont;
+        CFRetain(m_font);
+    }
+    m_cgFont.adoptCF(cgFont);
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
+    m_isColorBitmapFont = CTFontGetSymbolicTraits(toCTFontRef(m_font)) & kCTFontColorGlyphsTrait;
+#endif
+    // End Chromium Change
+}
+
+bool FontPlatformData::roundsGlyphAdvances() const
+{
+    return [m_font renderingMode] == NSFontAntialiasedIntegerAdvancementsRenderingMode;
+}
+
+bool FontPlatformData::allowsLigatures() const
+{
+    return ![[m_font coveredCharacterSet] characterIsMember:'a'];
+}
+
+#ifndef NDEBUG
+String FontPlatformData::description() const
+{
+    RetainPtr<CFStringRef> cgFontDescription(AdoptCF, CFCopyDescription(cgFont()));
+    return String(cgFontDescription.get()) + " " + String::number(m_size) + (m_syntheticBold ? " synthetic bold" : "") + (m_syntheticOblique ? " synthetic oblique" : "");
+}
+#endif
+
+} // namespace WebCore
diff --git a/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp b/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
index 0a5aec5..dda10b7 100644
--- a/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
+++ b/WebCore/platform/graphics/chromium/FontPlatformDataLinux.cpp
@@ -148,6 +148,7 @@ void FontPlatformData::setupPaint(SkPaint* paint) const
     paint->setTypeface(m_typeface);
     paint->setFakeBoldText(m_fakeBold);
     paint->setTextSkewX(m_fakeItalic ? -SK_Scalar1 / 4 : 0);
+    paint->setAutohinted(m_style.useAutoHint);
 
     if (m_style.useAntiAlias == 1 || (m_style.useAntiAlias == FontRenderStyle::NoPreference && isSkiaAntiAlias))
         paint->setLCDRenderText(m_style.useSubpixel == FontRenderStyle::NoPreference ? isSkiaSubpixelGlyphs : m_style.useSubpixel);
@@ -175,7 +176,8 @@ bool FontPlatformData::operator==(const FontPlatformData& a) const
     return typefacesEqual 
         && m_textSize == a.m_textSize
         && m_fakeBold == a.m_fakeBold
-        && m_fakeItalic == a.m_fakeItalic;
+        && m_fakeItalic == a.m_fakeItalic
+        && m_style == a.m_style;
 }
 
 unsigned FontPlatformData::hash() const
diff --git a/WebCore/platform/graphics/chromium/FontRenderStyle.h b/WebCore/platform/graphics/chromium/FontRenderStyle.h
index 1a3c736..6e2ae54 100644
--- a/WebCore/platform/graphics/chromium/FontRenderStyle.h
+++ b/WebCore/platform/graphics/chromium/FontRenderStyle.h
@@ -39,6 +39,24 @@ struct FontRenderStyle {
         NoPreference = 2,
     };
 
+    FontRenderStyle()
+        : useBitmaps(0),
+          useAutoHint(0),
+          useHinting(0),
+          hintStyle(0),
+          useAntiAlias(0),
+          useSubpixel(0) { }
+
+    bool operator==(const FontRenderStyle& a) const
+    {
+        return useBitmaps == a.useBitmaps
+            && useAutoHint == a.useAutoHint
+            && useHinting == a.useHinting
+            && hintStyle == a.hintStyle
+            && useAntiAlias == a.useAntiAlias
+            && useSubpixel == a.useSubpixel;
+    }
+
     // Each of the use* members below can take one of three values:
     //   0: off
     //   1: on
diff --git a/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp b/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
index b26565c..9b65346 100644
--- a/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
+++ b/WebCore/platform/graphics/chromium/GraphicsLayerChromium.cpp
@@ -53,6 +53,7 @@
 #include "PlatformString.h"
 #include "SystemTime.h"
 #include "TransformLayerChromium.h"
+#include "WebGLLayerChromium.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/StringExtras.h>
 #include <wtf/text/CString.h>
@@ -333,6 +334,35 @@ void GraphicsLayerChromium::setContentsToImage(Image* image)
         updateSublayerList();
 }
 
+#if ENABLE(3D_CANVAS)
+void GraphicsLayerChromium::setContentsToWebGL(PlatformLayer* platformLayer)
+{
+    bool childrenChanged = false;
+    if (platformLayer) {
+        if (!m_contentsLayer.get() || m_contentsLayerPurpose != ContentsLayerForWebGL) {
+            WebGLLayerChromium* webGLLayer = static_cast<WebGLLayerChromium*>(platformLayer);
+            setupContentsLayer(webGLLayer);
+            m_contentsLayer = webGLLayer;
+            m_contentsLayerPurpose = ContentsLayerForWebGL;
+            childrenChanged = true;
+        }
+        platformLayer->setOwner(this);
+        platformLayer->setNeedsDisplay();
+        updateContentsRect();
+    } else {
+        if (m_contentsLayer) {
+            childrenChanged = true;
+
+            // The old contents layer will be removed via updateSublayerList.
+            m_contentsLayer = 0;
+        }
+    }
+
+    if (childrenChanged)
+        updateSublayerList();
+}
+#endif
+
 void GraphicsLayerChromium::setContentsToVideo(PlatformLayer* videoLayer)
 {
     // FIXME: Implement
diff --git a/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h b/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
index 0c84c80..ccd02eb 100644
--- a/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
+++ b/WebCore/platform/graphics/chromium/GraphicsLayerChromium.h
@@ -86,6 +86,7 @@ public:
 
     virtual void setContentsToImage(Image*);
     virtual void setContentsToVideo(PlatformLayer*);
+    virtual void setContentsToWebGL(PlatformLayer*);
 
     virtual PlatformLayer* platformLayer() const;
 
diff --git a/WebCore/platform/graphics/chromium/LayerChromium.cpp b/WebCore/platform/graphics/chromium/LayerChromium.cpp
index e3209a7..3119dd6 100644
--- a/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -136,11 +136,14 @@ void LayerChromium::updateTextureContents(unsigned textureId)
     canvas.set(new skia::PlatformCanvas(dirtyRect.width(), dirtyRect.height(), false));
     skiaContext.set(new PlatformContextSkia(canvas.get()));
 
+#if OS(WINDOWS)
     // This is needed to get text to show up correctly. Without it,
     // GDI renders with zero alpha and the text becomes invisible.
     // Unfortunately, setting this to true disables cleartype.
     // FIXME: Does this take us down a very slow text rendering path?
+    // FIXME: why is this is a windows-only call ?
     skiaContext->setDrawingToImageBuffer(true);
+#endif
 
     graphicsContext.set(new GraphicsContext(reinterpret_cast<PlatformGraphicsContext*>(skiaContext.get())));
 
@@ -296,7 +299,6 @@ void LayerChromium::removeAllSublayers()
         ASSERT(layer->superlayer());
         layer->removeFromSuperlayer();
     }
-    setNeedsCommit();
 }
 
 void LayerChromium::setSublayers(const Vector<RefPtr<LayerChromium> >& sublayers)
diff --git a/WebCore/platform/graphics/chromium/LayerChromium.h b/WebCore/platform/graphics/chromium/LayerChromium.h
index f19baea..ebb4504 100644
--- a/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -172,6 +172,8 @@ public:
     static void setShaderProgramId(unsigned shaderProgramId) { m_shaderProgramId = shaderProgramId; }
     virtual unsigned shaderProgramId() { return m_shaderProgramId; }
 
+    void setOwner(GraphicsLayerChromium* owner) { m_owner = owner; }
+
 protected:
     GraphicsLayerChromium* m_owner;
     LayerChromium(GraphicsLayerChromium* owner);
diff --git a/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index dc587dd..59da9ae 100644
--- a/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -241,7 +241,10 @@ void LayerRendererChromium::setRootLayerCanvasSize(const IntSize& size)
     // the old ones.
     m_rootLayerCanvas = new skia::PlatformCanvas(size.width(), size.height(), false);
     m_rootLayerSkiaContext = new PlatformContextSkia(m_rootLayerCanvas.get());
+#if OS(WINDOWS)
+    // FIXME: why is this is a windows-only call ?
     m_rootLayerSkiaContext->setDrawingToImageBuffer(true);
+#endif
     m_rootLayerGraphicsContext = new GraphicsContext(reinterpret_cast<PlatformGraphicsContext*>(m_rootLayerSkiaContext.get()));
 #else
 #error "Need to implement for your platform."
@@ -623,11 +626,6 @@ void LayerRendererChromium::drawLayer(LayerChromium* layer)
             layer->updateTextureContents(textureId);
         }
 
-        // FIXME: This is temporary until WebGL layers stop changing the current
-        // context.
-        if (layer->ownsTexture())
-            makeContextCurrent();
-
         if (layer->doubleSided())
             glDisable(GL_CULL_FACE);
         else
diff --git a/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp b/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
index 6b49b9a..ebd9ebe 100644
--- a/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
+++ b/WebCore/platform/graphics/chromium/WebGLLayerChromium.cpp
@@ -34,10 +34,18 @@
 
 #include "WebGLLayerChromium.h"
 
+#include "GraphicsContext3D.h"
+#include <GLES2/gl2.h>
+
 namespace WebCore {
 
 unsigned WebGLLayerChromium::m_shaderProgramId = 0;
 
+PassRefPtr<WebGLLayerChromium> WebGLLayerChromium::create(GraphicsLayerChromium* owner)
+{
+    return adoptRef(new WebGLLayerChromium(owner));
+}
+
 WebGLLayerChromium::WebGLLayerChromium(GraphicsLayerChromium* owner)
     : LayerChromium(owner)
     , m_context(0)
@@ -53,12 +61,33 @@ unsigned WebGLLayerChromium::textureId()
 
 void WebGLLayerChromium::updateTextureContents(unsigned textureId)
 {
-    // FIXME: Implement
+    ASSERT(textureId == m_textureId);
+    ASSERT(m_context);
+    if (m_textureChanged) {
+        glBindTexture(GL_TEXTURE_2D, m_textureId);
+        // Set the min-mag filters to linear and wrap modes to GL_CLAMP_TO_EDGE
+        // to get around NPOT texture limitations of GLES.
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MIN_FILTER, GL_LINEAR);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_MAG_FILTER, GL_LINEAR);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_S, GL_CLAMP_TO_EDGE);
+        glTexParameterf(GL_TEXTURE_2D, GL_TEXTURE_WRAP_T, GL_CLAMP_TO_EDGE);
+        m_textureChanged = false;
+    }
+    // Update the contents of the texture used by the compositor.
+    if (m_contentsDirty) {
+        m_context->prepareTexture();
+        m_contentsDirty = false;
+    }
 }
 
 void WebGLLayerChromium::setContext(const GraphicsContext3D* context)
 {
-    // FIXME: Implement
+    m_context = const_cast<GraphicsContext3D*>(context);
+
+    unsigned int textureId = m_context->platformTexture();
+    if (textureId != m_textureId)
+        m_textureChanged = true;
+    m_textureId = textureId;
 }
 
 }
diff --git a/WebCore/platform/graphics/gtk/FontGtk.cpp b/WebCore/platform/graphics/gtk/FontGtk.cpp
index fae84cb..92f8816 100644
--- a/WebCore/platform/graphics/gtk/FontGtk.cpp
+++ b/WebCore/platform/graphics/gtk/FontGtk.cpp
@@ -181,6 +181,29 @@ bool Font::canReturnFallbackFontsForComplexText()
     return false;
 }
 
+#ifndef GTK_API_VERSION_2
+static void cairo_region_shrink(cairo_region_t* region, int dx, int dy)
+{
+    int nRects = cairo_region_num_rectangles(region);
+    // Clear region.
+    cairo_region_subtract(region, region);
+
+    for (int i = 0; i < nRects; i++) {
+        cairo_rectangle_int_t rect;
+        cairo_region_get_rectangle(region, i, &rect);
+
+        if (rect.width <= 2 * dx || rect.height <= 2 * dy)
+            continue;
+
+        rect.x += dx;
+        rect.y += dy;
+        rect.width -= 2 * dx;
+        rect.height -= 2 * dy;
+        cairo_region_union_rectangle(region, &rect);
+    }
+}
+#endif
+
 void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const FloatPoint& point, int from, int to) const
 {
     cairo_t* cr = context->platformContext();
@@ -196,14 +219,22 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
     // Our layouts are single line
     PangoLayoutLine* layoutLine = pango_layout_get_line_readonly(layout, 0);
 
-    GdkRegion* partialRegion = NULL;
+#ifdef GTK_API_VERSION_2
+    GdkRegion* partialRegion = 0;
+#else
+    cairo_region_t* partialRegion = 0;
+#endif
     if (to - from != run.length()) {
         // Clip the region of the run to be rendered
         char* start = g_utf8_offset_to_pointer(utf8, from);
         char* end = g_utf8_offset_to_pointer(start, to - from);
         int ranges[] = {start - utf8, end - utf8};
         partialRegion = gdk_pango_layout_line_get_clip_region(layoutLine, 0, 0, ranges, 1);
+#ifdef GTK_API_VERSION_2
         gdk_region_shrink(partialRegion, 0, -pixelSize());
+#else
+        cairo_region_shrink(partialRegion, 0, -pixelSize());
+#endif
     }
 
     Color fillColor = context->fillColor();
@@ -265,7 +296,11 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
     cairo_new_path(cr);
 
     if (partialRegion)
+#ifdef GTK_API_VERSION_2
         gdk_region_destroy(partialRegion);
+#else
+        cairo_region_destroy(partialRegion);
+#endif
 
     g_free(utf8);
     g_object_unref(layout);
diff --git a/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
index 2f02f31..f9e1980 100644
--- a/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/GraphicsContextHaiku.cpp
@@ -152,6 +152,17 @@ void GraphicsContext::drawConvexPolygon(size_t pointsLength, const FloatPoint* p
         m_data->m_view->StrokePolygon(bPoints, pointsLength, true, getHaikuStrokeStyle());
 }
 
+void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* points)
+{
+    if (paintingDisabled())
+        return;
+
+    if (numPoints <= 1)
+        return;
+    
+    // FIXME: IMPLEMENT!!
+}
+
 void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
diff --git a/WebCore/platform/graphics/mac/FontPlatformDataMac.mm b/WebCore/platform/graphics/mac/FontPlatformDataMac.mm
index e2ab405..aebd9f7 100644
--- a/WebCore/platform/graphics/mac/FontPlatformDataMac.mm
+++ b/WebCore/platform/graphics/mac/FontPlatformDataMac.mm
@@ -123,7 +123,7 @@ bool FontPlatformData::allowsLigatures() const
 String FontPlatformData::description() const
 {
     RetainPtr<CFStringRef> cgFontDescription(AdoptCF, CFCopyDescription(cgFont()));
-    return String(cgFontDescription.get()) + " " + String::number(m_size) + (m_syntheticBold ? " synthetic bold" : "") + (m_syntheticOblique ? " syntheitic oblique" : "");
+    return String(cgFontDescription.get()) + " " + String::number(m_size) + (m_syntheticBold ? " synthetic bold" : "") + (m_syntheticOblique ? " synthetic oblique" : "");
 }
 #endif
 
diff --git a/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm b/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
index 6457e4f..961ec45 100644
--- a/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
+++ b/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
@@ -736,6 +736,16 @@ bool GraphicsContext3D::getActiveUniform(WebGLProgram* program, unsigned long in
     return true;
 }
 
+void GraphicsContext3D::getAttachedShaders(WebGLProgram* program, int maxCount, int* count, unsigned int* shaders)
+{
+    if (!program || !program->object()) {
+        synthesizeGLError(INVALID_VALUE);
+        return;
+    }
+    ensureContext(m_contextObj);
+    ::glGetAttachedShaders(static_cast<GLuint>(program->object()), maxCount, count, shaders);
+}
+
 int GraphicsContext3D::getAttribLocation(WebGLProgram* program, const String& name)
 {
     if (!program)
@@ -1103,10 +1113,8 @@ void GraphicsContext3D::uniformMatrix4fv(long location, bool transpose, float* a
 
 void GraphicsContext3D::useProgram(WebGLProgram* program)
 {
-    ASSERT(program);
-    
     ensureContext(m_contextObj);
-    ::glUseProgram((GLuint) program->object());
+    ::glUseProgram(program ? ((GLuint) program->object()) : 0);
 }
 
 void GraphicsContext3D::validateProgram(WebGLProgram* program)
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.h b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
index c17204f..7d78dee 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.h
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.h
@@ -119,6 +119,7 @@ public:
     void recursiveCommitChanges();
 
     virtual void syncCompositingState();
+    virtual void syncCompositingStateForThisLayerOnly();
 
 protected:
     virtual void setOpacityInternal(float);
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
index 355c023..852bdb0 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
@@ -868,6 +868,12 @@ void GraphicsLayerCA::syncCompositingState()
     recursiveCommitChanges();
 }
 
+void GraphicsLayerCA::syncCompositingStateForThisLayerOnly()
+{
+    commitLayerChangesBeforeSublayers();
+    commitLayerChangesAfterSublayers();
+}
+
 void GraphicsLayerCA::recursiveCommitChanges()
 {
     commitLayerChangesBeforeSublayers();
diff --git a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
index c73eeea..5c327f9 100644
--- a/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
+++ b/WebCore/platform/graphics/mac/MediaPlayerPrivateQTKit.mm
@@ -1299,11 +1299,17 @@ static HashSet<String> mimeModernTypesCache()
     return cache;
 } 
 
-void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& types)
+void MediaPlayerPrivate::getSupportedTypes(HashSet<String>& supportedTypes)
 {
+    supportedTypes = mimeModernTypesCache();
+    
     // Note: this method starts QTKitServer if it isn't already running when in 64-bit because it has to return the list 
     // of every MIME type supported by QTKit.
-    types = mimeCommonTypesCache();
+    HashSet<String> commonTypes = mimeCommonTypesCache();
+    HashSet<String>::const_iterator it = commonTypes.begin();
+    HashSet<String>::const_iterator end = commonTypes.end();
+    for (; it != end; ++it)
+        supportedTypes.add(*it);
 } 
 
 MediaPlayer::SupportsType MediaPlayerPrivate::supportsType(const String& type, const String& codecs)
diff --git a/WebCore/platform/graphics/mac/SimpleFontDataMac.mm b/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
index bddb2ad..126ef2d 100644
--- a/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
+++ b/WebCore/platform/graphics/mac/SimpleFontDataMac.mm
@@ -280,7 +280,7 @@ void SimpleFontData::platformInit()
     }
 }
     
-static CFDataRef copyFontTableForTag(FontPlatformData platformData, FourCharCode tableName)
+static CFDataRef copyFontTableForTag(FontPlatformData& platformData, FourCharCode tableName)
 {
 #ifdef BUILDING_ON_TIGER
     ATSFontRef atsFont = FMGetATSFontRefFromFont(platformData.m_atsuFontID);
diff --git a/WebCore/platform/graphics/qt/FloatRectQt.cpp b/WebCore/platform/graphics/qt/FloatRectQt.cpp
index 1c918e3..063876b 100644
--- a/WebCore/platform/graphics/qt/FloatRectQt.cpp
+++ b/WebCore/platform/graphics/qt/FloatRectQt.cpp
@@ -44,6 +44,21 @@ FloatRect::operator QRectF() const
     return QRectF(x(), y(), width(), height());
 }
 
+FloatRect FloatRect::normalized() const
+{
+    FloatRect normalizedRect = *this;
+
+    if (width() < 0) {
+        normalizedRect.setX(x() + width());
+        normalizedRect.setWidth(-width());
+    }
+    if (height() < 0) {
+        normalizedRect.setY(y() + height());
+        normalizedRect.setHeight(-height());
+    }
+    return normalizedRect;
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/graphics/qt/FontQt.cpp b/WebCore/platform/graphics/qt/FontQt.cpp
index 0c1d271..59320cb 100644
--- a/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/WebCore/platform/graphics/qt/FontQt.cpp
@@ -234,7 +234,7 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
         return 0;
 
     if (run.length() == 1 && treatAsSpace(run[0]))
-        return QFontMetrics(font()).width(run[0]) + run.padding();
+        return QFontMetrics(font()).width(space) + run.padding();
 
     String sanitized = Font::normalizeSpaces(String(run.characters(), run.length()));
     QString string = fromRawDataWithoutRef(sanitized);
diff --git a/WebCore/platform/graphics/qt/GradientQt.cpp b/WebCore/platform/graphics/qt/GradientQt.cpp
index 8b9e2d7..1f05a15 100644
--- a/WebCore/platform/graphics/qt/GradientQt.cpp
+++ b/WebCore/platform/graphics/qt/GradientQt.cpp
@@ -51,6 +51,8 @@ QGradient* Gradient::platformGradient()
     else
         m_gradient = new QLinearGradient(m_p0.x(), m_p0.y(), m_p1.x(), m_p1.y());
 
+    m_gradient->setInterpolationMode(QGradient::ComponentInterpolation);
+
     sortStopsIfNecessary();
 
     QColor stopColor;
@@ -65,7 +67,7 @@ QGradient* Gradient::platformGradient()
             lastStop = stopIterator->stop;
         if (m_radial && m_r0)
             lastStop = m_r0 / m_r1 + lastStop * (1.0f - m_r0 / m_r1);
-        m_gradient->setColorAt(lastStop, stopColor);
+        m_gradient->setColorAt(qMin(lastStop, qreal(1.0f)), stopColor);
         // Keep the lastStop as orginal value, since the following stopColor depend it
         lastStop = stopIterator->stop;
         ++stopIterator;
diff --git a/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 1a51910..002765f 100644
--- a/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -1637,7 +1637,7 @@ bool GraphicsContext3D::getImageData(Image* image,
         neededAlphaOp = kAlphaDoUnmultiply;
     QImage nativeImage = nativePixmap->toImage().convertToFormat(QImage::Format_ARGB32);
     outputVector.resize(nativeImage.byteCount());
-    return packPixels(nativeImage.rgbSwapped().bits(), kSourceFormatRGBA8, image->width(), image->height(),
+    return packPixels(nativeImage.rgbSwapped().bits(), kSourceFormatRGBA8, image->width(), image->height(), 0,
                       format, type, neededAlphaOp, outputVector.data());
 }
 
diff --git a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 13608b2..9d23340 100644
--- a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -528,6 +528,17 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     p->restore();
 }
 
+void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* points)
+{
+    if (paintingDisabled())
+        return;
+
+    if (numPoints <= 1)
+        return;
+    
+    // FIXME: IMPLEMENT!!
+}
+
 QPen GraphicsContext::pen()
 {
     if (paintingDisabled())
@@ -1056,7 +1067,12 @@ void GraphicsContext::clip(const Path& path)
 
 void GraphicsContext::canvasClip(const Path& path)
 {
-    clip(path);
+    if (paintingDisabled())
+        return;
+
+    QPainterPath clipPath = path.platformPath();
+    clipPath.setFillRule(Qt::WindingFill);
+    m_data->p()->setClipPath(clipPath, Qt::IntersectClip);
 }
 
 void GraphicsContext::clipOut(const Path& path)
diff --git a/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp b/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
index 8ed0d89..226f1fb 100644
--- a/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
@@ -41,6 +41,10 @@
 #include <QtGui/qpixmapcache.h>
 #include <QtGui/qstyleoption.h>
 
+
+#define QT_DEBUG_RECACHE 0
+#define QT_DEBUG_CACHEDUMP 0
+
 namespace WebCore {
 
 #ifndef QT_NO_GRAPHICSEFFECT
@@ -225,7 +229,10 @@ public:
     int m_changeMask;
 
     QSizeF m_size;
-    QPixmapCache::Key m_backingStoreKey;
+    struct {
+        QPixmapCache::Key key;
+        QSizeF size;
+    } m_backingStore;
 #ifndef QT_NO_ANIMATION
     QList<QWeakPointer<QAbstractAnimation> > m_animations;
 #endif
@@ -283,7 +290,6 @@ inline GraphicsLayerQtImpl* toGraphicsLayerQtImpl(QGraphicsItem* item)
 
 inline GraphicsLayerQtImpl* toGraphicsLayerQtImpl(QGraphicsObject* item)
 {
-    ASSERT(item);
     return qobject_cast<GraphicsLayerQtImpl*>(item);
 }
 
@@ -339,36 +345,109 @@ const GraphicsLayerQtImpl* GraphicsLayerQtImpl::rootLayer() const
 
 QPixmap GraphicsLayerQtImpl::recache(const QRegion& regionToUpdate)
 {
-    if (!m_layer->drawsContent() || m_size.isEmpty() ||!m_size.isValid())
+    if (!m_layer->drawsContent() || m_size.isEmpty() || !m_size.isValid())
         return QPixmap();
 
-    QRegion region = regionToUpdate;
     QPixmap pixmap;
+    QRegion region = regionToUpdate;
+    if (QPixmapCache::find(m_backingStore.key, &pixmap)) {
+        if (region.isEmpty())
+            return pixmap;
+        QPixmapCache::remove(m_backingStore.key); // Remove the reference to the pixmap in the cache to avoid a detach.
+    }
 
-    // We might be drawing into an existing cache.
-    if (!QPixmapCache::find(m_backingStoreKey, &pixmap))
-        region = QRegion(QRect(0, 0, m_size.width(), m_size.height()));
+    {
+        bool erased = false;
 
-    if (m_size != pixmap.size()) {
-        pixmap = QPixmap(m_size.toSize());
-        if (!m_layer->contentsOpaque())
-            pixmap.fill(Qt::transparent);
-        m_pendingContent.regionToUpdate = QRegion(QRect(QPoint(0, 0), m_size.toSize()));
-    }
+        // If the pixmap is not in the cache or the view has grown since last cached.
+        if (pixmap.isNull() || m_size != m_backingStore.size) {
+#if QT_DEBUG_RECACHE
+            if (pixmap.isNull())
+                qDebug() << "CacheMiss" << this << m_size;
+#endif
+            bool fill = true;
+            QRegion newRegion;
+            QPixmap oldPixmap = pixmap;
+
+            // If the pixmap is two small to hold the view contents we enlarge, otherwise just use the old (large) pixmap.
+            if (pixmap.width() < m_size.width() || pixmap.height() < m_size.height()) {
+#if QT_DEBUG_RECACHE
+                qDebug() << "CacheGrow" << this << m_size;
+#endif
+                pixmap = QPixmap(m_size.toSize());
+                pixmap.fill(Qt::transparent);
+                newRegion = QRegion(0, 0, m_size.width(), m_size.height());
+            }
+
+#if 1
+            // Blit the contents of oldPixmap back into the cached pixmap as we are just adding new pixels.
+            if (!oldPixmap.isNull()) {
+                const QRegion cleanRegion = (QRegion(0, 0, m_size.width(), m_size.height())
+                                             & QRegion(0, 0, m_backingStore.size.width(), m_backingStore.size.height())) - regionToUpdate;
+                if (!cleanRegion.isEmpty()) {
+#if QT_DEBUG_RECACHE
+                    qDebug() << "CacheBlit" << this << cleanRegion;
+#endif
+                    const QRect cleanBounds(cleanRegion.boundingRect());
+                    QPainter painter(&pixmap);
+                    painter.setCompositionMode(QPainter::CompositionMode_Source);
+                    painter.drawPixmap(cleanBounds.topLeft(), oldPixmap, cleanBounds);
+                    newRegion -= cleanRegion;
+                    fill = false; // We cannot just fill the pixmap.
+                }
+                oldPixmap = QPixmap();
+            }
+#endif
+            region += newRegion;
+            if (fill && !region.isEmpty()) { // Clear the entire pixmap with the background.
+#if QT_DEBUG_RECACHE
+                qDebug() << "CacheErase" << this << m_size << background;
+#endif
+                erased = true;
+                pixmap.fill(Qt::transparent);
+            }
+        }
+        region &= QRegion(0, 0, m_size.width(), m_size.height());
+
+        // If we have something to draw its time to erase it and render the contents.
+        if (!region.isEmpty()) {
+#if QT_DEBUG_CACHEDUMP
+            static int recacheCount = 0;
+            ++recacheCount;
+            qDebug() << "**** CACHEDUMP" << recacheCount << this << m_layer << region << m_size;
+            pixmap.save(QString().sprintf("/tmp/%05d_A.png", recacheCount), "PNG");
+#endif
+
+            QPainter painter(&pixmap);
+            GraphicsContext gc(&painter);
 
-    QPainter painter(&pixmap);
-    GraphicsContext gc(&painter);
+            painter.setClipRegion(region);
 
-    // Clear the area in cache that we're drawing into
-    painter.setCompositionMode(QPainter::CompositionMode_Clear);
-    painter.fillRect(region.boundingRect(), Qt::transparent);
+            if (!erased) { // Erase the area in cache that we're drawing into.
+                painter.setCompositionMode(QPainter::CompositionMode_Clear);
+                painter.fillRect(region.boundingRect(), Qt::transparent);
 
-    // Render the actual contents into the cache
-    painter.setCompositionMode(QPainter::CompositionMode_SourceOver);
-    m_layer->paintGraphicsLayerContents(gc, region.boundingRect());
-    painter.end();
+#if QT_DEBUG_CACHEDUMP
+                qDebug() << "**** CACHEDUMP" << recacheCount << this << m_layer << region << m_size;
+                pixmap.save(QString().sprintf("/tmp/%05d_B.png", recacheCount), "PNG");
+#endif
+            }
 
-    m_backingStoreKey = QPixmapCache::insert(pixmap);
+            // Render the actual contents into the cache.
+            painter.setCompositionMode(QPainter::CompositionMode_SourceOver);
+            m_layer->paintGraphicsLayerContents(gc, region.boundingRect());
+            painter.end();
+
+#if QT_DEBUG_CACHEDUMP
+            qDebug() << "**** CACHEDUMP" << recacheCount << this << m_layer << region << m_size;
+            pixmap.save(QString().sprintf("/tmp/%05d_C.png", recacheCount), "PNG");
+#endif
+        }
+        m_backingStore.size = m_size; // Store the used size of the pixmap.
+    }
+
+    // Finally insert into the cache and allow a reference there.
+    m_backingStore.key = QPixmapCache::insert(pixmap);
     return pixmap;
 }
 
@@ -487,8 +566,9 @@ void GraphicsLayerQtImpl::paint(QPainter* painter, const QStyleOptionGraphicsIte
         if (m_state.drawsContent) {
             QPixmap backingStore;
             // We might need to recache, in case we try to paint and the cache was purged (e.g. if it was full).
-            if (!QPixmapCache::find(m_backingStoreKey, &backingStore) || backingStore.size() != m_size.toSize())
+            if (!QPixmapCache::find(m_backingStore.key, &backingStore) || backingStore.size() != m_size.toSize())
                 backingStore = recache(QRegion(m_state.contentsRect));
+            const QRectF bounds(0, 0, m_backingStore.size.width(), m_backingStore.size.height());
             painter->drawPixmap(0, 0, backingStore);
         }
         break;
@@ -674,11 +754,13 @@ void GraphicsLayerQtImpl::flushChanges(bool recursive, bool forceUpdateTransform
     else
 #endif
     if (m_changeMask & DisplayChange) {
+#ifndef QT_GRAPHICS_LAYER_NO_RECACHE_ON_DISPLAY_CHANGE
         // Recache now: all the content is ready and we don't want to wait until the paint event.
         // We only need to do this for HTML content, there's no point in caching directly composited
         // content like images or solid rectangles.
         if (m_pendingContent.contentType == HTMLContentType)
             recache(m_pendingContent.regionToUpdate);
+#endif
         update(m_pendingContent.regionToUpdate.boundingRect());
         m_pendingContent.regionToUpdate = QRegion();
     }
@@ -1441,10 +1523,7 @@ bool GraphicsLayerQt::addAnimation(const KeyframeValueList& values, const IntSiz
     if (anim->fillsBackwards())
         newAnim->setCurrentTime(0);
 
-    if (anim->delay())
-        QTimer::singleShot(anim->delay() * 1000, newAnim, SLOT(start()));
-    else
-        newAnim->start();
+    newAnim->start();
 
     // We synchronize the animation's clock to WebCore's timeOffset.
     newAnim->setCurrentTime(timeOffset * 1000);
diff --git a/WebCore/platform/graphics/qt/ImageQt.cpp b/WebCore/platform/graphics/qt/ImageQt.cpp
index af94f55..dd97873 100644
--- a/WebCore/platform/graphics/qt/ImageQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageQt.cpp
@@ -64,6 +64,8 @@ static QPixmap loadResourcePixmap(const char *name)
         pixmap = QWebSettings::webGraphic(QWebSettings::TextAreaSizeGripCornerGraphic);
     else if (qstrcmp(name, "deleteButton") == 0)
         pixmap = QWebSettings::webGraphic(QWebSettings::DeleteButtonGraphic);
+    else if (!qstrcmp(name, "inputSpeech"))
+        pixmap = QWebSettings::webGraphic(QWebSettings::InputSpeechButtonGraphic);
 
     return pixmap;
 }
@@ -164,6 +166,9 @@ void BitmapImage::invalidatePlatformData()
 void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
                        const FloatRect& src, ColorSpace styleColorSpace, CompositeOperator op)
 {
+    FloatRect normalizedDst = dst.normalized();
+    FloatRect normalizedSrc = src.normalized();
+
     startAnimation();
 
     QPixmap* image = nativeImageForCurrentFrame();
@@ -171,7 +176,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
         return;
 
     if (mayFillWithSolidColor()) {
-        fillWithSolidColor(ctxt, dst, solidColor(), styleColorSpace, op);
+        fillWithSolidColor(ctxt, normalizedDst, solidColor(), styleColorSpace, op);
         return;
     }
 
@@ -191,22 +196,22 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& dst,
     float shadowBlur;
     Color shadowColor;
     if (ctxt->getShadow(shadowSize, shadowBlur, shadowColor)) {
-        FloatRect shadowImageRect(dst);
+        FloatRect shadowImageRect(normalizedDst);
         shadowImageRect.move(shadowSize.width(), shadowSize.height());
 
-        QImage shadowImage(QSize(static_cast<int>(src.width()), static_cast<int>(src.height())), QImage::Format_ARGB32_Premultiplied);
+        QImage shadowImage(QSize(static_cast<int>(normalizedSrc.width()), static_cast<int>(normalizedSrc.height())), QImage::Format_ARGB32_Premultiplied);
         QPainter p(&shadowImage);
         p.setCompositionMode(QPainter::CompositionMode_Source);
         p.fillRect(shadowImage.rect(), shadowColor);
         p.setCompositionMode(QPainter::CompositionMode_DestinationIn);
-        p.drawPixmap(dst, *image, src);
+        p.drawPixmap(normalizedDst, *image, normalizedSrc);
         p.end();
-        painter->drawImage(shadowImageRect, shadowImage, src);
+        painter->drawImage(shadowImageRect, shadowImage, normalizedSrc);
     }
 
     // Test using example site at
     // http://www.meyerweb.com/eric/css/edge/complexspiral/demo.html
-    painter->drawPixmap(dst, *image, src);
+    painter->drawPixmap(normalizedDst, *image, normalizedSrc);
 
     painter->setCompositionMode(lastCompositionMode);
 
diff --git a/WebCore/platform/graphics/qt/PathQt.cpp b/WebCore/platform/graphics/qt/PathQt.cpp
index 8f1f912..a367212 100644
--- a/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/WebCore/platform/graphics/qt/PathQt.cpp
@@ -69,8 +69,19 @@ Path& Path::operator=(const Path& other)
     return *this;
 }
 
+static inline bool areCollinear(const QPointF& a, const QPointF& b, const QPointF& c)
+{
+    // Solved from comparing the slopes of a to b and b to c: (ay-by)/(ax-bx) == (cy-by)/(cx-bx)
+    return qFuzzyCompare((c.y() - b.y()) * (a.x() - b.x()), (a.y() - b.y()) * (c.x() - b.x()));
+}
+
+static inline bool withinRange(qreal p, qreal a, qreal b)
+{
+    return (p >= a && p <= b) || (p >= b && p <= a);
+}
+
 // Check whether a point is on the border
-bool isPointOnPathBorder(const QPolygonF& border, const QPointF& p)
+static bool isPointOnPathBorder(const QPolygonF& border, const QPointF& p)
 {
     // null border doesn't contain points
     if (border.isEmpty())
@@ -81,15 +92,12 @@ bool isPointOnPathBorder(const QPolygonF& border, const QPointF& p)
 
     for (int i = 1; i < border.size(); ++i) {
         p2 = border.at(i);
-        //  (x1<=x<=x2||x1=>x>=x2) && (y1<=y<=y2||y1=>y>=y2)  && (y2-y1)(x-x1) == (y-y1)(x2-x1)
-        //  In which, (y2-y1)(x-x1) == (y-y1)(x2-x1) is from (y2-y1)/(x2-x1) == (y-y1)/(x-x1)
-        //  it want to check the slope between p1 and p2 is same with slope between p and p1,
-        //  if so then the three points lie on the same line.
-        //  In which, (x1<=x<=x2||x1=>x>=x2) && (y1<=y<=y2||y1=>y>=y2) want to make sure p is
-        //  between p1 and p2, not outside.
-        if (((p.x() <= p1.x() && p.x() >= p2.x()) || (p.x() >= p1.x() && p.x() <= p2.x()))
-            && ((p.y() <= p1.y() && p.y() >= p2.y()) || (p.y() >= p1.y() && p.y() <= p2.y()))
-            && (p2.y() - p1.y()) * (p.x() - p1.x()) == (p.y() - p1.y()) * (p2.x() - p1.x())) {
+        if (areCollinear(p, p1, p2)
+                // Once we know that the points are collinear we
+                // only need to check one of the coordinates
+                && (qAbs(p2.x() - p1.x()) > qAbs(p2.y() - p1.y()) ?
+                        withinRange(p.x(), p1.x(), p2.x()) :
+                        withinRange(p.y(), p1.y(), p2.y()))) {
             return true;
         }
         p1 = p2;
@@ -212,19 +220,14 @@ void Path::addArcTo(const FloatPoint& p1, const FloatPoint& p2, float radius)
     float p1p2_length = sqrtf(p1p2.x() * p1p2.x() + p1p2.y() * p1p2.y());
 
     double cos_phi = (p1p0.x() * p1p2.x() + p1p0.y() * p1p2.y()) / (p1p0_length * p1p2_length);
-    // all points on a line logic
-    if (cos_phi == -1) {
+
+    // The points p0, p1, and p2 are on the same straight line (HTML5, 4.8.11.1.8)
+    // We could have used areCollinear() here, but since we're reusing
+    // the variables computed above later on we keep this logic.
+    if (qFuzzyCompare(qAbs(cos_phi), 1.0)) {
         m_path.lineTo(p1);
         return;
     }
-    if (cos_phi == 1) {
-        // add infinite far away point
-        unsigned int max_length = 65535;
-        double factor_max = max_length / p1p0_length;
-        FloatPoint ep((p0.x() + factor_max * p1p0.x()), (p0.y() + factor_max * p1p0.y()));
-        m_path.lineTo(ep);
-        return;
-    }
 
     float tangent = radius / tan(acos(cos_phi) / 2);
     float factor_p1p0 = tangent / p1p0_length;
diff --git a/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp b/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
index 62e2f17..ee0a874 100644
--- a/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
+++ b/WebCore/platform/graphics/skia/GraphicsContext3DSkia.cpp
@@ -63,7 +63,7 @@ bool GraphicsContext3D::getImageData(Image* image,
     if (!premultiplyAlpha)
         // FIXME: must fetch the image data before the premultiplication step
         neededAlphaOp = kAlphaDoUnmultiply;
-    return packPixels(pixels, kSourceFormatBGRA8, skiaImage->width(), height,
+    return packPixels(pixels, kSourceFormatBGRA8, skiaImage->width(), height, 0,
                       format, type, neededAlphaOp, outputVector.data());
 }
 
diff --git a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
index 74d0c6e..793fe72 100644
--- a/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/GraphicsContextSkia.cpp
@@ -478,6 +478,17 @@ void GraphicsContext::drawConvexPolygon(size_t numPoints,
     }
 }
 
+void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* points)
+{
+    if (paintingDisabled())
+        return;
+
+    if (numPoints <= 1)
+        return;
+    
+    // FIXME: IMPLEMENT!!
+}
+
 // This method is only used to draw the little circles used in lists.
 void GraphicsContext::drawEllipse(const IntRect& elipseRect)
 {
diff --git a/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp b/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
index 7387a14..94df6ae 100644
--- a/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
+++ b/WebCore/platform/graphics/win/GraphicsContextCairoWin.cpp
@@ -84,6 +84,12 @@ GraphicsContext::GraphicsContext(HDC dc, bool hasAlpha)
     }
 }
 
+static void setRGBABitmapAlpha(unsigned char* bytes, size_t length, unsigned char level)
+{
+    for (size_t i = 0; i < length; i += 4)
+        bytes[i + 3] = level;
+}
+
 void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, bool supportAlphaBlend, bool mayCreateBitmap)
 {
     if (!mayCreateBitmap || !hdc || !inTransparencyLayer()) {
@@ -100,9 +106,16 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
     GetObject(bitmap, sizeof(info), &info);
     ASSERT(info.bmBitsPixel == 32);
 
+    // If this context does not support alpha blending, then it may have
+    // been drawn with GDI functions which always set the alpha channel
+    // to zero. We need to manually set the bitmap to be fully opaque.
+    unsigned char* bytes = reinterpret_cast<unsigned char*>(info.bmBits);
+    if (!supportAlphaBlend)
+        setRGBABitmapAlpha(bytes, info.bmHeight * info.bmWidthBytes, 255);
+
     // Need to make a cairo_surface_t out of the bitmap's pixel buffer and then draw
     // it into our context.
-    cairo_surface_t* image = cairo_image_surface_create_for_data((unsigned char*)info.bmBits,
+    cairo_surface_t* image = cairo_image_surface_create_for_data(bytes,
                                             CAIRO_FORMAT_ARGB32,
                                             info.bmWidth,
                                             info.bmHeight,
@@ -111,9 +124,10 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
     // Scale the target surface to the new image size, and flip it
     // so that when we set the srcImage as the surface it will draw
     // right-side-up.
-    cairo_translate(m_data->cr, 0, dstRect.height());
-    cairo_scale(m_data->cr, dstRect.width(), -dstRect.height());
-    cairo_set_source_surface (m_data->cr, image, dstRect.x(), dstRect.y());
+    cairo_save(m_data->cr);
+    cairo_translate(m_data->cr, dstRect.x(), dstRect.height() + dstRect.y());
+    cairo_scale(m_data->cr, 1.0, -1.0);
+    cairo_set_source_surface(m_data->cr, image, 0, 0);
 
     if (m_data->layers.size())
         cairo_paint_with_alpha(m_data->cr, m_data->layers.last());
@@ -124,6 +138,7 @@ void GraphicsContext::releaseWindowsContext(HDC hdc, const IntRect& dstRect, boo
     cairo_surface_destroy(image);
     ::DeleteDC(hdc);
     ::DeleteObject(bitmap);
+    cairo_restore(m_data->cr);
 }
 
 void GraphicsContextPlatformPrivate::syncContext(PlatformGraphicsContext* cr)
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp b/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
index 2ca1a96..e664f2a 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
@@ -28,9 +28,12 @@
 
 #include "IntRect.h"
 #include "WebCoreInstanceHandle.h"
-#include <CoreGraphics/CGColor.h>
 #include <windows.h>
 
+#if PLATFORM(CG)
+#include <CoreGraphics/CGColor.h>
+#endif
+
 namespace WebCore {
 
 MediaPlayerPrivateFullscreenWindow::MediaPlayerPrivateFullscreenWindow(MediaPlayerPrivateFullscreenClient* client)
diff --git a/WebCore/platform/graphics/win/UniscribeController.cpp b/WebCore/platform/graphics/win/UniscribeController.cpp
index afea10a..bceec2d 100644
--- a/WebCore/platform/graphics/win/UniscribeController.cpp
+++ b/WebCore/platform/graphics/win/UniscribeController.cpp
@@ -287,9 +287,16 @@ bool UniscribeController::shapeAndPlaceItem(const UChar* cp, unsigned i, const S
             roundingHackCharacters[clusters[k]] = m_currentCharacter + k + item.iCharPos;
 
         int boundary = k + m_currentCharacter + item.iCharPos;
-        if (boundary < m_run.length() &&
-            Font::isRoundingHackCharacter(*(str + k + 1)))
-            roundingHackWordBoundaries[clusters[k]] = boundary;
+        if (boundary < m_run.length()) {
+            // When at the last character in the str, don't look one past the end for a rounding hack character.
+            // Instead look ahead to the first character of next item, if there is a next one. 
+            if (k + 1 == len) {
+                if (i + 2 < m_items.size() // Check for at least 2 items remaining. The last item is a terminating item containing no characters.
+                    && Font::isRoundingHackCharacter(*(cp + m_items[i + 1].iCharPos)))
+                    roundingHackWordBoundaries[clusters[k]] = boundary;
+            } else if (Font::isRoundingHackCharacter(*(str + k + 1)))
+                roundingHackWordBoundaries[clusters[k]] = boundary;
+        }
     }
 
     // Populate our glyph buffer with this information.
diff --git a/WebCore/platform/graphics/wince/GraphicsContextWince.cpp b/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
index c2c29c7..7bc6a27 100644
--- a/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
+++ b/WebCore/platform/graphics/wince/GraphicsContextWince.cpp
@@ -948,6 +948,17 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     }
 }
 
+void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* points)
+{
+    if (paintingDisabled())
+        return;
+
+    if (numPoints <= 1)
+        return;
+    
+    // FIXME: IMPLEMENT!!
+}
+
 void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled() || !m_data->m_opacity)
diff --git a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
index 0b6c81b..5968ef3 100644
--- a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
+++ b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
@@ -256,6 +256,17 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
     delete [] polygon;
 }
 
+void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* points)
+{
+    if (paintingDisabled())
+        return;
+
+    if (numPoints <= 1)
+        return;
+
+    // FIXME: IMPLEMENT!!
+}
+
 void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
diff --git a/WebCore/platform/gtk/DragDataGtk.cpp b/WebCore/platform/gtk/DragDataGtk.cpp
index 4ed3bc1..68f7ffc 100644
--- a/WebCore/platform/gtk/DragDataGtk.cpp
+++ b/WebCore/platform/gtk/DragDataGtk.cpp
@@ -18,8 +18,10 @@
 #include "DragData.h"
 
 #include "Clipboard.h"
+#include "ClipboardGtk.h"
 #include "Document.h"
 #include "DocumentFragment.h"
+#include "markup.h"
 
 namespace WebCore {
 
@@ -35,21 +37,24 @@ bool DragData::containsColor() const
 
 bool DragData::containsFiles() const
 {
-    return false;
+    return !m_platformDragData->files().isEmpty();
 }
 
 void DragData::asFilenames(Vector<String>& result) const
 {
+    Vector<String> files(m_platformDragData->files());
+    for (size_t i = 0; i < files.size(); i++)
+        result.append(files[i]);
 }
 
 bool DragData::containsPlainText() const
 {
-    return false;
+    return m_platformDragData->hasText();
 }
 
 String DragData::asPlainText() const
 {
-    return String();
+    return m_platformDragData->text();
 }
 
 Color DragData::asColor() const
@@ -57,30 +62,36 @@ Color DragData::asColor() const
     return Color();
 }
 
-PassRefPtr<Clipboard> DragData::createClipboard(ClipboardAccessPolicy) const
+PassRefPtr<Clipboard> DragData::createClipboard(ClipboardAccessPolicy policy) const
 {
-    return 0;
+    return ClipboardGtk::create(policy, m_platformDragData, true);
 }
 
 bool DragData::containsCompatibleContent() const
 {
-    return false;
+    return containsPlainText() || containsURL() || m_platformDragData->hasMarkup() || containsColor() || containsFiles();
 }
 
 bool DragData::containsURL(FilenameConversionPolicy filenamePolicy) const
 {
-    return false;
+    return m_platformDragData->hasURL();
 }
 
 String DragData::asURL(FilenameConversionPolicy filenamePolicy, String* title) const
 {
-    return String();
+    String url(m_platformDragData->url());
+    if (title)
+        *title = m_platformDragData->urlLabel();
+    return url;
 }
 
 
-PassRefPtr<DocumentFragment> DragData::asFragment(Document*) const
+PassRefPtr<DocumentFragment> DragData::asFragment(Document* document) const
 {
-    return 0;
+    if (!m_platformDragData->hasMarkup())
+        return 0;
+
+    return createFragmentFromMarkup(document, m_platformDragData->markup(), "");
 }
 
 }
diff --git a/WebCore/platform/gtk/GtkPluginWidget.cpp b/WebCore/platform/gtk/GtkPluginWidget.cpp
index 94382f1..331f60f 100644
--- a/WebCore/platform/gtk/GtkPluginWidget.cpp
+++ b/WebCore/platform/gtk/GtkPluginWidget.cpp
@@ -87,7 +87,11 @@ void GtkPluginWidget::paint(GraphicsContext* context, const IntRect& rect)
     event->expose.area.x = loc.x();
     event->expose.area.y = loc.y();
 
+#ifdef GTK_API_VERSION_2
     event->expose.region = gdk_region_rectangle(&event->expose.area);
+#else
+    event->expose.region = cairo_region_create_rectangle(&event->expose.area);
+#endif
 
     /*
      * This will be unref'ed by gdk_event_free.
@@ -97,7 +101,11 @@ void GtkPluginWidget::paint(GraphicsContext* context, const IntRect& rect)
     /*
      * If we are going to paint do the translation and GtkAllocation manipulation.
      */
+#ifdef GTK_API_VERSION_2
     if (!gdk_region_empty(event->expose.region))
+#else
+    if (!cairo_region_is_empty(event->expose.region))
+#endif
         gtk_widget_send_expose(widget, event);
 
     gdk_event_free(event);
diff --git a/WebCore/platform/gtk/GtkVersioning.h b/WebCore/platform/gtk/GtkVersioning.h
index 3ee6763..885d69f 100644
--- a/WebCore/platform/gtk/GtkVersioning.h
+++ b/WebCore/platform/gtk/GtkVersioning.h
@@ -31,6 +31,7 @@
 
 #if !GTK_CHECK_VERSION(2, 20, 0)
 #define gtk_widget_set_realized(widget, TRUE) GTK_WIDGET_SET_FLAGS((widget), GTK_REALIZED)
+#define gtk_range_get_min_slider_size(range) (range)->min_slider_size
 #endif // GTK_CHECK_VERSION(2, 20, 0)
 
 #if !GTK_CHECK_VERSION(2, 19, 0)
@@ -51,8 +52,10 @@
 #define gtk_widget_get_window(widget) (widget)->window
 #define gtk_adjustment_get_value(adj) (adj)->value
 #define gtk_dialog_get_content_area(dialog) (dialog)->vbox
+#define gtk_dialog_get_action_area(dialog) (dialog)->action_area
 #define gtk_selection_data_get_length(data) (data)->length
 #define gtk_selection_data_get_data(data) (data)->data
+#define gtk_adjustment_set_page_size(adj, value) (adj)->page_size = value
 #endif // GTK_CHECK_VERSION(2, 14, 0)
 
 #endif // GtkVersioning_h
diff --git a/WebCore/platform/gtk/PasteboardHelper.cpp b/WebCore/platform/gtk/PasteboardHelper.cpp
index 141488f..98cbe42 100644
--- a/WebCore/platform/gtk/PasteboardHelper.cpp
+++ b/WebCore/platform/gtk/PasteboardHelper.cpp
@@ -114,13 +114,12 @@ void PasteboardHelper::getClipboardContents(GtkClipboard* clipboard)
     }
 
     if (gtk_clipboard_wait_is_target_available(clipboard, gdkMarkupAtom)) {
-       if (GtkSelectionData* data = gtk_clipboard_wait_for_contents(clipboard, gdkMarkupAtom)) {
-          RefPtr<TextResourceDecoder> decoder(TextResourceDecoder::create("text/plain", "UTF-8", true));
-          String markup(decoder->decode(reinterpret_cast<const char*>(gtk_selection_data_get_data(data)), gtk_selection_data_get_length(data)));
-          markup += decoder->flush();
-          dataObject->setMarkup(markup);
-          gtk_selection_data_free(data);
-       }
+        if (GtkSelectionData* data = gtk_clipboard_wait_for_contents(clipboard, gdkMarkupAtom)) {
+            // g_strndup guards against selection data that is not null-terminated.
+            GOwnPtr<gchar> markupString(g_strndup(reinterpret_cast<const char*>(gtk_selection_data_get_data(data)), gtk_selection_data_get_length(data)));
+            dataObject->setMarkup(String::fromUTF8(markupString.get()));
+            gtk_selection_data_free(data);
+        }
     }
 
     if (gtk_clipboard_wait_is_target_available(clipboard, uriListAtom)) {
@@ -143,7 +142,7 @@ void PasteboardHelper::fillSelectionData(GtkSelectionData* selectionData, guint
     else if (info == getIdForTargetType(TargetTypeMarkup)) {
         GOwnPtr<gchar> markup(g_strdup(dataObject->markup().utf8().data()));
         gtk_selection_data_set(selectionData, gdkMarkupAtom, 8,
-            reinterpret_cast<const guchar*>(markup.get()), strlen(markup.get()));
+            reinterpret_cast<const guchar*>(markup.get()), strlen(markup.get()) + 1);
 
     } else if (info == getIdForTargetType(TargetTypeURIList)) {
         Vector<KURL> uriList(dataObject->uriList());
@@ -166,7 +165,7 @@ void PasteboardHelper::fillSelectionData(GtkSelectionData* selectionData, guint
 
         GOwnPtr<gchar> resultData(g_strdup(result.utf8().data()));
         gtk_selection_data_set(selectionData, netscapeURLAtom, 8,
-            reinterpret_cast<const guchar*>(resultData.get()), strlen(resultData.get()));
+            reinterpret_cast<const guchar*>(resultData.get()), strlen(resultData.get()) + 1);
 
     } else if (info == getIdForTargetType(TargetTypeImage))
         gtk_selection_data_set_pixbuf(selectionData, dataObject->image());
diff --git a/WebCore/platform/gtk/RenderThemeGtk.cpp b/WebCore/platform/gtk/RenderThemeGtk.cpp
index 75fb946..b70773e 100644
--- a/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -29,6 +29,7 @@
 #include "GOwnPtr.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
+#include "GtkVersioning.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
 #include "MediaControlElements.h"
@@ -37,10 +38,13 @@
 #include "RenderObject.h"
 #include "UserAgentStyleSheets.h"
 #include "gtkdrawing.h"
-#include <wtf/text/CString.h>
-
 #include <gdk/gdk.h>
 #include <gtk/gtk.h>
+#include <wtf/text/CString.h>
+
+#if ENABLE(PROGRESS_TAG)
+#include "RenderProgress.h"
+#endif
 
 namespace WebCore {
 
@@ -297,7 +301,7 @@ static void setMozillaState(const RenderTheme* theme, GtkThemeWidgetType type, R
         state->depressed = false;
 }
 
-static bool paintMozillaGtkWidget(const RenderThemeGtk* theme, GtkThemeWidgetType type, RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+static bool paintMozillaGtkWidget(const RenderThemeGtk* theme, GtkThemeWidgetType type, RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     // Painting is disabled so just claim to have succeeded
     if (i.context->paintingDisabled())
@@ -338,7 +342,7 @@ static bool paintMozillaGtkWidget(const RenderThemeGtk* theme, GtkThemeWidgetTyp
         // In some situations, like during print previews, this GraphicsContext is not
         // backed by a GdkDrawable. In those situations, we render onto a pixmap and then
         // copy the rendered data back to the GraphicsContext via Cairo.
-        drawable = adoptGRef(gdk_pixmap_new(0, rect.width(), rect.height(), gdk_visual_get_system()->depth));
+        drawable = adoptGRef(gdk_pixmap_new(0, rect.width(), rect.height(), gdk_visual_get_depth(gdk_visual_get_system())));
         paintRect = clipRect = IntRect(0, 0, rect.width(), rect.height());
     }
 
@@ -405,7 +409,7 @@ void RenderThemeGtk::setCheckboxSize(RenderStyle* style) const
     setToggleSize(this, style, RadioPart);
 }
 
-bool RenderThemeGtk::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeGtk::paintCheckbox(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintMozillaGtkWidget(this, MOZ_GTK_CHECKBUTTON, o, i, rect);
 }
@@ -415,7 +419,7 @@ void RenderThemeGtk::setRadioSize(RenderStyle* style) const
     setToggleSize(this, style, RadioPart);
 }
 
-bool RenderThemeGtk::paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeGtk::paintRadio(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintMozillaGtkWidget(this, MOZ_GTK_RADIOBUTTON, o, i, rect);
 }
@@ -436,7 +440,7 @@ void RenderThemeGtk::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle*
     }
 }
 
-bool RenderThemeGtk::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeGtk::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintMozillaGtkWidget(this, MOZ_GTK_BUTTON, o, i, rect);
 }
@@ -450,7 +454,7 @@ void RenderThemeGtk::adjustMenuListStyle(CSSStyleSelector* selector, RenderStyle
     adjustMozillaStyle(this, style, MOZ_GTK_DROPDOWN);
 }
 
-bool RenderThemeGtk::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeGtk::paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintMozillaGtkWidget(this, MOZ_GTK_DROPDOWN, o, i, rect);
 }
@@ -464,12 +468,12 @@ void RenderThemeGtk::adjustTextFieldStyle(CSSStyleSelector* selector, RenderStyl
     adjustMozillaStyle(this, style, MOZ_GTK_ENTRY);
 }
 
-bool RenderThemeGtk::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeGtk::paintTextField(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintMozillaGtkWidget(this, MOZ_GTK_ENTRY, o, i, rect);
 }
 
-bool RenderThemeGtk::paintTextArea(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeGtk::paintTextArea(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintTextField(o, i, r);
 }
@@ -479,7 +483,7 @@ void RenderThemeGtk::adjustSearchFieldResultsButtonStyle(CSSStyleSelector* selec
     adjustSearchFieldCancelButtonStyle(selector, style, e);
 }
 
-bool RenderThemeGtk::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeGtk::paintSearchFieldResultsButton(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintMozillaGtkWidget(this, MOZ_GTK_DROPDOWN_ARROW, o, i, rect);
 }
@@ -495,7 +499,7 @@ void RenderThemeGtk::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* s
     style->setHeight(Length(size.height(), Fixed));
 }
 
-bool RenderThemeGtk::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeGtk::paintSearchFieldResultsDecoration(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintMozillaGtkWidget(this, MOZ_GTK_CHECKMENUITEM, o, i, rect);
 }
@@ -511,7 +515,7 @@ void RenderThemeGtk::adjustSearchFieldCancelButtonStyle(CSSStyleSelector* select
     style->setHeight(Length(size.height(), Fixed));
 }
 
-bool RenderThemeGtk::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeGtk::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintMozillaGtkWidget(this, MOZ_GTK_CHECKMENUITEM, o, i, rect);
 }
@@ -521,12 +525,12 @@ void RenderThemeGtk::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderSt
     adjustTextFieldStyle(selector, style, e);
 }
 
-bool RenderThemeGtk::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeGtk::paintSearchField(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintTextField(o, i, rect);
 }
 
-bool RenderThemeGtk::paintSliderTrack(RenderObject* object, const RenderObject::PaintInfo& info, const IntRect& rect)
+bool RenderThemeGtk::paintSliderTrack(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
     ControlPart part = object->style()->appearance();
     ASSERT(part == SliderHorizontalPart || part == SliderVerticalPart);
@@ -543,7 +547,7 @@ void RenderThemeGtk::adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle* styl
     style->setBoxShadow(0);
 }
 
-bool RenderThemeGtk::paintSliderThumb(RenderObject* object, const RenderObject::PaintInfo& info, const IntRect& rect)
+bool RenderThemeGtk::paintSliderThumb(RenderObject* object, const PaintInfo& info, const IntRect& rect)
 {
     ControlPart part = object->style()->appearance();
     ASSERT(part == SliderThumbHorizontalPart || part == SliderThumbVerticalPart);
@@ -580,49 +584,49 @@ void RenderThemeGtk::adjustSliderThumbSize(RenderObject* o) const
 Color RenderThemeGtk::platformActiveSelectionBackgroundColor() const
 {
     GtkWidget* widget = gtkEntry();
-    return widget->style->base[GTK_STATE_SELECTED];
+    return gtk_widget_get_style(widget)->base[GTK_STATE_SELECTED];
 }
 
 Color RenderThemeGtk::platformInactiveSelectionBackgroundColor() const
 {
     GtkWidget* widget = gtkEntry();
-    return widget->style->base[GTK_STATE_ACTIVE];
+    return gtk_widget_get_style(widget)->base[GTK_STATE_ACTIVE];
 }
 
 Color RenderThemeGtk::platformActiveSelectionForegroundColor() const
 {
     GtkWidget* widget = gtkEntry();
-    return widget->style->text[GTK_STATE_SELECTED];
+    return gtk_widget_get_style(widget)->text[GTK_STATE_SELECTED];
 }
 
 Color RenderThemeGtk::platformInactiveSelectionForegroundColor() const
 {
     GtkWidget* widget = gtkEntry();
-    return widget->style->text[GTK_STATE_ACTIVE];
+    return gtk_widget_get_style(widget)->text[GTK_STATE_ACTIVE];
 }
 
 Color RenderThemeGtk::activeListBoxSelectionBackgroundColor() const
 {
     GtkWidget* widget = gtkTreeView();
-    return widget->style->base[GTK_STATE_SELECTED];
+    return gtk_widget_get_style(widget)->base[GTK_STATE_SELECTED];
 }
 
 Color RenderThemeGtk::inactiveListBoxSelectionBackgroundColor() const
 {
     GtkWidget* widget = gtkTreeView();
-    return widget->style->base[GTK_STATE_ACTIVE];
+    return gtk_widget_get_style(widget)->base[GTK_STATE_ACTIVE];
 }
 
 Color RenderThemeGtk::activeListBoxSelectionForegroundColor() const
 {
     GtkWidget* widget = gtkTreeView();
-    return widget->style->text[GTK_STATE_SELECTED];
+    return gtk_widget_get_style(widget)->text[GTK_STATE_SELECTED];
 }
 
 Color RenderThemeGtk::inactiveListBoxSelectionForegroundColor() const
 {
     GtkWidget* widget = gtkTreeView();
-    return widget->style->text[GTK_STATE_ACTIVE];
+    return gtk_widget_get_style(widget)->text[GTK_STATE_ACTIVE];
 }
 
 double RenderThemeGtk::caretBlinkInterval() const
@@ -650,9 +654,9 @@ Color RenderThemeGtk::systemColor(int cssValueId) const
 {
     switch (cssValueId) {
     case CSSValueButtontext:
-        return Color(gtkButton()->style->fg[GTK_STATE_NORMAL]);
+        return Color(gtk_widget_get_style(gtkButton())->fg[GTK_STATE_NORMAL]);
     case CSSValueCaptiontext:
-        return Color(gtkEntry()->style->fg[GTK_STATE_NORMAL]);
+        return Color(gtk_widget_get_style(gtkEntry())->fg[GTK_STATE_NORMAL]);
     default:
         return RenderTheme::systemColor(cssValueId);
     }
@@ -742,12 +746,12 @@ static inline bool paintMediaButton(GraphicsContext* context, const IntRect& r,
     return false;
 }
 
-bool RenderThemeGtk::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeGtk::paintMediaFullscreenButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return paintMediaButton(paintInfo.context, r, m_fullscreenButton.get(), m_panelColor, m_mediaIconSize);
 }
 
-bool RenderThemeGtk::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeGtk::paintMediaMuteButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
     if (!mediaElement)
@@ -756,7 +760,7 @@ bool RenderThemeGtk::paintMediaMuteButton(RenderObject* o, const RenderObject::P
     return paintMediaButton(paintInfo.context, r, mediaElement->muted() ? m_unmuteButton.get() : m_muteButton.get(), m_panelColor, m_mediaIconSize);
 }
 
-bool RenderThemeGtk::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeGtk::paintMediaPlayButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
     if (!mediaElement)
@@ -765,17 +769,17 @@ bool RenderThemeGtk::paintMediaPlayButton(RenderObject* o, const RenderObject::P
     return paintMediaButton(paintInfo.context, r, mediaElement->canPlay() ? m_playButton.get() : m_pauseButton.get(), m_panelColor, m_mediaIconSize);
 }
 
-bool RenderThemeGtk::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeGtk::paintMediaSeekBackButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return paintMediaButton(paintInfo.context, r, m_seekBackButton.get(), m_panelColor, m_mediaIconSize);
 }
 
-bool RenderThemeGtk::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeGtk::paintMediaSeekForwardButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return paintMediaButton(paintInfo.context, r, m_seekForwardButton.get(), m_panelColor, m_mediaIconSize);
 }
 
-bool RenderThemeGtk::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeGtk::paintMediaSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     GraphicsContext* context = paintInfo.context;
 
@@ -820,7 +824,7 @@ bool RenderThemeGtk::paintMediaSliderTrack(RenderObject* o, const RenderObject::
     return false;
 }
 
-bool RenderThemeGtk::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeGtk::paintMediaSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     // Make the thumb nicer with rounded corners.
     paintInfo.context->fillRoundedRect(r, IntSize(3, 3), IntSize(3, 3), IntSize(3, 3), IntSize(3, 3), m_sliderThumbColor, DeviceColorSpace);
@@ -828,4 +832,52 @@ bool RenderThemeGtk::paintMediaSliderThumb(RenderObject* o, const RenderObject::
 }
 #endif
 
+#if ENABLE(PROGRESS_TAG)
+double RenderThemeGtk::animationRepeatIntervalForProgressBar(RenderProgress*) const
+{
+    // FIXME: It doesn't look like there is a good way yet to support animated
+    // progress bars with the Mozilla theme drawing code.
+    return 0;
+}
+
+double RenderThemeGtk::animationDurationForProgressBar(RenderProgress*) const
+{
+    // FIXME: It doesn't look like there is a good way yet to support animated
+    // progress bars with the Mozilla theme drawing code.
+    return 0;
+}
+
+void RenderThemeGtk::adjustProgressBarStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    style->setBoxShadow(0);
+}
+
+bool RenderThemeGtk::paintProgressBar(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    if (!renderObject->isProgress())
+        return true;
+
+    GtkWidget* progressBarWidget = moz_gtk_get_progress_widget();
+    if (!progressBarWidget)
+        return true;
+
+    if (paintMozillaGtkWidget(this, MOZ_GTK_PROGRESSBAR, renderObject, paintInfo, rect))
+        return true;
+
+    IntRect chunkRect(rect);
+    RenderProgress* renderProgress = toRenderProgress(renderObject);
+
+    GtkStyle* style = gtk_widget_get_style(progressBarWidget);
+    chunkRect.setHeight(chunkRect.height() - (2 * style->ythickness));
+    chunkRect.setY(chunkRect.y() + style->ythickness);
+    chunkRect.setWidth((chunkRect.width() - (2 * style->xthickness)) * renderProgress->position());
+    if (renderObject->style()->direction() == RTL)
+        chunkRect.setX(rect.x() + rect.width() - chunkRect.width() - style->xthickness);
+    else
+        chunkRect.setX(chunkRect.x() + style->xthickness);
+
+    return paintMozillaGtkWidget(this, MOZ_GTK_PROGRESS_CHUNK, renderObject, paintInfo, chunkRect);
+}
+#endif
+
 }
diff --git a/WebCore/platform/gtk/RenderThemeGtk.h b/WebCore/platform/gtk/RenderThemeGtk.h
index 41b518e..71338d4 100644
--- a/WebCore/platform/gtk/RenderThemeGtk.h
+++ b/WebCore/platform/gtk/RenderThemeGtk.h
@@ -34,7 +34,12 @@
 typedef struct _GtkWidget GtkWidget;
 typedef struct _GtkStyle GtkStyle;
 typedef struct _GtkContainer GtkContainer;
+#ifdef GTK_API_VERSION_2
 typedef struct _GdkRectangle GdkRectangle;
+#else
+typedef struct _cairo_rectangle_int cairo_rectangle_int_t;
+typedef cairo_rectangle_int_t GdkRectangle;
+#endif
 typedef struct _GdkDrawable GdkDrawable;
 typedef struct _GtkBorder GtkBorder;
 typedef struct _GtkThemeParts GtkThemeParts;
@@ -93,52 +98,59 @@ public:
     GtkThemeParts* partsForDrawable(GdkDrawable*) const;
 
 protected:
-    virtual bool paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r);
+    virtual bool paintCheckbox(RenderObject* o, const PaintInfo& i, const IntRect& r);
     virtual void setCheckboxSize(RenderStyle* style) const;
 
-    virtual bool paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r);
+    virtual bool paintRadio(RenderObject* o, const PaintInfo& i, const IntRect& r);
     virtual void setRadioSize(RenderStyle* style) const;
 
     virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
 
-    virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&);
 
-    virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
     virtual void adjustSliderThumbSize(RenderObject* object) const;
 
 #if ENABLE(VIDEO)
     virtual void initMediaStyling(GtkStyle* style, bool force);
-    virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekBackButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekForwardButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+#endif
+
+#if ENABLE(PROGRESS_TAG)
+    virtual double animationRepeatIntervalForProgressBar(RenderProgress*) const;
+    virtual double animationDurationForProgressBar(RenderProgress*) const;
+    virtual void adjustProgressBarStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&);
 #endif
 
 private:
diff --git a/WebCore/platform/gtk/ScrollViewGtk.cpp b/WebCore/platform/gtk/ScrollViewGtk.cpp
index 5c258ad..3edc7b0 100644
--- a/WebCore/platform/gtk/ScrollViewGtk.cpp
+++ b/WebCore/platform/gtk/ScrollViewGtk.cpp
@@ -169,9 +169,9 @@ void ScrollView::platformRemoveChild(Widget* child)
     if (hostWindow())
         parent = GTK_WIDGET(hostWindow()->platformPageClient());
     else
-        parent = GTK_WIDGET(child->platformWidget()->parent);
+        parent = GTK_WIDGET(gtk_widget_get_parent(child->platformWidget()));
 
-    if (GTK_IS_CONTAINER(parent) && parent == child->platformWidget()->parent)
+    if (GTK_IS_CONTAINER(parent) && parent == gtk_widget_get_parent(child->platformWidget()))
         gtk_container_remove(GTK_CONTAINER(parent), child->platformWidget());
 }
 
@@ -191,9 +191,14 @@ IntRect ScrollView::visibleContentRect(bool includeScrollbars) const
     if (parent && includeScrollbars)
         measuredWidget = parent;
 
+    GtkAllocation allocation;
+#if GTK_CHECK_VERSION(2, 18, 0)
+    gtk_widget_get_allocation(measuredWidget, &allocation);
+#else
+    allocation = measuredWidget->allocation;
+#endif
     return IntRect(IntPoint(m_scrollOffset.width(), m_scrollOffset.height()),
-                   IntSize(measuredWidget->allocation.width,
-                           measuredWidget->allocation.height));
+                   IntSize(allocation.width, allocation.height));
 }
 
 void ScrollView::setScrollbarModes(ScrollbarMode horizontalMode, ScrollbarMode verticalMode, bool, bool)
diff --git a/WebCore/platform/gtk/ScrollbarGtk.cpp b/WebCore/platform/gtk/ScrollbarGtk.cpp
index 5dc4dd6..8081fb8 100644
--- a/WebCore/platform/gtk/ScrollbarGtk.cpp
+++ b/WebCore/platform/gtk/ScrollbarGtk.cpp
@@ -238,7 +238,11 @@ void ScrollbarGtk::paint(GraphicsContext* context, const IntRect& rect)
     event->expose.area.x = loc.x();
     event->expose.area.y = loc.y();
 
+#ifdef GTK_API_VERSION_2
     event->expose.region = gdk_region_rectangle(&event->expose.area);
+#else
+    event->expose.region = cairo_region_create_rectangle(&event->expose.area);
+#endif
 
     /*
      * This will be unref'ed by gdk_event_free.
@@ -248,7 +252,11 @@ void ScrollbarGtk::paint(GraphicsContext* context, const IntRect& rect)
     /*
      * If we are going to paint do the translation and GtkAllocation manipulation.
      */
+#ifdef GTK_API_VERSION_2
     if (!gdk_region_empty(event->expose.region))
+#else
+    if (!cairo_region_is_empty(event->expose.region))
+#endif
         gtk_widget_send_expose(widget, event);
 
     gdk_event_free(event);
diff --git a/WebCore/platform/gtk/gtk2drawing.c b/WebCore/platform/gtk/gtk2drawing.c
index 6a8af57..80e2c2a 100644
--- a/WebCore/platform/gtk/gtk2drawing.c
+++ b/WebCore/platform/gtk/gtk2drawing.c
@@ -48,6 +48,7 @@
 #include "gtkdrawing.h"
 
 #include "Assertions.h"
+#include "GtkVersioning.h"
 
 #include <math.h>
 #include <string.h>
@@ -150,7 +151,7 @@ ensure_toggle_button_widget()
         gParts->toggleButtonWidget = gtk_toggle_button_new();
         setup_widget_prototype(gParts->toggleButtonWidget);
         /* toggle button must be set active to get the right style on hover. */
-        GTK_TOGGLE_BUTTON(gParts->toggleButtonWidget)->active = TRUE;
+        gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(gParts->toggleButtonWidget), TRUE);
   }
   return MOZ_GTK_SUCCESS;
 }
@@ -297,7 +298,7 @@ ensure_combo_box_widgets()
 
     if (gParts->comboBoxButtonWidget) {
         /* Get the widgets inside the Button */
-        buttonChild = GTK_BIN(gParts->comboBoxButtonWidget)->child;
+        buttonChild = gtk_bin_get_child(GTK_BIN(gParts->comboBoxButtonWidget));
         if (GTK_IS_HBOX(buttonChild)) {
             /* appears-as-list = FALSE, cell-view = TRUE; the button
              * contains an hbox. This hbox is there because the ComboBox
@@ -407,7 +408,7 @@ ensure_combo_box_entry_widgets()
 
     if (gParts->comboBoxEntryButtonWidget) {
         /* Get the Arrow inside the Button */
-        buttonChild = GTK_BIN(gParts->comboBoxEntryButtonWidget)->child;
+        buttonChild = gtk_bin_get_child(GTK_BIN(gParts->comboBoxEntryButtonWidget));
         if (GTK_IS_HBOX(buttonChild)) {
             /* appears-as-list = FALSE, cell-view = TRUE; the button
              * contains an hbox. This hbox is there because ComboBoxEntry
@@ -682,9 +683,14 @@ ensure_tree_header_cell_widget()
         gtk_tree_view_column_set_title(lastTreeViewColumn, "M");
         gtk_tree_view_append_column(GTK_TREE_VIEW(gParts->treeViewWidget), lastTreeViewColumn);
 
+#ifdef GTK_API_VERSION_2
         /* Use the middle column's header for our button */
         gParts->treeHeaderCellWidget = gParts->middleTreeViewColumn->button;
         gParts->treeHeaderSortArrowWidget = gParts->middleTreeViewColumn->arrow;
+#else
+        gParts->treeHeaderCellWidget = gtk_button_new();
+        gParts->treeHeaderSortArrowWidget = gtk_arrow_new(GTK_ARROW_DOWN, GTK_SHADOW_NONE);
+#endif
         g_object_set_data(G_OBJECT(gParts->treeHeaderCellWidget),
                           "transparent-bg-hint", GINT_TO_POINTER(TRUE));
         g_object_set_data(G_OBJECT(gParts->treeHeaderSortArrowWidget),
@@ -758,7 +764,7 @@ moz_gtk_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
                      GtkTextDirection direction)
 {
     GtkShadowType shadow_type;
-    GtkStyle* style = widget->style;
+    GtkStyle* style = gtk_widget_get_style(widget);
     GtkStateType button_state = ConvertGtkState(state);
     gint x = rect->x, y=rect->y, width=rect->width, height=rect->height;
 
@@ -776,15 +782,19 @@ moz_gtk_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
     gtk_widget_set_state(widget, button_state);
     gtk_widget_set_direction(widget, direction);
 
+#ifdef GTK_API_VERSION_2
     if (state->isDefault)
         GTK_WIDGET_SET_FLAGS(widget, GTK_HAS_DEFAULT);
+#endif
 
-    GTK_BUTTON(widget)->relief = relief;
+    gtk_button_set_relief(GTK_BUTTON(widget), relief);
 
     /* Some theme engines love to cause us pain in that gtk_paint_focus is a
        no-op on buttons and button-like widgets. They only listen to this flag. */
+#ifdef GTK_API_VERSION_2
     if (state->focused && !state->disabled)
         GTK_WIDGET_SET_FLAGS(widget, GTK_HAS_FOCUS);
+#endif
 
     if (!interior_focus && state->focused) {
         x += focus_width + focus_pad;
@@ -814,10 +824,11 @@ moz_gtk_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
 
     if (state->focused) {
         if (interior_focus) {
-            x += widget->style->xthickness + focus_pad;
-            y += widget->style->ythickness + focus_pad;
-            width -= 2 * (widget->style->xthickness + focus_pad);
-            height -= 2 * (widget->style->ythickness + focus_pad);
+            GtkStyle* style = gtk_widget_get_style(widget);
+            x += style->xthickness + focus_pad;
+            y += style->ythickness + focus_pad;
+            width -= 2 * (style->xthickness + focus_pad);
+            height -= 2 * (style->ythickness + focus_pad);
         } else {
             x -= focus_width + focus_pad;
             y -= focus_width + focus_pad;
@@ -830,8 +841,10 @@ moz_gtk_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
                         widget, "button", x, y, width, height);
     }
 
+#ifdef GTK_API_VERSION_2
     GTK_WIDGET_UNSET_FLAGS(widget, GTK_HAS_DEFAULT);
     GTK_WIDGET_UNSET_FLAGS(widget, GTK_HAS_FOCUS);
+#endif
     return MOZ_GTK_SUCCESS;
 }
 
@@ -970,12 +983,12 @@ moz_gtk_toggle_paint(GdkDrawable* drawable, GdkRectangle* rect,
     focus_width = width + 2 * indicator_spacing;
     focus_height = height + 2 * indicator_spacing;
   
-    style = w->style;
+    style = gtk_widget_get_style(w);
     TSOffsetStyleGCs(style, x, y);
 
     gtk_widget_set_sensitive(w, !state->disabled);
     gtk_widget_set_direction(w, direction);
-    GTK_TOGGLE_BUTTON(w)->active = selected;
+    gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(w), selected);
       
     if (isradio) {
         gtk_paint_option(style, drawable, state_type, shadow_type, cliprect,
@@ -1022,7 +1035,7 @@ calculate_button_inner_rect(GtkWidget* button, GdkRectangle* rect,
     gint focus_width, focus_pad;
     GtkStyle* style;
 
-    style = button->style;
+    style = gtk_widget_get_style(button);
 
     /* This mirrors gtkbutton's child positioning */
     moz_gtk_button_get_inner_border(button, &inner_border);
@@ -1055,20 +1068,25 @@ calculate_arrow_rect(GtkWidget* arrow, GdkRectangle* rect,
     gfloat xalign, xpad;
     gint extent;
     GtkMisc* misc = GTK_MISC(arrow);
+    gfloat misc_xalign, misc_yalign;
+    gint misc_xpad, misc_ypad;
 
     if (have_arrow_scaling)
         gtk_widget_style_get(arrow, "arrow_scaling", &arrow_scaling, NULL);
 
-    extent = MIN((rect->width - misc->xpad * 2),
-                 (rect->height - misc->ypad * 2)) * arrow_scaling;
+    gtk_misc_get_padding(misc, &misc_xpad, &misc_ypad);
+    gtk_misc_get_alignment(misc, &misc_xalign, &misc_yalign);
 
-    xalign = direction == GTK_TEXT_DIR_LTR ? misc->xalign : 1.0 - misc->xalign;
-    xpad = misc->xpad + (rect->width - extent) * xalign;
+    extent = MIN((rect->width - misc_xpad * 2),
+                 (rect->height - misc_ypad * 2)) * arrow_scaling;
+
+    xalign = direction == GTK_TEXT_DIR_LTR ? misc_xalign : 1.0 - misc_xalign;
+    xpad = misc_xpad + (rect->width - extent) * xalign;
 
     arrow_rect->x = direction == GTK_TEXT_DIR_LTR ?
                         floor(rect->x + xpad) : ceil(rect->x + xpad);
-    arrow_rect->y = floor(rect->y + misc->ypad +
-                          ((rect->height - extent) * misc->yalign));
+    arrow_rect->y = floor(rect->y + misc_ypad +
+                          ((rect->height - extent) * misc_yalign));
 
     arrow_rect->width = arrow_rect->height = extent;
 
@@ -1087,6 +1105,7 @@ moz_gtk_scrollbar_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
     GdkRectangle arrow_rect;
     GtkStyle* style;
     GtkWidget *scrollbar;
+    GtkAllocation allocation;
     GtkArrowType arrow_type;
     gint arrow_displacement_x, arrow_displacement_y;
     const char* detail = (flags & MOZ_GTK_STEPPER_VERTICAL) ?
@@ -1105,41 +1124,46 @@ moz_gtk_scrollbar_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
        to determine where it should paint rounded corners on the buttons.
        We need to trick them into drawing the buttons the way we want them. */
 
-    scrollbar->allocation.x = rect->x;
-    scrollbar->allocation.y = rect->y;
-    scrollbar->allocation.width = rect->width;
-    scrollbar->allocation.height = rect->height;
+#if GTK_CHECK_VERSION(2, 18, 0)
+    gtk_widget_get_allocation(scrollbar, &allocation);
+#else
+    allocation = scrollbar->allocation;
+#endif
+    allocation.x = rect->x;
+    allocation.y = rect->y;
+    allocation.width = rect->width;
+    allocation.height = rect->height;
 
     if (flags & MOZ_GTK_STEPPER_VERTICAL) {
-        scrollbar->allocation.height *= 5;
+        allocation.height *= 5;
         if (flags & MOZ_GTK_STEPPER_DOWN) {
             arrow_type = GTK_ARROW_DOWN;
             if (flags & MOZ_GTK_STEPPER_BOTTOM)
-                scrollbar->allocation.y -= 4 * rect->height;
+                allocation.y -= 4 * rect->height;
             else
-                scrollbar->allocation.y -= rect->height;
+                allocation.y -= rect->height;
 
         } else {
             arrow_type = GTK_ARROW_UP;
             if (flags & MOZ_GTK_STEPPER_BOTTOM)
-                scrollbar->allocation.y -= 3 * rect->height;
+                allocation.y -= 3 * rect->height;
         }
     } else {
-        scrollbar->allocation.width *= 5;
+        allocation.width *= 5;
         if (flags & MOZ_GTK_STEPPER_DOWN) {
             arrow_type = GTK_ARROW_RIGHT;
             if (flags & MOZ_GTK_STEPPER_BOTTOM)
-                scrollbar->allocation.x -= 4 * rect->width;
+                allocation.x -= 4 * rect->width;
             else
-                scrollbar->allocation.x -= rect->width;
+                allocation.x -= rect->width;
         } else {
             arrow_type = GTK_ARROW_LEFT;
             if (flags & MOZ_GTK_STEPPER_BOTTOM)
-                scrollbar->allocation.x -= 3 * rect->width;
+                allocation.x -= 3 * rect->width;
         }
     }
 
-    style = scrollbar->style;
+    style = gtk_widget_get_style(scrollbar);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
@@ -1187,7 +1211,7 @@ moz_gtk_scrollbar_trough_paint(GtkThemeWidgetType widget,
 
     gtk_widget_set_direction(GTK_WIDGET(scrollbar), direction);
 
-    style = GTK_WIDGET(scrollbar)->style;
+    style = gtk_widget_get_style(GTK_WIDGET(scrollbar));
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_style_apply_default_background(style, drawable, TRUE, GTK_STATE_ACTIVE,
@@ -1246,20 +1270,30 @@ moz_gtk_scrollbar_thumb_paint(GtkThemeWidgetType widget,
     if (widget == MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL) {
         cliprect->x -= 1;
         cliprect->width += 2;
-        adj->page_size = rect->width;
+        gtk_adjustment_set_page_size(adj, rect->width);
     }
     else {
         cliprect->y -= 1;
         cliprect->height += 2;
-        adj->page_size = rect->height;
-    }
-
+        gtk_adjustment_set_page_size(adj, rect->height);
+    }
+
+#if GTK_CHECK_VERSION(2, 14, 0)
+    gtk_adjustment_configure(adj,
+                             state->curpos,
+                             0,
+                             state->maxpos,
+                             gtk_adjustment_get_step_increment(adj),
+                             gtk_adjustment_get_page_increment(adj),
+                             gtk_adjustment_get_page_size(adj));
+#else
     adj->lower = 0;
     adj->value = state->curpos;
     adj->upper = state->maxpos;
     gtk_adjustment_changed(adj);
+#endif
 
-    style = GTK_WIDGET(scrollbar)->style;
+    style = gtk_widget_get_style(GTK_WIDGET(scrollbar));
     
     gtk_widget_style_get(GTK_WIDGET(scrollbar), "activate-slider",
                          &activate_slider, NULL);
@@ -1288,7 +1322,7 @@ moz_gtk_spin_paint(GdkDrawable* drawable, GdkRectangle* rect,
 
     ensure_spin_widget();
     gtk_widget_set_direction(gParts->spinWidget, direction);
-    style = gParts->spinWidget->style;
+    style = gtk_widget_get_style(gParts->spinWidget);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_paint_box(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_IN, NULL,
@@ -1309,7 +1343,7 @@ moz_gtk_spin_updown_paint(GdkDrawable* drawable, GdkRectangle* rect,
     GtkStyle* style;
 
     ensure_spin_widget();
-    style = gParts->spinWidget->style;
+    style = gtk_widget_get_style(gParts->spinWidget);
     gtk_widget_set_direction(gParts->spinWidget, direction);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
@@ -1347,7 +1381,7 @@ moz_gtk_scale_paint(GdkDrawable* drawable, GdkRectangle* rect,
   widget = ((flags == GTK_ORIENTATION_HORIZONTAL) ? gParts->hScaleWidget : gParts->vScaleWidget);
   gtk_widget_set_direction(widget, direction);
 
-  style = widget->style;
+  style = gtk_widget_get_style(widget);
 
   if (flags == GTK_ORIENTATION_HORIZONTAL) {
     x = XTHICKNESS(style);
@@ -1388,7 +1422,7 @@ moz_gtk_scale_thumb_paint(GdkDrawable* drawable, GdkRectangle* rect,
   widget = ((flags == GTK_ORIENTATION_HORIZONTAL) ? gParts->hScaleWidget : gParts->vScaleWidget);
   gtk_widget_set_direction(widget, direction);
 
-  style = widget->style;
+  style = gtk_widget_get_style(widget);
 
   /* determine the thumb size, and position the thumb in the center in the opposite axis */
   if (flags == GTK_ORIENTATION_HORIZONTAL) {
@@ -1422,8 +1456,8 @@ moz_gtk_gripper_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_handlebox_widget();
     gtk_widget_set_direction(gParts->handleBoxWidget, direction);
 
-    style = gParts->handleBoxWidget->style;
-    shadow_type = GTK_HANDLE_BOX(gParts->handleBoxWidget)->shadow_type;
+    style = gtk_widget_get_style(gParts->handleBoxWidget);
+    shadow_type = gtk_handle_box_get_shadow_type(GTK_HANDLE_BOX(gParts->handleBoxWidget));
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_paint_box(style, drawable, state_type, shadow_type, cliprect,
@@ -1440,7 +1474,7 @@ moz_gtk_hpaned_paint(GdkDrawable* drawable, GdkRectangle* rect,
     GtkStateType hpaned_state = ConvertGtkState(state);
 
     ensure_hpaned_widget();
-    gtk_paint_handle(gParts->hpanedWidget->style, drawable, hpaned_state,
+    gtk_paint_handle(gtk_widget_get_style(gParts->hpanedWidget), drawable, hpaned_state,
                      GTK_SHADOW_NONE, cliprect, gParts->hpanedWidget, "paned",
                      rect->x, rect->y, rect->width, rect->height,
                      GTK_ORIENTATION_VERTICAL);
@@ -1455,7 +1489,7 @@ moz_gtk_vpaned_paint(GdkDrawable* drawable, GdkRectangle* rect,
     GtkStateType vpaned_state = ConvertGtkState(state);
 
     ensure_vpaned_widget();
-    gtk_paint_handle(gParts->vpanedWidget->style, drawable, vpaned_state,
+    gtk_paint_handle(gtk_widget_get_style(gParts->vpanedWidget), drawable, vpaned_state,
                      GTK_SHADOW_NONE, cliprect, gParts->vpanedWidget, "paned",
                      rect->x, rect->y, rect->width, rect->height,
                      GTK_ORIENTATION_HORIZONTAL);
@@ -1495,7 +1529,7 @@ moz_gtk_entry_paint(GdkDrawable* drawable, GdkRectangle* rect,
 
     gtk_widget_set_direction(widget, direction);
 
-    style = widget->style;
+    style = gtk_widget_get_style(widget);
 
     gtk_widget_style_get(widget,
                          "interior-focus", &interior_focus,
@@ -1551,7 +1585,9 @@ moz_gtk_entry_paint(GdkDrawable* drawable, GdkRectangle* rect,
     if (state->focused && !state->disabled) {
         /* This will get us the lit borders that focused textboxes enjoy on
          * some themes. */
+#ifdef GTK_API_VERSION_2
         GTK_WIDGET_SET_FLAGS(widget, GTK_HAS_FOCUS);
+#endif
 
         if (!interior_focus) {
             /* Indent the border a little bit if we have exterior focus 
@@ -1575,7 +1611,9 @@ moz_gtk_entry_paint(GdkDrawable* drawable, GdkRectangle* rect,
 
         /* Now unset the focus flag. We don't want other entries to look
          * like they're focused too! */
+#ifdef GTK_API_VERSION_2
         GTK_WIDGET_UNSET_FLAGS(widget, GTK_HAS_FOCUS);
+#endif
     }
 
     return MOZ_GTK_SUCCESS;
@@ -1588,7 +1626,7 @@ moz_gtk_treeview_paint(GdkDrawable* drawable, GdkRectangle* rect,
 {
     gint xthickness, ythickness;
 
-    GtkStyle *style;
+    GtkStyle *style, *treeview_style;
     GtkStateType state_type;
 
     ensure_tree_view_widget();
@@ -1605,16 +1643,17 @@ moz_gtk_treeview_paint(GdkDrawable* drawable, GdkRectangle* rect,
      * which contains the cells to the treeview base color.
      * If we don't set it here the background color will not be correct.*/
     gtk_widget_modify_bg(gParts->treeViewWidget, state_type,
-                         &gParts->treeViewWidget->style->base[state_type]);
+                         &gtk_widget_get_style(gParts->treeViewWidget)->base[state_type]);
 
-    style = gParts->scrolledWindowWidget->style;
+    style = gtk_widget_get_style(gParts->scrolledWindowWidget);
     xthickness = XTHICKNESS(style);
     ythickness = YTHICKNESS(style);
 
-    TSOffsetStyleGCs(gParts->treeViewWidget->style, rect->x, rect->y);
+    treeview_style = gtk_widget_get_style(gParts->treeViewWidget);
+    TSOffsetStyleGCs(treeview_style, rect->x, rect->y);
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
-    gtk_paint_flat_box(gParts->treeViewWidget->style, drawable, state_type,
+    gtk_paint_flat_box(treeview_style, drawable, state_type,
                        GTK_SHADOW_NONE, cliprect, gParts->treeViewWidget, "treeview",
                        rect->x + xthickness, rect->y + ythickness,
                        rect->width - 2 * xthickness,
@@ -1661,7 +1700,7 @@ moz_gtk_tree_header_sort_arrow_paint(GdkDrawable* drawable, GdkRectangle* rect,
     arrow_rect.x = rect->x + (rect->width - arrow_rect.width) / 2;
     arrow_rect.y = rect->y + (rect->height - arrow_rect.height) / 2;
 
-    style = gParts->treeHeaderSortArrowWidget->style;
+    style = gtk_widget_get_style(gParts->treeHeaderSortArrowWidget);
     TSOffsetStyleGCs(style, arrow_rect.x, arrow_rect.y);
 
     gtk_paint_arrow(style, drawable, state_type, shadow_type, cliprect,
@@ -1684,7 +1723,7 @@ moz_gtk_treeview_expander_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_tree_view_widget();
     gtk_widget_set_direction(gParts->treeViewWidget, direction);
 
-    style = gParts->treeViewWidget->style;
+    style = gtk_widget_get_style(gParts->treeViewWidget);
 
     /* Because the frame we get is of the entire treeview, we can't get the precise
      * event state of one expander, thus rendering hover and active feedback useless. */
@@ -1709,7 +1748,7 @@ moz_gtk_expander_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_expander_widget();
     gtk_widget_set_direction(gParts->expanderWidget, direction);
 
-    style = gParts->expanderWidget->style;
+    style = gtk_widget_get_style(gParts->expanderWidget);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_paint_expander(style, drawable, state_type, cliprect, gParts->expanderWidget, "expander",
@@ -1750,7 +1789,7 @@ moz_gtk_combo_box_paint(GdkDrawable* drawable, GdkRectangle* rect,
     calculate_arrow_rect(gParts->comboBoxArrowWidget,
                          &arrow_rect, &real_arrow_rect, direction);
 
-    style = gParts->comboBoxArrowWidget->style;
+    style = gtk_widget_get_style(gParts->comboBoxArrowWidget);
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
     gtk_widget_size_allocate(gParts->comboBoxWidget, rect);
@@ -1765,7 +1804,7 @@ moz_gtk_combo_box_paint(GdkDrawable* drawable, GdkRectangle* rect,
     if (!gParts->comboBoxSeparatorWidget)
         return MOZ_GTK_SUCCESS;
 
-    style = gParts->comboBoxSeparatorWidget->style;
+    style = gtk_widget_get_style(gParts->comboBoxSeparatorWidget);
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
     gtk_widget_style_get(gParts->comboBoxSeparatorWidget,
@@ -1809,7 +1848,7 @@ moz_gtk_downarrow_paint(GdkDrawable* drawable, GdkRectangle* rect,
     GdkRectangle arrow_rect;
 
     ensure_button_arrow_widget();
-    style = gParts->buttonArrowWidget->style;
+    style = gtk_widget_get_style(gParts->buttonArrowWidget);
 
     calculate_arrow_rect(gParts->buttonArrowWidget, rect, &arrow_rect,
                          GTK_TEXT_DIR_LTR);
@@ -1840,14 +1879,18 @@ moz_gtk_combo_box_entry_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
     if (input_focus) {
         /* Some themes draw a complementary focus ring for the dropdown button
          * when the dropdown entry has focus */
+#ifdef GTK_API_VERSION_2
         GTK_WIDGET_SET_FLAGS(gParts->comboBoxEntryTextareaWidget, GTK_HAS_FOCUS);
+#endif
     }
 
     moz_gtk_button_paint(drawable, rect, cliprect, state, GTK_RELIEF_NORMAL,
                          gParts->comboBoxEntryButtonWidget, direction);
 
+#ifdef GTK_API_VERSION_2
     if (input_focus)
         GTK_WIDGET_UNSET_FLAGS(gParts->comboBoxEntryTextareaWidget, GTK_HAS_FOCUS);
+#endif
 
     calculate_button_inner_rect(gParts->comboBoxEntryButtonWidget,
                                 rect, &arrow_rect, direction, FALSE);
@@ -1863,7 +1906,7 @@ moz_gtk_combo_box_entry_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
     calculate_arrow_rect(gParts->comboBoxEntryArrowWidget,
                          &arrow_rect, &real_arrow_rect, direction);
 
-    style = gParts->comboBoxEntryArrowWidget->style;
+    style = gtk_widget_get_style(gParts->comboBoxEntryArrowWidget);
     TSOffsetStyleGCs(style, real_arrow_rect.x, real_arrow_rect.y);
 
     gtk_paint_arrow(style, drawable, state_type, shadow_type, cliprect,
@@ -1894,7 +1937,7 @@ moz_gtk_container_paint(GdkDrawable* drawable, GdkRectangle* rect,
     }
     gtk_widget_set_direction(widget, direction);
 
-    style = widget->style;
+    style = gtk_widget_get_style(widget);
     moz_gtk_widget_get_focus(widget, &interior_focus, &focus_width,
                              &focus_pad);
 
@@ -1951,7 +1994,7 @@ moz_gtk_toggle_label_paint(GdkDrawable* drawable, GdkRectangle* rect,
 
     state_type = ConvertGtkState(state);
 
-    style = widget->style;
+    style = gtk_widget_get_style(widget);
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
     /* Always "checkbutton" to match gtkcheckbutton.c */
@@ -1972,7 +2015,7 @@ moz_gtk_toolbar_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_toolbar_widget();
     gtk_widget_set_direction(gParts->toolbarWidget, direction);
 
-    style = gParts->toolbarWidget->style;
+    style = gtk_widget_get_style(gParts->toolbarWidget);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
@@ -2007,7 +2050,7 @@ moz_gtk_toolbar_separator_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_toolbar_separator_widget();
     gtk_widget_set_direction(gParts->toolbarSeparatorWidget, direction);
 
-    style = gParts->toolbarSeparatorWidget->style;
+    style = gtk_widget_get_style(gParts->toolbarSeparatorWidget);
 
     gtk_widget_style_get(gParts->toolbarWidget,
                          "wide-separators", &wide_separators,
@@ -2058,7 +2101,7 @@ moz_gtk_tooltip_paint(GdkDrawable* drawable, GdkRectangle* rect,
                                       "gtk-tooltips", "GtkWindow",
                                       GTK_TYPE_WINDOW);
 
-    style = gtk_style_attach(style, gParts->tooltipWidget->window);
+    style = gtk_style_attach(style, gtk_widget_get_window(gParts->tooltipWidget));
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_paint_flat_box(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_OUT,
                        cliprect, gParts->tooltipWidget, "tooltip",
@@ -2078,7 +2121,7 @@ moz_gtk_resizer_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_window_widget();
     gtk_widget_set_direction(gParts->protoWindow, direction);
 
-    style = gParts->protoWindow->style;
+    style = gtk_widget_get_style(gParts->protoWindow);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
@@ -2100,7 +2143,7 @@ moz_gtk_frame_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_frame_widget();
     gtk_widget_set_direction(gParts->frameWidget, direction);
 
-    style = gParts->frameWidget->style;
+    style = gtk_widget_get_style(gParts->frameWidget);
 
     gtk_widget_style_get(gParts->statusbarWidget, "shadow-type", &shadow_type, NULL);
 
@@ -2121,7 +2164,7 @@ moz_gtk_progressbar_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_progress_widget();
     gtk_widget_set_direction(gParts->progresWidget, direction);
 
-    style = gParts->progresWidget->style;
+    style = gtk_widget_get_style(gParts->progresWidget);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_paint_box(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_IN,
@@ -2140,7 +2183,7 @@ moz_gtk_progress_chunk_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_progress_widget();
     gtk_widget_set_direction(gParts->progresWidget, direction);
 
-    style = gParts->progresWidget->style;
+    style = gtk_widget_get_style(gParts->progresWidget);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_paint_box(style, drawable, GTK_STATE_PRELIGHT, GTK_SHADOW_OUT,
@@ -2153,11 +2196,14 @@ moz_gtk_progress_chunk_paint(GdkDrawable* drawable, GdkRectangle* rect,
 gint
 moz_gtk_get_tab_thickness(void)
 {
+    GtkStyle* style;
+
     ensure_tab_widget();
-    if (YTHICKNESS(gParts->tabWidget->style) < 2)
+    style = gtk_widget_get_style(gParts->tabWidget);
+    if (YTHICKNESS(style) < 2)
         return 2; /* some themes don't set ythickness correctly */
 
-    return YTHICKNESS(gParts->tabWidget->style);
+    return YTHICKNESS(style);
 }
 
 static gint
@@ -2175,7 +2221,7 @@ moz_gtk_tab_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_tab_widget();
     gtk_widget_set_direction(gParts->tabWidget, direction);
 
-    style = gParts->tabWidget->style;
+    style = gtk_widget_get_style(gParts->tabWidget);
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
     if ((flags & MOZ_GTK_TAB_SELECTED) == 0) {
@@ -2312,7 +2358,7 @@ moz_gtk_tabpanels_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_tab_widget();
     gtk_widget_set_direction(gParts->tabWidget, direction);
 
-    style = gParts->tabWidget->style;
+    style = gtk_widget_get_style(gParts->tabWidget);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_paint_box_gap(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_OUT,
@@ -2338,7 +2384,7 @@ moz_gtk_tab_scroll_arrow_paint(GdkDrawable* drawable, GdkRectangle* rect,
 
     ensure_tab_widget();
 
-    style = gParts->tabWidget->style;
+    style = gtk_widget_get_style(gParts->tabWidget);
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
     if (direction == GTK_TEXT_DIR_RTL) {
@@ -2364,7 +2410,7 @@ moz_gtk_menu_bar_paint(GdkDrawable* drawable, GdkRectangle* rect,
 
     gtk_widget_style_get(gParts->menuBarWidget, "shadow-type", &shadow_type, NULL);
 
-    style = gParts->menuBarWidget->style;
+    style = gtk_widget_get_style(gParts->menuBarWidget);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_style_apply_default_background(style, drawable, TRUE, GTK_STATE_NORMAL,
@@ -2385,7 +2431,7 @@ moz_gtk_menu_popup_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_menu_popup_widget();
     gtk_widget_set_direction(gParts->menuPopupWidget, direction);
 
-    style = gParts->menuPopupWidget->style;
+    style = gtk_widget_get_style(gParts->menuPopupWidget);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_style_apply_default_background(style, drawable, TRUE, GTK_STATE_NORMAL,
@@ -2411,7 +2457,7 @@ moz_gtk_menu_separator_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_menu_separator_widget();
     gtk_widget_set_direction(gParts->menuSeparatorWidget, direction);
 
-    style = gParts->menuSeparatorWidget->style;
+    style = gtk_widget_get_style(gParts->menuSeparatorWidget);
 
     gtk_widget_style_get(gParts->menuSeparatorWidget,
                          "wide-separators",    &wide_separators,
@@ -2467,7 +2513,7 @@ moz_gtk_menu_item_paint(GdkDrawable* drawable, GdkRectangle* rect,
         }
         gtk_widget_set_direction(item_widget, direction);
         
-        style = item_widget->style;
+        style = gtk_widget_get_style(item_widget);
         TSOffsetStyleGCs(style, rect->x, rect->y);
 
         gtk_widget_style_get(item_widget, "selected-shadow-type",
@@ -2492,7 +2538,7 @@ moz_gtk_menu_arrow_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_menu_item_widget();
     gtk_widget_set_direction(gParts->menuItemWidget, direction);
 
-    style = gParts->menuItemWidget->style;
+    style = gtk_widget_get_style(gParts->menuItemWidget);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_paint_arrow(style, drawable, state_type,
@@ -2526,11 +2572,14 @@ moz_gtk_check_menu_item_paint(GdkDrawable* drawable, GdkRectangle* rect,
                           "indicator-size", &indicator_size,
                           NULL);
 
+#ifdef GTK_API_VERSION_2
     if (checked || GTK_CHECK_MENU_ITEM(gParts->checkMenuItemWidget)->always_show_toggle) {
-      style = gParts->checkMenuItemWidget->style;
+#else
+    if (checked || FALSE) {
+#endif
+      style = gtk_widget_get_style(gParts->checkMenuItemWidget);
 
-      offset = GTK_CONTAINER(gParts->checkMenuItemWidget)->border_width +
-             gParts->checkMenuItemWidget->style->xthickness + 2;
+      offset = gtk_container_get_border_width(GTK_CONTAINER(gParts->checkMenuItemWidget)) + style->xthickness + 2;
 
       /* while normally this "3" would be the horizontal-padding style value, passing it to Gecko
          as the value of menuitem padding causes problems with dropdowns (bug 406129), so in the menu.css
@@ -2566,7 +2615,7 @@ moz_gtk_window_paint(GdkDrawable* drawable, GdkRectangle* rect,
     ensure_window_widget();
     gtk_widget_set_direction(gParts->protoWindow, direction);
 
-    style = gParts->protoWindow->style;
+    style = gtk_widget_get_style(gParts->protoWindow);
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
     gtk_style_apply_default_background(style, drawable, TRUE,
@@ -2582,6 +2631,7 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
                           gboolean inhtml)
 {
     GtkWidget* w;
+    GtkStyle *style;
 
     switch (widget) {
     case MOZ_GTK_BUTTON:
@@ -2589,9 +2639,10 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
             GtkBorder inner_border;
             gboolean interior_focus;
             gint focus_width, focus_pad;
+            GtkStyle *style;
 
             ensure_button_widget();
-            *left = *top = *right = *bottom = GTK_CONTAINER(gParts->buttonWidget)->border_width;
+            *left = *top = *right = *bottom = gtk_container_get_border_width(GTK_CONTAINER(gParts->buttonWidget));
 
             /* Don't add this padding in HTML, otherwise the buttons will
                become too big and stuff the layout. */
@@ -2604,10 +2655,11 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
                 *bottom += focus_width + focus_pad + inner_border.bottom;
             }
 
-            *left += gParts->buttonWidget->style->xthickness;
-            *right += gParts->buttonWidget->style->xthickness;
-            *top += gParts->buttonWidget->style->ythickness;
-            *bottom += gParts->buttonWidget->style->ythickness;
+            style = gtk_widget_get_style(gParts->buttonWidget);
+            *left += style->xthickness;
+            *right += style->xthickness;
+            *top += style->ythickness;
+            *bottom += style->ythickness;
             return MOZ_GTK_SUCCESS;
         }
     case MOZ_GTK_ENTRY:
@@ -2629,9 +2681,10 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
             GtkBorder inner_border;
             gboolean interior_focus;
             gint focus_width, focus_pad;
+            GtkStyle* style;
 
             ensure_tree_header_cell_widget();
-            *left = *top = *right = *bottom = GTK_CONTAINER(gParts->treeHeaderCellWidget)->border_width;
+            *left = *top = *right = *bottom = gtk_container_get_border_width(GTK_CONTAINER(gParts->treeHeaderCellWidget));
 
             moz_gtk_widget_get_focus(gParts->treeHeaderCellWidget, &interior_focus, &focus_width, &focus_pad);
             moz_gtk_button_get_inner_border(gParts->treeHeaderCellWidget, &inner_border);
@@ -2640,10 +2693,11 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
             *top += focus_width + focus_pad + inner_border.top;
             *bottom += focus_width + focus_pad + inner_border.bottom;
             
-            *left += gParts->treeHeaderCellWidget->style->xthickness;
-            *right += gParts->treeHeaderCellWidget->style->xthickness;
-            *top += gParts->treeHeaderCellWidget->style->ythickness;
-            *bottom += gParts->treeHeaderCellWidget->style->ythickness;
+            style = gtk_widget_get_style(gParts->treeHeaderCellWidget);
+            *left += style->xthickness;
+            *right += style->xthickness;
+            *top += style->ythickness;
+            *bottom += style->ythickness;
             return MOZ_GTK_SUCCESS;
         }
     case MOZ_GTK_TREE_HEADER_SORTARROW:
@@ -2666,10 +2720,11 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
             gboolean ignored_interior_focus, wide_separators;
             gint focus_width, focus_pad, separator_width;
             GtkRequisition arrow_req;
+            GtkStyle* style;
 
             ensure_combo_box_widgets();
 
-            *left = GTK_CONTAINER(gParts->comboBoxButtonWidget)->border_width;
+            *left = gtk_container_get_border_width(GTK_CONTAINER(gParts->comboBoxButtonWidget));
 
             if (!inhtml) {
                 moz_gtk_widget_get_focus(gParts->comboBoxButtonWidget,
@@ -2678,8 +2733,9 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
                 *left += focus_width + focus_pad;
             }
 
-            *top = *left + gParts->comboBoxButtonWidget->style->ythickness;
-            *left += gParts->comboBoxButtonWidget->style->xthickness;
+            style = gtk_widget_get_style(gParts->comboBoxButtonWidget);
+            *top = *left + style->ythickness;
+            *left += style->xthickness;
 
             *right = *left; *bottom = *top;
 
@@ -2693,7 +2749,7 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
 
                 if (!wide_separators)
                     separator_width =
-                        XTHICKNESS(gParts->comboBoxSeparatorWidget->style);
+                        XTHICKNESS(style);
             }
 
             gtk_widget_size_request(gParts->comboBoxArrowWidget, &arrow_req);
@@ -2778,7 +2834,7 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
                 w = gParts->radiobuttonWidget;
             }
 
-            *left = *top = *right = *bottom = GTK_CONTAINER(w)->border_width;
+            *left = *top = *right = *bottom = gtk_container_get_border_width(GTK_CONTAINER(w));
 
             if (!interior_focus) {
                 *left += (focus_width + focus_pad);
@@ -2843,8 +2899,9 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
         return MOZ_GTK_UNKNOWN_WIDGET;
     }
 
-    *right = *left = XTHICKNESS(w->style);
-    *bottom = *top = YTHICKNESS(w->style);
+    style = gtk_widget_get_style(w);
+    *right = *left = XTHICKNESS(style);
+    *bottom = *top = YTHICKNESS(style);
 
     return MOZ_GTK_SUCCESS;
 }
@@ -2904,7 +2961,7 @@ moz_gtk_get_toolbar_separator_width(gint* size)
 
     ensure_toolbar_widget();
 
-    style = gParts->toolbarWidget->style;
+    style = gtk_widget_get_style(gParts->toolbarWidget);
 
     gtk_widget_style_get(gParts->toolbarWidget,
                          "space-size", size,
@@ -2945,6 +3002,7 @@ moz_gtk_get_menu_separator_height(gint *size)
 {
     gboolean wide_separators;
     gint     separator_height;
+    GtkStyle *style;
 
     ensure_menu_separator_widget();
 
@@ -2953,10 +3011,12 @@ moz_gtk_get_menu_separator_height(gint *size)
                           "separator-height", &separator_height,
                           NULL);
 
+    style = gtk_widget_get_style(gParts->menuSeparatorWidget);
+
     if (wide_separators)
-        *size = separator_height + gParts->menuSeparatorWidget->style->ythickness;
+        *size = separator_height + style->ythickness;
     else
-        *size = gParts->menuSeparatorWidget->style->ythickness * 2;
+        *size = style->ythickness * 2;
 
     return MOZ_GTK_SUCCESS;
 }
@@ -2989,8 +3049,7 @@ moz_gtk_get_scrollbar_metrics(MozGtkScrollbarMetrics *metrics)
                           "stepper_spacing", &metrics->stepper_spacing,
                           NULL);
 
-    metrics->min_slider_size =
-        GTK_RANGE(gParts->horizScrollbarWidget)->min_slider_size;
+    metrics->min_slider_size = gtk_range_get_min_slider_size(GTK_RANGE(gParts->horizScrollbarWidget));
 
     return MOZ_GTK_SUCCESS;
 }
@@ -3247,3 +3306,11 @@ void moz_gtk_destroy_theme_parts_widgets(GtkThemeParts* parts)
         parts->protoWindow = NULL;
     }
 }
+
+GtkWidget* moz_gtk_get_progress_widget()
+{
+    if (!is_initialized)
+        return NULL;
+    ensure_progress_widget();
+    return gParts->progresWidget;
+}
diff --git a/WebCore/platform/gtk/gtkdrawing.h b/WebCore/platform/gtk/gtkdrawing.h
index 1e9023f..b5a7feb 100644
--- a/WebCore/platform/gtk/gtkdrawing.h
+++ b/WebCore/platform/gtk/gtkdrawing.h
@@ -485,6 +485,12 @@ gint moz_gtk_get_tab_thickness(void);
  */
 gboolean moz_gtk_images_in_menus(void);
 
+/**
+ * Retrieve an actual GTK progress bar widget for style analysis. It will not
+ * be modified.
+ */
+GtkWidget* moz_gtk_get_progress_widget(void);
+
 #ifdef __cplusplus
 }
 #endif /* __cplusplus */
diff --git a/WebCore/platform/haiku/RenderThemeHaiku.cpp b/WebCore/platform/haiku/RenderThemeHaiku.cpp
index 4327795..78dfa9e 100644
--- a/WebCore/platform/haiku/RenderThemeHaiku.cpp
+++ b/WebCore/platform/haiku/RenderThemeHaiku.cpp
@@ -107,7 +107,7 @@ void RenderThemeHaiku::systemFont(int propId, FontDescription&) const
     notImplemented();
 }
 
-bool RenderThemeHaiku::paintCheckbox(RenderObject*, const RenderObject::PaintInfo& info, const IntRect& intRect)
+bool RenderThemeHaiku::paintCheckbox(RenderObject*, const PaintInfo& info, const IntRect& intRect)
 {
     if (info.context->paintingDisabled())
         return false;
@@ -139,7 +139,7 @@ void RenderThemeHaiku::setCheckboxSize(RenderStyle* style) const
         style->setHeight(Length(size, Fixed));
 }
 
-bool RenderThemeHaiku::paintRadio(RenderObject*, const RenderObject::PaintInfo& info, const IntRect& intRect)
+bool RenderThemeHaiku::paintRadio(RenderObject*, const PaintInfo& info, const IntRect& intRect)
 {
     if (info.context->paintingDisabled())
         return false;
@@ -169,7 +169,7 @@ void RenderThemeHaiku::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* style
     style->setMinHeight(Length(minHeight, Fixed));
 }
 
-bool RenderThemeHaiku::paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
+bool RenderThemeHaiku::paintMenuList(RenderObject*, const PaintInfo&, const IntRect&)
 {
     notImplemented();
     return false;
diff --git a/WebCore/platform/haiku/RenderThemeHaiku.h b/WebCore/platform/haiku/RenderThemeHaiku.h
index 7daebc4..06b7bdf 100644
--- a/WebCore/platform/haiku/RenderThemeHaiku.h
+++ b/WebCore/platform/haiku/RenderThemeHaiku.h
@@ -55,14 +55,14 @@ namespace WebCore {
         virtual void systemFont(int propId, FontDescription&) const;
 
     protected:
-        virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintCheckbox(RenderObject*, const PaintInfo&, const IntRect&);
         virtual void setCheckboxSize(RenderStyle*) const;
 
-        virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintRadio(RenderObject*, const PaintInfo&, const IntRect&);
         virtual void setRadioSize(RenderStyle*) const;
 
         virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
index cce4f64..4911bc9 100644
--- a/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp
@@ -210,7 +210,7 @@ public:
 
             // We can fill in the size now that the header is available.
             if (!m_decoder->setSize(m_info.image_width, m_info.image_height))
-                return m_decoder->setFailed();
+                return false;
 
             if (m_decodingSizeOnly) {
                 // We can stop here.  Reduce our buffer length and available
diff --git a/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp b/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
index 56cf05f..8186f33 100644
--- a/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/png/PNGImageDecoder.cpp
@@ -41,6 +41,12 @@
 #include "PNGImageDecoder.h"
 #include "png.h"
 
+#if defined(PNG_LIBPNG_VER_MAJOR) && defined(PNG_LIBPNG_VER_MINOR) && (PNG_LIBPNG_VER_MAJOR > 1 || (PNG_LIBPNG_VER_MAJOR == 1 && PNG_LIBPNG_VER_MINOR >= 4))
+#define JMPBUF(png_ptr) png_jmpbuf(png_ptr)
+#else
+#define JMPBUF(png_ptr) png_ptr->jmpbuf
+#endif
+
 namespace WebCore {
 
 // Gamma constants.
@@ -54,7 +60,7 @@ const unsigned long cMaxPNGSize = 1000000UL;
 // Called if the decoding of the image fails.
 static void PNGAPI decodingFailed(png_structp png, png_const_charp)
 {
-    longjmp(png->jmpbuf, 1);
+    longjmp(JMPBUF(png), 1);
 }
 
 // Callbacks given to the read struct.  The first is for warnings (we want to
@@ -125,7 +131,7 @@ public:
         PNGImageDecoder* decoder = static_cast<PNGImageDecoder*>(png_get_progressive_ptr(m_png));
 
         // We need to do the setjmp here. Otherwise bad things will happen.
-        if (setjmp(m_png->jmpbuf))
+        if (setjmp(JMPBUF(m_png)))
             return decoder->setFailed();
 
         const char* segment;
@@ -220,7 +226,7 @@ void PNGImageDecoder::headerAvailable()
     
     // Protect against large images.
     if (png->width > cMaxPNGSize || png->height > cMaxPNGSize) {
-        longjmp(png->jmpbuf, 1);
+        longjmp(JMPBUF(png), 1);
         return;
     }
     
@@ -233,7 +239,7 @@ void PNGImageDecoder::headerAvailable()
     bool result = setSize(width, height);
     m_doNothingOnFailure = false;
     if (!result) {
-        longjmp(png->jmpbuf, 1);
+        longjmp(JMPBUF(png), 1);
         return;
     }
 
@@ -297,7 +303,7 @@ void PNGImageDecoder::rowAvailable(unsigned char* rowBuffer, unsigned rowIndex,
     RGBA32Buffer& buffer = m_frameBufferCache[0];
     if (buffer.status() == RGBA32Buffer::FrameEmpty) {
         if (!buffer.setSize(scaledSize().width(), scaledSize().height())) {
-            longjmp(m_reader->pngPtr()->jmpbuf, 1);
+            longjmp(JMPBUF(m_reader->pngPtr()), 1);
             return;
         }
         buffer.setStatus(RGBA32Buffer::FramePartial);
diff --git a/WebCore/platform/network/ResourceLoadTiming.h b/WebCore/platform/network/ResourceLoadTiming.h
new file mode 100644
index 0000000..55ff181
--- /dev/null
+++ b/WebCore/platform/network/ResourceLoadTiming.h
@@ -0,0 +1,110 @@
+/*
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef ResourceLoadTiming_h
+#define ResourceLoadTiming_h
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class ResourceLoadTiming : public RefCounted<ResourceLoadTiming> {
+public:
+    PassRefPtr<ResourceLoadTiming> create()
+    {
+        return adoptRef(new ResourceLoadTiming);
+    }
+
+    PassRefPtr<ResourceLoadTiming> deepCopy()
+    {
+        RefPtr<ResourceLoadTiming> timing = create();
+        timing->redirectStart = redirectStart;
+        timing->redirectEnd = redirectEnd;
+        timing->redirectCount = redirectCount;
+        timing->domainLookupStart = domainLookupStart;
+        timing->domainLookupEnd = domainLookupEnd;
+        timing->connectStart = connectStart;
+        timing->connectEnd = connectEnd;
+        timing->requestStart = requestStart;
+        timing->requestEnd = requestEnd;
+        timing->responseStart = responseStart;
+        timing->responseEnd = responseEnd;
+        return timing.release();
+    }
+
+    bool operator==(const ResourceLoadTiming& other) const
+    {
+        return redirectStart == other.redirectStart
+            && redirectEnd == other.redirectEnd
+            && redirectCount == other.redirectCount
+            && domainLookupStart == other.domainLookupStart
+            && domainLookupEnd == other.domainLookupEnd
+            && connectStart == other.connectStart
+            && connectEnd == other.connectEnd
+            && requestStart == other.requestStart
+            && requestEnd == other.requestEnd
+            && responseStart == other.responseStart
+            && responseEnd == other.responseEnd;
+    }
+
+    bool operator!=(const ResourceLoadTiming& other) const
+    {
+        return !(*this == other);
+    }
+
+    double redirectStart;
+    double redirectEnd;
+    unsigned short redirectCount;
+    double domainLookupStart;
+    double domainLookupEnd;
+    double connectStart;
+    double connectEnd;
+    double requestStart;
+    double requestEnd;
+    double responseStart;
+    double responseEnd;
+
+private:
+    ResourceLoadTiming()
+        : redirectStart(0.0)
+        , redirectEnd(0.0)
+        , redirectCount(0)
+        , domainLookupStart(0.0)
+        , domainLookupEnd(0.0)
+        , connectStart(0.0)
+        , connectEnd(0.0)
+        , requestStart(0.0)
+        , requestEnd(0.0)
+        , responseStart(0.0)
+        , responseEnd(0.0)
+    {
+    }
+};
+
+}
+
+#endif
diff --git a/WebCore/platform/network/ResourceResponseBase.cpp b/WebCore/platform/network/ResourceResponseBase.cpp
index 3192a18..607cd7f 100644
--- a/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/WebCore/platform/network/ResourceResponseBase.cpp
@@ -100,6 +100,7 @@ PassOwnPtr<ResourceResponse> ResourceResponseBase::adopt(PassOwnPtr<CrossThreadR
     response->lazyInit();
     response->m_httpHeaderFields.adopt(data->m_httpHeaders.release());
     response->setLastModifiedDate(data->m_lastModifiedDate);
+    response->setResourceLoadTiming(data->m_resourceLoadTiming.release());
 
     return response.release();
 }
@@ -116,6 +117,8 @@ PassOwnPtr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() con
     data->m_httpStatusText = httpStatusText().crossThreadString();
     data->m_httpHeaders = httpHeaderFields().copyData();
     data->m_lastModifiedDate = lastModifiedDate();
+    if (m_resourceLoadTiming)
+        data->m_resourceLoadTiming = m_resourceLoadTiming->deepCopy();
     return data.release();
 }
 
@@ -452,6 +455,20 @@ time_t ResourceResponseBase::lastModifiedDate() const
     return m_lastModifiedDate;
 }
 
+ResourceLoadTiming* ResourceResponseBase::resourceLoadTiming() const
+{
+    lazyInit();
+
+    return m_resourceLoadTiming.get();
+}
+
+void ResourceResponseBase::setResourceLoadTiming(PassRefPtr<ResourceLoadTiming> resourceLoadTiming)
+{
+    lazyInit();
+
+    m_resourceLoadTiming = resourceLoadTiming;
+}
+
 void ResourceResponseBase::lazyInit() const
 {
     const_cast<ResourceResponse*>(static_cast<const ResourceResponse*>(this))->platformLazyInit();
@@ -477,6 +494,10 @@ bool ResourceResponseBase::compare(const ResourceResponse& a, const ResourceResp
         return false;
     if (a.httpHeaderFields() != b.httpHeaderFields())
         return false;
+    if (a.resourceLoadTiming() && b.resourceLoadTiming() && *a.resourceLoadTiming() == *b.resourceLoadTiming())
+        return ResourceResponse::platformCompare(a, b);
+    if (a.resourceLoadTiming() != b.resourceLoadTiming())
+        return false;
     return ResourceResponse::platformCompare(a, b);
 }
 
diff --git a/WebCore/platform/network/ResourceResponseBase.h b/WebCore/platform/network/ResourceResponseBase.h
index 74e23a4..697a84c 100644
--- a/WebCore/platform/network/ResourceResponseBase.h
+++ b/WebCore/platform/network/ResourceResponseBase.h
@@ -29,8 +29,10 @@
 
 #include "HTTPHeaderMap.h"
 #include "KURL.h"
+#include "ResourceLoadTiming.h"
 
 #include <wtf/PassOwnPtr.h>
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
@@ -95,6 +97,9 @@ public:
     double expires() const;
     double lastModified() const;
 
+    ResourceLoadTiming* resourceLoadTiming() const;
+    void setResourceLoadTiming(PassRefPtr<ResourceLoadTiming>);
+
     // The ResourceResponse subclass may "shadow" this method to provide platform-specific memory usage information
     unsigned memoryUsage() const
     {
@@ -125,6 +130,7 @@ protected:
     String m_httpStatusText;
     HTTPHeaderMap m_httpHeaderFields;
     time_t m_lastModifiedDate;
+    RefPtr<ResourceLoadTiming> m_resourceLoadTiming;
 
     bool m_isNull : 1;
     
@@ -161,6 +167,7 @@ struct CrossThreadResourceResponseData : Noncopyable {
     String m_httpStatusText;
     OwnPtr<CrossThreadHTTPHeaderMapData> m_httpHeaders;
     time_t m_lastModifiedDate;
+    RefPtr<ResourceLoadTiming> m_resourceLoadTiming;
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index e52dd1d..1ae24ff 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -60,6 +60,9 @@ FormDataIODevice::FormDataIODevice(FormData* data)
     , m_currentDelta(0)
 {
     setOpenMode(FormDataIODevice::ReadOnly);
+
+    if (!m_formElements.isEmpty() && m_formElements[0].m_type == FormDataElement::encodedFile)
+        openFileForCurrentElement();
 }
 
 FormDataIODevice::~FormDataIODevice()
@@ -78,6 +81,11 @@ void FormDataIODevice::moveToNextElement()
     if (m_formElements.isEmpty() || m_formElements[0].m_type == FormDataElement::data)
         return;
 
+    openFileForCurrentElement();
+}
+
+void FormDataIODevice::openFileForCurrentElement()
+{
     if (!m_currentFile)
         m_currentFile = new QFile;
 
@@ -353,7 +361,7 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
         ResourceRequest newRequest = m_resourceHandle->request();
         newRequest.setURL(newUrl);
 
-        if (((statusCode >= 301 && statusCode <= 303) || statusCode == 307) && m_method == QNetworkAccessManager::PostOperation) {
+        if (((statusCode >= 301 && statusCode <= 303) || statusCode == 307) && newRequest.httpMethod() == "POST") {
             m_method = QNetworkAccessManager::GetOperation;
             newRequest.setHTTPMethod("GET");
         }
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.h b/WebCore/platform/network/qt/QNetworkReplyHandler.h
index 9f8217d..f6b2358 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -104,6 +104,7 @@ protected:
 
 private:
     void moveToNextElement();
+    void openFileForCurrentElement();
 
 private:
     Vector<FormDataElement> m_formElements;
diff --git a/WebCore/platform/qt/ClipboardQt.cpp b/WebCore/platform/qt/ClipboardQt.cpp
index 485d0d1..f478e64 100644
--- a/WebCore/platform/qt/ClipboardQt.cpp
+++ b/WebCore/platform/qt/ClipboardQt.cpp
@@ -57,6 +57,11 @@
 
 namespace WebCore {
 
+static bool isTextMimeType(const String& type)
+{
+    return type == "text/plain" || type.startsWith("text/plain;");
+}
+
 ClipboardQt::ClipboardQt(ClipboardAccessPolicy policy, const QMimeData* readableClipboard)
     : Clipboard(policy, true)
     , m_readableData(readableClipboard)
@@ -130,10 +135,15 @@ String ClipboardQt::getData(const String& type, bool& success) const
         return String();
     }
 
+    if (isTextMimeType(type) && m_readableData->hasText()) {
+        success = true;
+        return m_readableData->text();
+    }
+
     ASSERT(m_readableData);
     QByteArray data = m_readableData->data(QString(type));
     success = !data.isEmpty();
-    return String(data.data(), data.size());
+    return String(data.constData(), data.size());
 }
 
 bool ClipboardQt::setData(const String& type, const String& data)
@@ -143,9 +153,14 @@ bool ClipboardQt::setData(const String& type, const String& data)
 
     if (!m_writableData)
         m_writableData = new QMimeData;
-    QByteArray array(reinterpret_cast<const char*>(data.characters()),
-                     data.length()*2);
-    m_writableData->setData(QString(type), array);
+
+    if (isTextMimeType(type))
+        m_writableData->setText(QString(data));
+    else {
+        QByteArray array(reinterpret_cast<const char*>(data.characters()), data.length() * 2);
+        m_writableData->setData(QString(type), array);
+    }
+
 #ifndef QT_NO_CLIPBOARD
     if (!isForDragging())
         QApplication::clipboard()->setMimeData(m_writableData);
diff --git a/WebCore/platform/qt/RenderThemeQt.cpp b/WebCore/platform/qt/RenderThemeQt.cpp
index 9319493..deb9037 100644
--- a/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/WebCore/platform/qt/RenderThemeQt.cpp
@@ -83,7 +83,7 @@ namespace WebCore {
 using namespace HTMLNames;
 
 
-StylePainter::StylePainter(RenderThemeQt* theme, const RenderObject::PaintInfo& paintInfo)
+StylePainter::StylePainter(RenderThemeQt* theme, const PaintInfo& paintInfo)
 {
     init(paintInfo.context ? paintInfo.context : 0, theme->qStyle());
 }
@@ -437,7 +437,7 @@ void RenderThemeQt::setCheckboxSize(RenderStyle* style) const
     computeSizeBasedOnStyle(style);
 }
 
-bool RenderThemeQt::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeQt::paintCheckbox(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintButton(o, i, r);
 }
@@ -447,7 +447,7 @@ void RenderThemeQt::setRadioSize(RenderStyle* style) const
     computeSizeBasedOnStyle(style);
 }
 
-bool RenderThemeQt::paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeQt::paintRadio(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintButton(o, i, r);
 }
@@ -531,7 +531,7 @@ void RenderThemeQt::setButtonPadding(RenderStyle* style) const
     style->setPaddingBottom(Length(paddingBottom, Fixed));
 }
 
-bool RenderThemeQt::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeQt::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     StylePainter p(this, i);
     if (!p.isValid())
@@ -564,7 +564,7 @@ void RenderThemeQt::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle* style,
     computeSizeBasedOnStyle(style);
 }
 
-bool RenderThemeQt::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeQt::paintTextField(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     StylePainter p(this, i);
     if (!p.isValid())
@@ -598,7 +598,7 @@ void RenderThemeQt::adjustTextAreaStyle(CSSStyleSelector* selector, RenderStyle*
     adjustTextFieldStyle(selector, style, element);
 }
 
-bool RenderThemeQt::paintTextArea(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeQt::paintTextArea(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintTextField(o, i, r);
 }
@@ -633,7 +633,7 @@ void RenderThemeQt::setPopupPadding(RenderStyle* style) const
 }
 
 
-bool RenderThemeQt::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeQt::paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     StylePainter p(this, i);
     if (!p.isValid())
@@ -676,7 +676,7 @@ void RenderThemeQt::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle* st
     setPopupPadding(style);
 }
 
-bool RenderThemeQt::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& i,
+bool RenderThemeQt::paintMenuListButton(RenderObject* o, const PaintInfo& i,
                                         const IntRect& r)
 {
     StylePainter p(this, i);
@@ -725,7 +725,7 @@ void RenderThemeQt::adjustProgressBarStyle(CSSStyleSelector*, RenderStyle* style
     style->setBoxShadow(0);
 }
 
-bool RenderThemeQt::paintProgressBar(RenderObject* o, const RenderObject::PaintInfo& pi, const IntRect& r)
+bool RenderThemeQt::paintProgressBar(RenderObject* o, const PaintInfo& pi, const IntRect& r)
 {
     if (!o->isProgress())
         return true;
@@ -769,7 +769,7 @@ bool RenderThemeQt::paintProgressBar(RenderObject* o, const RenderObject::PaintI
 }
 #endif
 
-bool RenderThemeQt::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& pi,
+bool RenderThemeQt::paintSliderTrack(RenderObject* o, const PaintInfo& pi,
                                      const IntRect& r)
 {
     StylePainter p(this, pi);
@@ -823,7 +823,7 @@ void RenderThemeQt::adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle* style
     style->setBoxShadow(0);
 }
 
-bool RenderThemeQt::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& pi,
+bool RenderThemeQt::paintSliderThumb(RenderObject* o, const PaintInfo& pi,
                                      const IntRect& r)
 {
     // We've already painted it in paintSliderTrack(), no need to do anything here.
@@ -835,7 +835,7 @@ void RenderThemeQt::adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle* style
     style->setBoxShadow(0);
 }
 
-bool RenderThemeQt::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& pi,
+bool RenderThemeQt::paintSearchField(RenderObject* o, const PaintInfo& pi,
                                      const IntRect& r)
 {
     return true;
@@ -855,7 +855,7 @@ void RenderThemeQt::adjustSearchFieldCancelButtonStyle(CSSStyleSelector* selecto
     RenderTheme::adjustSearchFieldCancelButtonStyle(selector, style, e);
 }
 
-bool RenderThemeQt::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& pi,
+bool RenderThemeQt::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& pi,
                                                  const IntRect& r)
 {
     notImplemented();
@@ -869,7 +869,7 @@ void RenderThemeQt::adjustSearchFieldDecorationStyle(CSSStyleSelector* selector,
     RenderTheme::adjustSearchFieldDecorationStyle(selector, style, e);
 }
 
-bool RenderThemeQt::paintSearchFieldDecoration(RenderObject* o, const RenderObject::PaintInfo& pi,
+bool RenderThemeQt::paintSearchFieldDecoration(RenderObject* o, const PaintInfo& pi,
                                                const IntRect& r)
 {
     notImplemented();
@@ -883,7 +883,7 @@ void RenderThemeQt::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* se
     RenderTheme::adjustSearchFieldResultsDecorationStyle(selector, style, e);
 }
 
-bool RenderThemeQt::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& pi,
+bool RenderThemeQt::paintSearchFieldResultsDecoration(RenderObject* o, const PaintInfo& pi,
                                                       const IntRect& r)
 {
     notImplemented();
@@ -1042,12 +1042,12 @@ QColor RenderThemeQt::getMediaControlForegroundColor(RenderObject* o) const
     return fgColor;
 }
 
-bool RenderThemeQt::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeQt::paintMediaFullscreenButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderTheme::paintMediaFullscreenButton(o, paintInfo, r);
 }
 
-bool RenderThemeQt::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeQt::paintMediaMuteButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
     if (!mediaElement)
@@ -1071,7 +1071,7 @@ bool RenderThemeQt::paintMediaMuteButton(RenderObject* o, const RenderObject::Pa
     return false;
 }
 
-bool RenderThemeQt::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeQt::paintMediaPlayButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
     if (!mediaElement)
@@ -1098,19 +1098,19 @@ bool RenderThemeQt::paintMediaPlayButton(RenderObject* o, const RenderObject::Pa
     return false;
 }
 
-bool RenderThemeQt::paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
+bool RenderThemeQt::paintMediaSeekBackButton(RenderObject*, const PaintInfo&, const IntRect&)
 {
     // We don't want to paint this at the moment.
     return false;
 }
 
-bool RenderThemeQt::paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
+bool RenderThemeQt::paintMediaSeekForwardButton(RenderObject*, const PaintInfo&, const IntRect&)
 {
     // We don't want to paint this at the moment.
     return false;
 }
 
-bool RenderThemeQt::paintMediaCurrentTime(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeQt::paintMediaCurrentTime(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     StylePainter p(this, paintInfo);
     if (!p.isValid())
@@ -1132,7 +1132,7 @@ String RenderThemeQt::formatMediaControlsRemainingTime(float currentTime, float
     return String();
 }
 
-bool RenderThemeQt::paintMediaVolumeSliderTrack(RenderObject *o, const RenderObject::PaintInfo &paintInfo, const IntRect &r)
+bool RenderThemeQt::paintMediaVolumeSliderTrack(RenderObject *o, const PaintInfo &paintInfo, const IntRect &r)
 {
     StylePainter p(this, paintInfo);
     if (!p.isValid())
@@ -1180,7 +1180,7 @@ bool RenderThemeQt::paintMediaVolumeSliderTrack(RenderObject *o, const RenderObj
     return false;
 }
 
-bool RenderThemeQt::paintMediaVolumeSliderThumb(RenderObject *o, const RenderObject::PaintInfo &paintInfo, const IntRect &r)
+bool RenderThemeQt::paintMediaVolumeSliderThumb(RenderObject *o, const PaintInfo &paintInfo, const IntRect &r)
 {
     StylePainter p(this, paintInfo);
     if (!p.isValid())
@@ -1190,7 +1190,7 @@ bool RenderThemeQt::paintMediaVolumeSliderThumb(RenderObject *o, const RenderObj
     return false;
 }
 
-bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     HTMLMediaElement* mediaElement = getMediaElementFromRenderObject(o);
     if (!mediaElement)
@@ -1227,7 +1227,7 @@ bool RenderThemeQt::paintMediaSliderTrack(RenderObject* o, const RenderObject::P
     return false;
 }
 
-bool RenderThemeQt::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeQt::paintMediaSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     StylePainter p(this, paintInfo);
     if (!p.isValid())
diff --git a/WebCore/platform/qt/RenderThemeQt.h b/WebCore/platform/qt/RenderThemeQt.h
index fdd8d6b..7ab6769 100644
--- a/WebCore/platform/qt/RenderThemeQt.h
+++ b/WebCore/platform/qt/RenderThemeQt.h
@@ -90,50 +90,50 @@ public:
     QStyle* qStyle() const;
 
 protected:
-    virtual bool paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r);
+    virtual bool paintCheckbox(RenderObject* o, const PaintInfo& i, const IntRect& r);
     virtual void setCheckboxSize(RenderStyle*) const;
 
-    virtual bool paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r);
+    virtual bool paintRadio(RenderObject* o, const PaintInfo& i, const IntRect& r);
     virtual void setRadioSize(RenderStyle*) const;
 
     virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void setButtonSize(RenderStyle*) const;
 
-    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r);
+    virtual bool paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& r);
     virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
 #if ENABLE(PROGRESS_TAG)
     virtual void adjustProgressBarStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintProgressBar(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&);
 #endif
 
-    virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
     virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
 #if ENABLE(PROGRESS_TAG)
     // Returns the repeat interval of the animation for the progress bar.
@@ -143,16 +143,16 @@ protected:
 #endif
 
 #if ENABLE(VIDEO)
-    virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekBackButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekForwardButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaCurrentTime(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
     virtual String formatMediaControlsCurrentTime(float currentTime, float duration) const;
     virtual String formatMediaControlsRemainingTime(float currentTime, float duration) const;
 private:
@@ -190,7 +190,7 @@ private:
 
 class StylePainter {
 public:
-    explicit StylePainter(RenderThemeQt*, const RenderObject::PaintInfo&);
+    explicit StylePainter(RenderThemeQt*, const PaintInfo&);
     explicit StylePainter(ScrollbarThemeQt*, GraphicsContext*);
     ~StylePainter();
 
diff --git a/WebCore/platform/text/BidiResolver.h b/WebCore/platform/text/BidiResolver.h
index 286cdcd..a99fd01 100644
--- a/WebCore/platform/text/BidiResolver.h
+++ b/WebCore/platform/text/BidiResolver.h
@@ -806,35 +806,33 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, boo
             break;
         }
 
-        if (pastEnd) {
-            if (eor == current) {
-                if (!reachedEndOfLine) {
-                    eor = endOfLine;
-                    switch (m_status.eor) {
-                        case LeftToRight:
-                        case RightToLeft:
-                        case ArabicNumber:
-                            m_direction = m_status.eor;
-                            break;
-                        case EuropeanNumber:
-                            m_direction = m_status.lastStrong == LeftToRight ? LeftToRight : EuropeanNumber;
-                            break;
-                        default:
-                            ASSERT(false);
-                    }
-                    appendRun();
+        if (pastEnd && eor == current) {
+            if (!reachedEndOfLine) {
+                eor = endOfLine;
+                switch (m_status.eor) {
+                    case LeftToRight:
+                    case RightToLeft:
+                    case ArabicNumber:
+                        m_direction = m_status.eor;
+                        break;
+                    case EuropeanNumber:
+                        m_direction = m_status.lastStrong == LeftToRight ? LeftToRight : EuropeanNumber;
+                        break;
+                    default:
+                        ASSERT(false);
                 }
-                current = end;
-                m_status = stateAtEnd.m_status;
-                sor = stateAtEnd.sor; 
-                eor = stateAtEnd.eor;
-                last = stateAtEnd.last;
-                reachedEndOfLine = stateAtEnd.reachedEndOfLine;
-                lastBeforeET = stateAtEnd.lastBeforeET;
-                emptyRun = stateAtEnd.emptyRun;
-                m_direction = OtherNeutral;
-                break;
+                appendRun();
             }
+            current = end;
+            m_status = stateAtEnd.m_status;
+            sor = stateAtEnd.sor; 
+            eor = stateAtEnd.eor;
+            last = stateAtEnd.last;
+            reachedEndOfLine = stateAtEnd.reachedEndOfLine;
+            lastBeforeET = stateAtEnd.lastBeforeET;
+            emptyRun = stateAtEnd.emptyRun;
+            m_direction = OtherNeutral;
+            break;
         }
 
         // set m_status.last as needed.
@@ -887,8 +885,21 @@ void BidiResolver<Iterator, Run>::createBidiRunsForLine(const Iterator& end, boo
         }
 
         increment();
-        if (!m_currentExplicitEmbeddingSequence.isEmpty())
+        if (!m_currentExplicitEmbeddingSequence.isEmpty()) {
             commitExplicitEmbedding();
+            if (pastEnd) {
+                current = end;
+                m_status = stateAtEnd.m_status;
+                sor = stateAtEnd.sor; 
+                eor = stateAtEnd.eor;
+                last = stateAtEnd.last;
+                reachedEndOfLine = stateAtEnd.reachedEndOfLine;
+                lastBeforeET = stateAtEnd.lastBeforeET;
+                emptyRun = stateAtEnd.emptyRun;
+                m_direction = OtherNeutral;
+                break;
+            }
+        }
 
         if (emptyRun && (dirCurrent == RightToLeftEmbedding
                 || dirCurrent == LeftToRightEmbedding
diff --git a/WebCore/platform/text/SegmentedString.cpp b/WebCore/platform/text/SegmentedString.cpp
index 9ff1c45..04d6c77 100644
--- a/WebCore/platform/text/SegmentedString.cpp
+++ b/WebCore/platform/text/SegmentedString.cpp
@@ -122,6 +122,13 @@ void SegmentedString::prepend(const SegmentedSubstring &s)
     }
 }
 
+void SegmentedString::close()
+{
+    // Closing a stream twice is likely a coding mistake.
+    ASSERT(!m_closed);
+    m_closed = true;
+}
+
 void SegmentedString::append(const SegmentedString &s)
 {
     ASSERT(!m_closed);
diff --git a/WebCore/platform/text/SegmentedString.h b/WebCore/platform/text/SegmentedString.h
index 21eae14..747d426 100644
--- a/WebCore/platform/text/SegmentedString.h
+++ b/WebCore/platform/text/SegmentedString.h
@@ -82,7 +82,7 @@ public:
     const SegmentedString& operator=(const SegmentedString&);
 
     void clear();
-    void close() { m_closed = true; }
+    void close();
 
     void append(const SegmentedString&);
     void prepend(const SegmentedString&);
diff --git a/WebCore/platform/wx/RenderThemeWx.cpp b/WebCore/platform/wx/RenderThemeWx.cpp
index c4d8c35..c68bde9 100644
--- a/WebCore/platform/wx/RenderThemeWx.cpp
+++ b/WebCore/platform/wx/RenderThemeWx.cpp
@@ -55,14 +55,14 @@ public:
     // A method asking if the theme's controls actually care about redrawing when hovered.
     virtual bool supportsHover(const RenderStyle*) const { return true; }
 
-    virtual bool paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+    virtual bool paintCheckbox(RenderObject* o, const PaintInfo& i, const IntRect& r)
     {
         return paintButton(o, i, r);
     }
  
     virtual void setCheckboxSize(RenderStyle*) const;
 
-    virtual bool paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+    virtual bool paintRadio(RenderObject* o, const PaintInfo& i, const IntRect& r)
     {
         return paintButton(o, i, r);
     }
@@ -72,18 +72,18 @@ public:
     virtual void adjustRepaintRect(const RenderObject*, IntRect&);
 
     virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual int minimumMenuListSize(RenderStyle*) const;
 
     virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual bool isControlStyled(const RenderStyle*, const BorderData&,
                                  const FillLayer&, const Color&) const;
@@ -259,7 +259,7 @@ void RenderThemeWx::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* s
     addIntrinsicMargins(style);
 }
 
-bool RenderThemeWx::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWx::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
@@ -318,7 +318,7 @@ void RenderThemeWx::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle* style,
     
 }
 
-bool RenderThemeWx::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWx::paintTextField(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
@@ -340,7 +340,7 @@ void RenderThemeWx::adjustMenuListStyle(CSSStyleSelector*, RenderStyle* style, E
 {
 }
     
-bool RenderThemeWx::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWx::paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
@@ -369,7 +369,7 @@ void RenderThemeWx::adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, E
     notImplemented();
 }
     
-bool RenderThemeWx::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWx::paintMenuListButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     wxWindow* window = nativeWindowForRenderObject(o);
     wxDC* dc = static_cast<wxDC*>(i.context->platformContext());
diff --git a/WebCore/plugins/PluginPackage.cpp b/WebCore/plugins/PluginPackage.cpp
index 278be30..c7d8b22 100644
--- a/WebCore/plugins/PluginPackage.cpp
+++ b/WebCore/plugins/PluginPackage.cpp
@@ -195,6 +195,10 @@ void PluginPackage::determineQuirks(const String& mimeType)
         } else {
             // Flash 9 and older requests windowless plugins if we return a mozilla user agent
             m_quirks.add(PluginQuirkWantsMozillaUserAgent);
+#if PLATFORM(QT)
+            // Flash 9 and older would crash on repeated calls to SetWindow in windowed mode
+            m_quirks.add(PluginQuirkDontCallSetWindowMoreThanOnce);
+#endif
         }
 
         m_quirks.add(PluginQuirkThrottleInvalidate);
diff --git a/WebCore/plugins/PluginQuirkSet.h b/WebCore/plugins/PluginQuirkSet.h
index de29baf..7f52f6a 100644
--- a/WebCore/plugins/PluginQuirkSet.h
+++ b/WebCore/plugins/PluginQuirkSet.h
@@ -46,7 +46,8 @@ namespace WebCore {
         PluginQuirkDontSetNullWindowHandleOnDestroy = 1 << 10,
         PluginQuirkDontAllowMultipleInstances = 1 << 11,
         PluginQuirkRequiresGtkToolKit = 1 << 12,
-        PluginQuirkRequiresDefaultScreenDepth = 1 << 13
+        PluginQuirkRequiresDefaultScreenDepth = 1 << 13,
+        PluginQuirkDontCallSetWindowMoreThanOnce = 1 << 14
     };
 
     class PluginQuirkSet {
diff --git a/WebCore/plugins/gtk/PluginViewGtk.cpp b/WebCore/plugins/gtk/PluginViewGtk.cpp
index dca7dad..78c6636 100644
--- a/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -506,10 +506,10 @@ void PluginView::setNPWindowIfNeeded()
         m_npWindow.width = m_windowRect.width();
         m_npWindow.height = m_windowRect.height();
 
-        m_npWindow.clipRect.left = m_clipRect.x();
-        m_npWindow.clipRect.top = m_clipRect.y();
-        m_npWindow.clipRect.right = m_clipRect.width();
-        m_npWindow.clipRect.bottom = m_clipRect.height();
+        m_npWindow.clipRect.left = max(0, m_clipRect.x());
+        m_npWindow.clipRect.top = max(0, m_clipRect.y());
+        m_npWindow.clipRect.right = m_clipRect.x() + m_clipRect.width();
+        m_npWindow.clipRect.bottom = m_clipRect.y() + m_clipRect.height();
 
         GtkAllocation allocation = { m_windowRect.x(), m_windowRect.y(), m_windowRect.width(), m_windowRect.height() };
         gtk_widget_size_allocate(platformPluginWidget(), &allocation);
@@ -522,6 +522,8 @@ void PluginView::setNPWindowIfNeeded()
     } else {
         m_npWindow.x = 0;
         m_npWindow.y = 0;
+        m_npWindow.width = m_windowRect.width();
+        m_npWindow.height = m_windowRect.height();
 
         m_npWindow.clipRect.left = 0;
         m_npWindow.clipRect.top = 0;
@@ -529,13 +531,6 @@ void PluginView::setNPWindowIfNeeded()
         m_npWindow.clipRect.bottom = 0;
     }
 
-    // FLASH WORKAROUND: Only set initially. Multiple calls to
-    // setNPWindow() cause the plugin to crash in windowed mode.
-    if (!m_isWindowed || m_npWindow.width == (unsigned int)-1 || m_npWindow.height == (unsigned int)-1) {
-        m_npWindow.width = m_windowRect.width();
-        m_npWindow.height = m_windowRect.height();
-    }
-
     PluginView::setCurrentPluginView(this);
     JSC::JSLock::DropAllLocks dropAllLocks(JSC::SilenceAssertionsOnly);
     setCallingPlugin(true);
diff --git a/WebCore/plugins/qt/PluginViewQt.cpp b/WebCore/plugins/qt/PluginViewQt.cpp
index 6a0fa39..0ca356b 100644
--- a/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/WebCore/plugins/qt/PluginViewQt.cpp
@@ -493,10 +493,10 @@ void PluginView::setNPWindowIfNeeded()
         m_npWindow.x = m_windowRect.x();
         m_npWindow.y = m_windowRect.y();
 
-        m_npWindow.clipRect.left = m_clipRect.x();
-        m_npWindow.clipRect.top = m_clipRect.y();
-        m_npWindow.clipRect.right = m_clipRect.width();
-        m_npWindow.clipRect.bottom = m_clipRect.height();
+        m_npWindow.clipRect.left = max(0, m_clipRect.x());
+        m_npWindow.clipRect.top = max(0, m_clipRect.y());
+        m_npWindow.clipRect.right = m_clipRect.x() + m_clipRect.width();
+        m_npWindow.clipRect.bottom = m_clipRect.y() + m_clipRect.height();
     } else {
         m_npWindow.x = 0;
         m_npWindow.y = 0;
@@ -507,9 +507,14 @@ void PluginView::setNPWindowIfNeeded()
         m_npWindow.clipRect.bottom = 0;
     }
 
-    // FLASH WORKAROUND: Only set initially. Multiple calls to
-    // setNPWindow() cause the plugin to crash in windowed mode.
-    if (!m_isWindowed || m_npWindow.width == -1 || m_npWindow.height == -1) {
+    if (m_plugin->quirks().contains(PluginQuirkDontCallSetWindowMoreThanOnce)) {
+        // FLASH WORKAROUND: Only set initially. Multiple calls to
+        // setNPWindow() cause the plugin to crash in windowed mode.
+        if (!m_isWindowed || m_npWindow.width == -1 || m_npWindow.height == -1) {
+            m_npWindow.width = m_windowRect.width();
+            m_npWindow.height = m_windowRect.height();
+        }
+    } else {
         m_npWindow.width = m_windowRect.width();
         m_npWindow.height = m_windowRect.height();
     }
diff --git a/WebCore/plugins/symbian/PluginViewSymbian.cpp b/WebCore/plugins/symbian/PluginViewSymbian.cpp
index 361f946..baa9839 100644
--- a/WebCore/plugins/symbian/PluginViewSymbian.cpp
+++ b/WebCore/plugins/symbian/PluginViewSymbian.cpp
@@ -267,10 +267,10 @@ void PluginView::setNPWindowIfNeeded()
         m_npWindow.x = m_windowRect.x();
         m_npWindow.y = m_windowRect.y();
 
-        m_npWindow.clipRect.left = m_clipRect.x();
-        m_npWindow.clipRect.top = m_clipRect.y();
-        m_npWindow.clipRect.right = m_clipRect.width();
-        m_npWindow.clipRect.bottom = m_clipRect.height();
+        m_npWindow.clipRect.left = max(0, m_clipRect.x());
+        m_npWindow.clipRect.top = max(0, m_clipRect.y());
+        m_npWindow.clipRect.right = m_clipRect.x() + m_clipRect.width();
+        m_npWindow.clipRect.bottom = m_clipRect.y() + m_clipRect.height();
     
     } else {
         // always call this method before painting.
@@ -418,8 +418,10 @@ void PluginView::platformDestroy()
 {
     if (platformPluginWidget()) {
         PluginContainerSymbian* container = static_cast<PluginContainerSymbian*>(platformPluginWidget());
-        delete container->proxy();
-        delete container;
+        if (container && container->proxy())
+            delete container->proxy();
+        else
+            delete container;
     }
 }
 
diff --git a/WebCore/rendering/EllipsisBox.cpp b/WebCore/rendering/EllipsisBox.cpp
index 9d36086..96efbe2 100644
--- a/WebCore/rendering/EllipsisBox.cpp
+++ b/WebCore/rendering/EllipsisBox.cpp
@@ -27,7 +27,7 @@
 
 namespace WebCore {
 
-void EllipsisBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
+void EllipsisBox::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     GraphicsContext* context = paintInfo.context;
     RenderStyle* style = m_renderer->style(m_firstLine);
diff --git a/WebCore/rendering/EllipsisBox.h b/WebCore/rendering/EllipsisBox.h
index 087fc72..476331c 100644
--- a/WebCore/rendering/EllipsisBox.h
+++ b/WebCore/rendering/EllipsisBox.h
@@ -39,7 +39,7 @@ public:
     {
     }
 
-    virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
     void setSelectionState(RenderObject::SelectionState s) { m_selectionState = s; }
     IntRect selectionRect(int tx, int ty);
diff --git a/WebCore/rendering/InlineBox.cpp b/WebCore/rendering/InlineBox.cpp
index 213737c..5475187 100644
--- a/WebCore/rendering/InlineBox.cpp
+++ b/WebCore/rendering/InlineBox.cpp
@@ -159,16 +159,16 @@ void InlineBox::adjustPosition(int dx, int dy)
     }
 }
 
-void InlineBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
+void InlineBox::paint(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!renderer()->shouldPaintWithinRoot(paintInfo) || (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection))
+    if (!paintInfo.shouldPaintWithinRoot(renderer()) || (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection))
         return;
 
     // Paint all phases of replaced elements atomically, as though the replaced element established its
     // own stacking context.  (See Appendix E.2, section 6.4 on inline block/table elements in the CSS2.1
     // specification.)
     bool preservePhase = paintInfo.phase == PaintPhaseSelection || paintInfo.phase == PaintPhaseTextClip;
-    RenderObject::PaintInfo info(paintInfo);
+    PaintInfo info(paintInfo);
     info.phase = preservePhase ? paintInfo.phase : PaintPhaseBlockBackground;
     renderer()->paint(info, tx, ty);
     if (!preservePhase) {
diff --git a/WebCore/rendering/InlineBox.h b/WebCore/rendering/InlineBox.h
index eec9c1b..ab0167c 100644
--- a/WebCore/rendering/InlineBox.h
+++ b/WebCore/rendering/InlineBox.h
@@ -112,7 +112,7 @@ public:
 
     virtual void adjustPosition(int dx, int dy);
 
-    virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
 
     // Overloaded new operator.
diff --git a/WebCore/rendering/InlineFlowBox.cpp b/WebCore/rendering/InlineFlowBox.cpp
index c329b23..c2d8549 100644
--- a/WebCore/rendering/InlineFlowBox.cpp
+++ b/WebCore/rendering/InlineFlowBox.cpp
@@ -648,7 +648,7 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
     return false;
 }
 
-void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
+void InlineFlowBox::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     IntRect overflowRect(visibleOverflowRect());
     overflowRect.inflate(renderer()->maximalOutlineSize(paintInfo.phase));
@@ -687,9 +687,9 @@ void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         return;
 
     PaintPhase paintPhase = paintInfo.phase == PaintPhaseChildOutlines ? PaintPhaseOutline : paintInfo.phase;
-    RenderObject::PaintInfo childInfo(paintInfo);
+    PaintInfo childInfo(paintInfo);
     childInfo.phase = paintPhase;
-    childInfo.paintingRoot = renderer()->paintingRootForChildren(paintInfo);
+    childInfo.updatePaintingRootForChildren(renderer());
     
     // 3. Paint our children.
     if (paintPhase != PaintPhaseSelfOutline) {
@@ -704,7 +704,7 @@ void InlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
         paintTextDecorations(paintInfo, tx, ty, true);
 }
 
-void InlineFlowBox::paintFillLayers(const RenderObject::PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int _tx, int _ty, int w, int h, CompositeOperator op)
+void InlineFlowBox::paintFillLayers(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int _tx, int _ty, int w, int h, CompositeOperator op)
 {
     if (!fillLayer)
         return;
@@ -712,7 +712,7 @@ void InlineFlowBox::paintFillLayers(const RenderObject::PaintInfo& paintInfo, co
     paintFillLayer(paintInfo, c, fillLayer, _tx, _ty, w, h, op);
 }
 
-void InlineFlowBox::paintFillLayer(const RenderObject::PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int w, int h, CompositeOperator op)
+void InlineFlowBox::paintFillLayer(const PaintInfo& paintInfo, const Color& c, const FillLayer* fillLayer, int tx, int ty, int w, int h, CompositeOperator op)
 {
     StyleImage* img = fillLayer->image();
     bool hasFillImage = img && img->canRender(renderer()->style()->effectiveZoom());
@@ -752,9 +752,9 @@ void InlineFlowBox::paintBoxShadow(GraphicsContext* context, RenderStyle* s, Sha
     }
 }
 
-void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int tx, int ty)
+void InlineFlowBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseForeground)
+    if (!paintInfo.shouldPaintWithinRoot(renderer()) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseForeground)
         return;
 
     int x = m_x;
@@ -828,9 +828,9 @@ void InlineFlowBox::paintBoxDecorations(RenderObject::PaintInfo& paintInfo, int
     }
 }
 
-void InlineFlowBox::paintMask(RenderObject::PaintInfo& paintInfo, int tx, int ty)
+void InlineFlowBox::paintMask(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseMask)
+    if (!paintInfo.shouldPaintWithinRoot(renderer()) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseMask)
         return;
 
     int x = m_x;
@@ -920,11 +920,11 @@ static bool shouldDrawTextDecoration(RenderObject* obj)
     return false;
 }
 
-void InlineFlowBox::paintTextDecorations(RenderObject::PaintInfo& paintInfo, int tx, int ty, bool paintedChildren)
+void InlineFlowBox::paintTextDecorations(PaintInfo& paintInfo, int tx, int ty, bool paintedChildren)
 {
     // Paint text decorations like underlines/overlines. We only do this if we aren't in quirks mode (i.e., in
     // almost-strict mode or strict mode).
-    if (renderer()->style()->htmlHacks() || !renderer()->shouldPaintWithinRoot(paintInfo) ||
+    if (renderer()->style()->htmlHacks() || !paintInfo.shouldPaintWithinRoot(renderer()) ||
         renderer()->style()->visibility() != VISIBLE)
         return;
     
diff --git a/WebCore/rendering/InlineFlowBox.h b/WebCore/rendering/InlineFlowBox.h
index b933c09..9589c0a 100644
--- a/WebCore/rendering/InlineFlowBox.h
+++ b/WebCore/rendering/InlineFlowBox.h
@@ -91,13 +91,13 @@ public:
 
     virtual void clearTruncation();
 
-    virtual void paintBoxDecorations(RenderObject::PaintInfo&, int tx, int ty);
-    virtual void paintMask(RenderObject::PaintInfo&, int tx, int ty);
-    void paintFillLayers(const RenderObject::PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
-    void paintFillLayer(const RenderObject::PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
+    virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
+    virtual void paintMask(PaintInfo&, int tx, int ty);
+    void paintFillLayers(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
+    void paintFillLayer(const PaintInfo&, const Color&, const FillLayer*, int tx, int ty, int w, int h, CompositeOperator = CompositeSourceOver);
     void paintBoxShadow(GraphicsContext*, RenderStyle*, ShadowStyle, int tx, int ty, int w, int h);
-    virtual void paintTextDecorations(RenderObject::PaintInfo&, int tx, int ty, bool paintedChildren = false);
-    virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
+    virtual void paintTextDecorations(PaintInfo&, int tx, int ty, bool paintedChildren = false);
+    virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
 
     virtual RenderLineBoxList* rendererLineBoxes() const;
diff --git a/WebCore/rendering/InlineTextBox.cpp b/WebCore/rendering/InlineTextBox.cpp
index 09825b6..d6bd70c 100644
--- a/WebCore/rendering/InlineTextBox.cpp
+++ b/WebCore/rendering/InlineTextBox.cpp
@@ -306,6 +306,31 @@ bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, in
     return false;
 }
 
+FloatSize InlineTextBox::applyShadowToGraphicsContext(GraphicsContext* context, const ShadowData* shadow, const FloatRect& textRect, bool stroked, bool opaque)
+{
+    if (!shadow)
+        return FloatSize();
+
+    FloatSize extraOffset;
+    FloatSize shadowOffset(shadow->x(), shadow->y());
+    int shadowBlur = shadow->blur();
+    const Color& shadowColor = shadow->color();
+
+    if (shadow->next() || stroked || !opaque) {
+        FloatRect shadowRect(textRect);
+        shadowRect.inflate(shadowBlur);
+        shadowRect.move(shadowOffset);
+        context->save();
+        context->clip(shadowRect);
+
+        extraOffset = FloatSize(0, 2 * textRect.height() + max(0.0f, shadowOffset.height()) + shadowBlur);
+        shadowOffset -= extraOffset;
+    }
+
+    context->setShadow(shadowOffset, shadowBlur, shadowColor, context->fillColorSpace());
+    return extraOffset;
+}
+
 static void paintTextWithShadows(GraphicsContext* context, const Font& font, const TextRun& textRun, int startOffset, int endOffset, int truncationPoint, const IntPoint& textOrigin, int x, int y, int w, int h, const ShadowData* shadow, bool stroked)
 {
     Color fillColor = context->fillColor();
@@ -316,24 +341,9 @@ static void paintTextWithShadows(GraphicsContext* context, const Font& font, con
 
     do {
         IntSize extraOffset;
-
-        if (shadow) {
-            IntSize shadowOffset(shadow->x(), shadow->y());
-            int shadowBlur = shadow->blur();
-            const Color& shadowColor = shadow->color();
-
-            if (shadow->next() || stroked || !opaque) {
-                IntRect shadowRect(x, y, w, h);
-                shadowRect.inflate(shadowBlur);
-                shadowRect.move(shadowOffset);
-                context->save();
-                context->clip(shadowRect);
-
-                extraOffset = IntSize(0, 2 * h + max(0, shadowOffset.height()) + shadowBlur);
-                shadowOffset -= extraOffset;
-            }
-            context->setShadow(shadowOffset, shadowBlur, shadowColor, fillColorSpace);
-        } else if (!opaque)
+        if (shadow)
+            extraOffset = roundedIntSize(InlineTextBox::applyShadowToGraphicsContext(context, shadow, FloatRect(x, y, w, h), stroked, opaque));
+        else if (!opaque)
             context->setFillColor(fillColor, fillColorSpace);
 
         if (startOffset <= endOffset)
@@ -357,9 +367,9 @@ static void paintTextWithShadows(GraphicsContext* context, const Font& font, con
     } while (shadow || stroked || !opaque);
 }
 
-void InlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
+void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (isLineBreak() || !renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE ||
+    if (isLineBreak() || !paintInfo.shouldPaintWithinRoot(renderer()) || renderer()->style()->visibility() != VISIBLE ||
         m_truncation == cFullTruncation || paintInfo.phase == PaintPhaseOutline)
         return;
 
diff --git a/WebCore/rendering/InlineTextBox.h b/WebCore/rendering/InlineTextBox.h
index 2ef5ec9..fcbf23a 100644
--- a/WebCore/rendering/InlineTextBox.h
+++ b/WebCore/rendering/InlineTextBox.h
@@ -80,7 +80,7 @@ public:
     virtual void selectionStartEnd(int& sPos, int& ePos);
 
 protected:
-    virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
 
 public:
@@ -121,6 +121,9 @@ public:
 
     bool containsCaretOffset(int offset) const; // false for offset after line break
 
+    // Needs to be public, so the static paintTextWithShadows() function can use it.
+    static FloatSize applyShadowToGraphicsContext(GraphicsContext*, const ShadowData*, const FloatRect& textRect, bool stroked, bool opaque);
+
 private:
     InlineTextBox* m_prevTextBox; // The previous box that also uses our RenderObject
     InlineTextBox* m_nextTextBox; // The next box that also uses our RenderObject
diff --git a/WebCore/rendering/MediaControlElements.cpp b/WebCore/rendering/MediaControlElements.cpp
index 383a8cf..d5cb187 100644
--- a/WebCore/rendering/MediaControlElements.cpp
+++ b/WebCore/rendering/MediaControlElements.cpp
@@ -135,7 +135,7 @@ PassRefPtr<MediaControlElement> MediaControlElement::create(HTMLMediaElement* me
 
 void MediaControlElement::attachToParent(Element* parent)
 {
-    parent->addChild(this);
+    parent->legacyParserAddChild(this);
 }
 
 void MediaControlElement::update()
@@ -389,7 +389,7 @@ MediaControlInputElement::MediaControlInputElement(HTMLMediaElement* mediaElemen
 
 void MediaControlInputElement::attachToParent(Element* parent)
 {
-    parent->addChild(this);
+    parent->legacyParserAddChild(this);
 }
 
 void MediaControlInputElement::update()
diff --git a/WebCore/rendering/PaintInfo.h b/WebCore/rendering/PaintInfo.h
new file mode 100644
index 0000000..213eb30
--- /dev/null
+++ b/WebCore/rendering/PaintInfo.h
@@ -0,0 +1,105 @@
+/*
+ * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
+ *           (C) 2000 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2000 Dirk Mueller (mueller@kde.org)
+ *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef PaintInfo_h
+#define PaintInfo_h
+
+#if ENABLE(SVG)
+#include "AffineTransform.h"
+#endif
+
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "PaintPhase.h"
+#include <wtf/HashMap.h>
+#include <wtf/ListHashSet.h>
+
+namespace WebCore {
+
+class OverlapTestRequestClient;
+class RenderInline;
+class RenderObject;
+
+typedef HashMap<OverlapTestRequestClient*, IntRect> OverlapTestRequestMap;
+
+/*
+ * Paint the object and its children, clipped by (x|y|w|h).
+ * (tx|ty) is the calculated position of the parent
+ */
+struct PaintInfo {
+    PaintInfo(GraphicsContext* newContext, const IntRect& newRect, PaintPhase newPhase, bool newForceBlackText,
+              RenderObject* newPaintingRoot, ListHashSet<RenderInline*>* newOutlineObjects,
+              OverlapTestRequestMap* overlapTestRequests = 0)
+        : context(newContext)
+        , rect(newRect)
+        , phase(newPhase)
+        , forceBlackText(newForceBlackText)
+        , paintingRoot(newPaintingRoot)
+        , outlineObjects(newOutlineObjects)
+        , overlapTestRequests(overlapTestRequests)
+    {
+    }
+
+    void updatePaintingRootForChildren(const RenderObject* renderer)
+    {
+        if (!paintingRoot)
+            return;
+
+        // If we're the painting root, kids draw normally, and see root of 0.
+        if (paintingRoot == renderer) {
+            paintingRoot = 0; 
+            return;
+        }
+    }
+
+    bool shouldPaintWithinRoot(const RenderObject* renderer) const
+    {
+        return !paintingRoot || paintingRoot == renderer;
+    }
+
+#if ENABLE(SVG)
+    void applyTransform(const AffineTransform& localToAncestorTransform)
+    {
+        if (localToAncestorTransform.isIdentity())
+            return;
+
+        context->concatCTM(localToAncestorTransform);
+        rect = localToAncestorTransform.inverse().mapRect(rect);
+    }
+#endif
+
+    // FIXME: Introduce setters/getters at some point. Requires a lot of changes throughout rendering/.
+    GraphicsContext* context;
+    IntRect rect;
+    PaintPhase phase;
+    bool forceBlackText;
+    RenderObject* paintingRoot; // used to draw just one element and its visual kids
+    ListHashSet<RenderInline*>* outlineObjects; // used to list outlines that should be painted by a block with inline children
+    OverlapTestRequestMap* overlapTestRequests;
+};
+
+} // namespace WebCore
+
+#endif // PaintInfo_h
diff --git a/WebCore/rendering/PaintPhase.h b/WebCore/rendering/PaintPhase.h
new file mode 100644
index 0000000..396131f
--- /dev/null
+++ b/WebCore/rendering/PaintPhase.h
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2000 Lars Knoll (knoll@kde.org)
+ *           (C) 2000 Antti Koivisto (koivisto@kde.org)
+ *           (C) 2000 Dirk Mueller (mueller@kde.org)
+ *           (C) 2004 Allan Sandfeld Jensen (kde@carewolf.com)
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009 Google Inc. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef PaintPhase_h
+#define PaintPhase_h
+
+namespace WebCore {
+
+/*
+ *  The painting of a layer occurs in three distinct phases.  Each phase involves
+ *  a recursive descent into the layer's render objects. The first phase is the background phase.
+ *  The backgrounds and borders of all blocks are painted.  Inlines are not painted at all.
+ *  Floats must paint above block backgrounds but entirely below inline content that can overlap them.
+ *  In the foreground phase, all inlines are fully painted.  Inline replaced elements will get all
+ *  three phases invoked on them during this phase.
+ */
+
+enum PaintPhase {
+    PaintPhaseBlockBackground,
+    PaintPhaseChildBlockBackground,
+    PaintPhaseChildBlockBackgrounds,
+    PaintPhaseFloat,
+    PaintPhaseForeground,
+    PaintPhaseOutline,
+    PaintPhaseChildOutlines,
+    PaintPhaseSelfOutline,
+    PaintPhaseSelection,
+    PaintPhaseCollapsedTableBorders,
+    PaintPhaseTextClip,
+    PaintPhaseMask
+};
+
+enum PaintBehaviorFlags {
+    PaintBehaviorNormal = 0,
+    PaintBehaviorSelectionOnly = 1 << 0,
+    PaintBehaviorForceBlackText = 1 << 1,
+    PaintBehaviorFlattenCompositingLayers = 1 << 2
+};
+
+typedef unsigned PaintBehavior;
+
+} // namespace WebCore
+
+#endif // PaintPhase_h
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index f60b13c..58c5842 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -2007,7 +2007,7 @@ void RenderBlock::paint(PaintInfo& paintInfo, int tx, int ty)
     // Our scrollbar widgets paint exactly when we tell them to, so that they work properly with
     // z-index.  We paint after we painted the background/border, so that the scrollbars will
     // sit above the background/border.
-    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && shouldPaintWithinRoot(paintInfo))
+    if (hasOverflowClip() && style()->visibility() == VISIBLE && (phase == PaintPhaseBlockBackground || phase == PaintPhaseChildBlockBackground) && paintInfo.shouldPaintWithinRoot(this))
         layer()->paintOverflowControls(paintInfo.context, tx, ty, paintInfo.rect);
 }
 
@@ -2122,13 +2122,13 @@ void RenderBlock::paintChildren(PaintInfo& paintInfo, int tx, int ty)
     // We don't paint our own background, but we do let the kids paint their backgrounds.
     PaintInfo info(paintInfo);
     info.phase = newPhase;
-    info.paintingRoot = paintingRootForChildren(paintInfo);
+    info.updatePaintingRootForChildren(this);
     bool checkPageBreaks = document()->printing() && !document()->settings()->paginateDuringLayoutEnabled();
     bool checkColumnBreaks = !checkPageBreaks && !view()->printRect().isEmpty() && !document()->settings()->paginateDuringLayoutEnabled();
 
     for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {        
         // Check for page-break-before: always, and if it's set, break and bail.
-        bool checkBeforeAlways = !childrenInline() && (checkPageBreaks && child->style()->pageBreakBefore() == PBALWAYS || checkColumnBreaks && child->style()->columnBreakBefore() == PBALWAYS);
+        bool checkBeforeAlways = !childrenInline() && ((checkPageBreaks && child->style()->pageBreakBefore() == PBALWAYS) || (checkColumnBreaks && child->style()->columnBreakBefore() == PBALWAYS));
         if (checkBeforeAlways
             && (ty + child->y()) > paintInfo.rect.y()
             && (ty + child->y()) < paintInfo.rect.bottom()) {
@@ -2137,7 +2137,7 @@ void RenderBlock::paintChildren(PaintInfo& paintInfo, int tx, int ty)
         }
 
         // Check for page-break-inside: avoid, and it it's set, break and bail.
-        bool checkInsideAvoid = !childrenInline() && (checkPageBreaks && child->style()->pageBreakInside() == PBAVOID || checkColumnBreaks && child->style()->columnBreakInside() == PBAVOID);
+        bool checkInsideAvoid = !childrenInline() && ((checkPageBreaks && child->style()->pageBreakInside() == PBAVOID) || (checkColumnBreaks && child->style()->columnBreakInside() == PBAVOID));
         if (checkInsideAvoid
             && ty + child->y() > paintInfo.rect.y()
             && ty + child->y() < paintInfo.rect.bottom()
@@ -2150,7 +2150,7 @@ void RenderBlock::paintChildren(PaintInfo& paintInfo, int tx, int ty)
             child->paint(info, tx, ty);
 
         // Check for page-break-after: always, and if it's set, break and bail.
-        bool checkAfterAlways = !childrenInline() && (checkPageBreaks && child->style()->pageBreakAfter() == PBALWAYS || checkColumnBreaks && child->style()->columnBreakAfter() == PBALWAYS);
+        bool checkAfterAlways = !childrenInline() && ((checkPageBreaks && child->style()->pageBreakAfter() == PBALWAYS) || (checkColumnBreaks && child->style()->columnBreakAfter() == PBALWAYS));
         if (checkAfterAlways
             && (ty + child->y() + child->height()) > paintInfo.rect.y()
             && (ty + child->y() + child->height()) < paintInfo.rect.bottom()) {
@@ -2289,7 +2289,7 @@ void RenderBlock::paintFloats(PaintInfo& paintInfo, int tx, int ty, bool preserv
 
 void RenderBlock::paintEllipsisBoxes(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!shouldPaintWithinRoot(paintInfo) || !firstLineBox())
+    if (!paintInfo.shouldPaintWithinRoot(this) || !firstLineBox())
         return;
 
     if (style()->visibility() == VISIBLE && paintInfo.phase == PaintPhaseForeground) {
@@ -2452,7 +2452,7 @@ void RenderBlock::paintSelection(PaintInfo& paintInfo, int tx, int ty)
 }
 
 #ifndef BUILDING_ON_TIGER
-static void clipOutPositionedObjects(const RenderObject::PaintInfo* paintInfo, int tx, int ty, RenderBlock::PositionedObjectsListHashSet* positionedObjects)
+static void clipOutPositionedObjects(const PaintInfo* paintInfo, int tx, int ty, RenderBlock::PositionedObjectsListHashSet* positionedObjects)
 {
     if (!positionedObjects)
         return;
@@ -4282,7 +4282,7 @@ int RenderBlock::layoutColumns(int endOfContent, int requestedColumnHeight)
         v->setPrintRect(pageRect);
         v->setTruncatedAt(truncationPoint);
         GraphicsContext context((PlatformGraphicsContext*)0);
-        RenderObject::PaintInfo paintInfo(&context, pageRect, PaintPhaseForeground, false, 0, 0);
+        PaintInfo paintInfo(&context, pageRect, PaintPhaseForeground, false, 0, 0);
         
         setHasColumns(false);
         paintObject(paintInfo, 0, 0);
diff --git a/WebCore/rendering/RenderBlock.h b/WebCore/rendering/RenderBlock.h
index e3a11c8..95d0c29 100644
--- a/WebCore/rendering/RenderBlock.h
+++ b/WebCore/rendering/RenderBlock.h
@@ -295,7 +295,6 @@ private:
     };
 
     // The following functions' implementations are in RenderBlockLineLayout.cpp.
-    void bidiReorderLine(InlineBidiResolver&, const InlineIterator& end, bool previousLineBrokeCleanly);
     RootInlineBox* determineStartPosition(bool& firstLine, bool& fullLayout, bool& previousLineBrokeCleanly,
                                           InlineBidiResolver&, Vector<FloatWithRect>& floats, unsigned& numCleanFloats);
     RootInlineBox* determineEndPosition(RootInlineBox* startBox, InlineIterator& cleanLineStart,
diff --git a/WebCore/rendering/RenderBlockLineLayout.cpp b/WebCore/rendering/RenderBlockLineLayout.cpp
index 097b661..1a7f983 100644
--- a/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -521,12 +521,6 @@ void RenderBlock::computeVerticalPositionsForLine(RootInlineBox* lineBox, BidiRu
     lineBox->markDirty(false);
 }
 
-// collects one line of the paragraph and transforms it to visual order
-void RenderBlock::bidiReorderLine(InlineBidiResolver& resolver, const InlineIterator& end, bool previousLineBrokeCleanly)
-{
-    resolver.createBidiRunsForLine(end, style()->visuallyOrdered(), previousLineBrokeCleanly);
-}
-
 static inline bool isCollapsibleSpace(UChar character, RenderText* renderer)
 {
     if (character == ' ' || character == '\t' || character == softHyphen)
@@ -809,7 +803,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
             ASSERT(end != resolver.position());
 
             if (!isLineEmpty) {
-                bidiReorderLine(resolver, end, previousLineBrokeCleanly);
+                resolver.createBidiRunsForLine(end, style()->visuallyOrdered(), previousLineBrokeCleanly);
                 ASSERT(resolver.position() == end);
 
                 BidiRun* trailingSpaceRun = 0;
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index c845ba7..f337a9a 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -591,7 +591,7 @@ void RenderBox::paint(PaintInfo& paintInfo, int tx, int ty)
 
     // default implementation. Just pass paint through to the children
     PaintInfo childInfo(paintInfo);
-    childInfo.paintingRoot = paintingRootForChildren(paintInfo);
+    childInfo.updatePaintingRootForChildren(this);
     for (RenderObject* child = firstChild(); child; child = child->nextSibling())
         child->paint(childInfo, tx, ty);
 }
@@ -643,7 +643,7 @@ void RenderBox::paintRootBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 
 void RenderBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!shouldPaintWithinRoot(paintInfo))
+    if (!paintInfo.shouldPaintWithinRoot(this))
         return;
 
     if (isRoot()) {
@@ -685,7 +685,7 @@ void RenderBox::paintBoxDecorationsWithSize(PaintInfo& paintInfo, int tx, int ty
 
 void RenderBox::paintMask(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!shouldPaintWithinRoot(paintInfo) || style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseMask)
+    if (!paintInfo.shouldPaintWithinRoot(this) || style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseMask)
         return;
 
     int w = width();
@@ -2972,13 +2972,4 @@ void RenderBox::clearLayoutOverflow()
     m_overflow->resetLayoutOverflow(borderBoxRect());
 }
 
-#if ENABLE(SVG)
-
-AffineTransform RenderBox::localTransform() const
-{
-    return AffineTransform(1, 0, 0, 1, x(), y());
-}
-
-#endif
-
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderBox.h b/WebCore/rendering/RenderBox.h
index c033275..3e95cea 100644
--- a/WebCore/rendering/RenderBox.h
+++ b/WebCore/rendering/RenderBox.h
@@ -297,10 +297,6 @@ public:
     bool shrinkToAvoidFloats() const;
     virtual bool avoidsFloats() const;
 
-#if ENABLE(SVG)
-    virtual AffineTransform localTransform() const;
-#endif
-
 protected:
     virtual void styleWillChange(StyleDifference, const RenderStyle* newStyle);
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
diff --git a/WebCore/rendering/RenderBoxModelObject.cpp b/WebCore/rendering/RenderBoxModelObject.cpp
index 3f1b5ae..c81289b 100644
--- a/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/WebCore/rendering/RenderBoxModelObject.cpp
@@ -30,6 +30,7 @@
 #include "HTMLElement.h"
 #include "HTMLNames.h"
 #include "ImageBuffer.h"
+#include "Path.h"
 #include "RenderBlock.h"
 #include "RenderInline.h"
 #include "RenderLayer.h"
@@ -931,9 +932,182 @@ bool RenderBoxModelObject::paintNinePieceImage(GraphicsContext* graphicsContext,
     return true;
 }
 
+#if HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
+static bool borderWillArcInnerEdge(const IntSize& firstRadius, const IntSize& secondRadius, int firstBorderWidth, int secondBorderWidth, int middleBorderWidth)
+{
+    // FIXME: This test is insufficient. We need to take border style into account.
+    return (!firstRadius.width() || firstRadius.width() >= firstBorderWidth)
+            && (!firstRadius.height() || firstRadius.height() >= middleBorderWidth)
+            && (!secondRadius.width() || secondRadius.width() >= secondBorderWidth)
+            && (!secondRadius.height() || secondRadius.height() >= middleBorderWidth);
+}
+
+void RenderBoxModelObject::paintBorder(GraphicsContext* graphicsContext, int tx, int ty, int w, int h,
+                                       const RenderStyle* style, bool begin, bool end)
+{
+    if (paintNinePieceImage(graphicsContext, tx, ty, w, h, style, style->borderImage()))
+        return;
+
+    if (graphicsContext->paintingDisabled())
+        return;
+
+    const Color& topColor = style->visitedDependentColor(CSSPropertyBorderTopColor);
+    const Color& bottomColor = style->visitedDependentColor(CSSPropertyBorderBottomColor);
+    const Color& leftColor = style->visitedDependentColor(CSSPropertyBorderLeftColor);
+    const Color& rightColor = style->visitedDependentColor(CSSPropertyBorderRightColor);
+
+    bool topTransparent = style->borderTopIsTransparent();
+    bool bottomTransparent = style->borderBottomIsTransparent();
+    bool rightTransparent = style->borderRightIsTransparent();
+    bool leftTransparent = style->borderLeftIsTransparent();
+
+    EBorderStyle topStyle = style->borderTopStyle();
+    EBorderStyle bottomStyle = style->borderBottomStyle();
+    EBorderStyle leftStyle = style->borderLeftStyle();
+    EBorderStyle rightStyle = style->borderRightStyle();
+
+    bool renderTop = topStyle > BHIDDEN && !topTransparent;
+    bool renderLeft = leftStyle > BHIDDEN && begin && !leftTransparent;
+    bool renderRight = rightStyle > BHIDDEN && end && !rightTransparent;
+    bool renderBottom = bottomStyle > BHIDDEN && !bottomTransparent;
+
+    bool renderRadii = false;
+    Path roundedPath;
+    IntSize topLeft, topRight, bottomLeft, bottomRight;
+    IntRect borderRect(tx, ty, w, h);
+
+    if (style->hasBorderRadius()) {
+        IntSize topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius;
+        style->getBorderRadiiForRect(borderRect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+        IntRect innerBorderRect = borderInnerRect(borderRect, style->borderTopWidth(), style->borderBottomWidth(), 
+            style->borderLeftWidth(), style->borderRightWidth());
+
+        IntSize innerTopLeftRadius, innerTopRightRadius, innerBottomLeftRadius, innerBottomRightRadius;
+        style->getInnerBorderRadiiForRectWithBorderWidths(innerBorderRect, style->borderTopWidth(), style->borderBottomWidth(), 
+            style->borderLeftWidth(), style->borderRightWidth(), innerTopLeftRadius, innerTopRightRadius, 
+            innerBottomLeftRadius, innerBottomRightRadius);
+
+        if (begin) {
+            topLeft = topLeftRadius;
+            bottomLeft = bottomLeftRadius;
+        }
+        if (end) {
+            topRight = topRightRadius;
+            bottomRight = bottomRightRadius;
+        }
+
+        renderRadii = true;
+
+        // Clip to the inner and outer radii rects.
+        graphicsContext->save();
+        graphicsContext->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+        graphicsContext->clipOutRoundedRect(innerBorderRect, innerTopLeftRadius, innerTopRightRadius, innerBottomLeftRadius, innerBottomRightRadius);
+
+        roundedPath = Path::createRoundedRectangle(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+        graphicsContext->addPath(roundedPath);
+    }
+
+    if (renderTop) {
+        int x = tx;
+        int x2 = tx + w;
+
+        if (renderRadii && borderWillArcInnerEdge(topLeft, topRight, style->borderLeftWidth(), style->borderRightWidth(), style->borderTopWidth())) {
+            graphicsContext->save();
+            clipBorderSidePolygon(graphicsContext, borderRect, topLeft, topRight, bottomLeft, bottomRight, BSTop, style);
+            float thickness = max(max(style->borderTopWidth(), style->borderLeftWidth()), style->borderRightWidth());
+            drawBoxSideFromPath(graphicsContext, borderRect, roundedPath, style->borderTopWidth(), thickness, BSTop, style, topColor, topStyle);
+            graphicsContext->restore();
+        } else {
+            bool ignoreLeft = (topColor == leftColor && topTransparent == leftTransparent && topStyle >= OUTSET
+                && (leftStyle == DOTTED || leftStyle == DASHED || leftStyle == SOLID || leftStyle == OUTSET));
+            bool ignoreRight = (topColor == rightColor && topTransparent == rightTransparent && topStyle >= OUTSET
+                && (rightStyle == DOTTED || rightStyle == DASHED || rightStyle == SOLID || rightStyle == INSET));
+
+            drawLineForBoxSide(graphicsContext, x, ty, x2, ty + style->borderTopWidth(), BSTop, topColor, topStyle,
+                    ignoreLeft ? 0 : style->borderLeftWidth(), ignoreRight ? 0 : style->borderRightWidth());               
+        }
+    }
+
+    if (renderBottom) {
+        int x = tx;
+        int x2 = tx + w;
+
+        if (renderRadii && borderWillArcInnerEdge(bottomLeft, bottomRight, style->borderLeftWidth(), style->borderRightWidth(), style->borderBottomWidth())) {
+            graphicsContext->save();
+            clipBorderSidePolygon(graphicsContext, borderRect, topLeft, topRight, bottomLeft, bottomRight, BSBottom, style);
+            float thickness = max(max(style->borderBottomWidth(), style->borderLeftWidth()), style->borderRightWidth());
+            drawBoxSideFromPath(graphicsContext, borderRect, roundedPath, style->borderBottomWidth(), thickness, BSBottom, style, bottomColor, bottomStyle);
+            graphicsContext->restore();
+        } else {
+            bool ignoreLeft = (bottomColor == leftColor && bottomTransparent == leftTransparent && bottomStyle >= OUTSET
+                && (leftStyle == DOTTED || leftStyle == DASHED || leftStyle == SOLID || leftStyle == OUTSET));
+
+            bool ignoreRight = (bottomColor == rightColor && bottomTransparent == rightTransparent && bottomStyle >= OUTSET
+                && (rightStyle == DOTTED || rightStyle == DASHED || rightStyle == SOLID || rightStyle == INSET));
+
+            drawLineForBoxSide(graphicsContext, x, ty + h - style->borderBottomWidth(), x2, ty + h, BSBottom, bottomColor, 
+                        bottomStyle, ignoreLeft ? 0 : style->borderLeftWidth(), 
+                        ignoreRight ? 0 : style->borderRightWidth());
+        }
+    }
+
+    if (renderLeft) {
+        int y = ty;
+        int y2 = ty + h;
+
+        if (renderRadii && borderWillArcInnerEdge(bottomLeft, topLeft, style->borderBottomWidth(), style->borderTopWidth(), style->borderLeftWidth())) {
+            graphicsContext->save();
+            clipBorderSidePolygon(graphicsContext, borderRect, topLeft, topRight, bottomLeft, bottomRight, BSLeft, style);
+            float thickness = max(max(style->borderLeftWidth(), style->borderTopWidth()), style->borderBottomWidth());
+            drawBoxSideFromPath(graphicsContext, borderRect, roundedPath, style->borderLeftWidth(), thickness, BSLeft, style, leftColor, leftStyle);
+            graphicsContext->restore();
+        } else {
+            bool ignoreTop = (topColor == leftColor && topTransparent == leftTransparent && leftStyle >= OUTSET
+                && (topStyle == DOTTED || topStyle == DASHED || topStyle == SOLID || topStyle == OUTSET));
+
+            bool ignoreBottom = (bottomColor == leftColor && bottomTransparent == leftTransparent && leftStyle >= OUTSET
+                && (bottomStyle == DOTTED || bottomStyle == DASHED || bottomStyle == SOLID || bottomStyle == INSET));
+
+            drawLineForBoxSide(graphicsContext, tx, y, tx + style->borderLeftWidth(), y2, BSLeft, leftColor,
+                        leftStyle, ignoreTop ? 0 : style->borderTopWidth(), ignoreBottom ? 0 : style->borderBottomWidth());
+        }
+    }
+
+    if (renderRight) {
+        if (renderRadii && borderWillArcInnerEdge(bottomRight, topRight, style->borderBottomWidth(), style->borderTopWidth(), style->borderRightWidth())) {
+            graphicsContext->save();
+            clipBorderSidePolygon(graphicsContext, borderRect, topLeft, topRight, bottomLeft, bottomRight, BSRight, style);
+            float thickness = max(max(style->borderRightWidth(), style->borderTopWidth()), style->borderBottomWidth());
+            drawBoxSideFromPath(graphicsContext, borderRect, roundedPath, style->borderRightWidth(), thickness, BSRight, style, rightColor, rightStyle);
+            graphicsContext->restore();
+        } else {
+            bool ignoreTop = ((topColor == rightColor) && (topTransparent == rightTransparent)
+                && (rightStyle >= DOTTED || rightStyle == INSET)
+                && (topStyle == DOTTED || topStyle == DASHED || topStyle == SOLID || topStyle == OUTSET));
+
+            bool ignoreBottom = ((bottomColor == rightColor) && (bottomTransparent == rightTransparent)
+                && (rightStyle >= DOTTED || rightStyle == INSET)
+                && (bottomStyle == DOTTED || bottomStyle == DASHED || bottomStyle == SOLID || bottomStyle == INSET));
+
+            int y = ty;
+            int y2 = ty + h;
+
+            drawLineForBoxSide(graphicsContext, tx + w - style->borderRightWidth(), y, tx + w, y2, BSRight, rightColor, 
+                rightStyle, ignoreTop ? 0 : style->borderTopWidth(), 
+                ignoreBottom ? 0 : style->borderBottomWidth());
+        }
+    }
+
+    if (renderRadii)
+        graphicsContext->restore();
+}
+#else
 void RenderBoxModelObject::paintBorder(GraphicsContext* graphicsContext, int tx, int ty, int w, int h,
                                        const RenderStyle* style, bool begin, bool end)
 {
+    // FIXME: This old version of paintBorder should be removed when all ports implement 
+    // GraphicsContext::clipConvexPolygon()!! This should happen soon.
     if (paintNinePieceImage(graphicsContext, tx, ty, w, h, style, style->borderImage()))
         return;
 
@@ -1279,6 +1453,65 @@ void RenderBoxModelObject::paintBorder(GraphicsContext* graphicsContext, int tx,
     if (renderRadii)
         graphicsContext->restore();
 }
+#endif
+
+void RenderBoxModelObject::clipBorderSidePolygon(GraphicsContext* graphicsContext, const IntRect& box, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const BoxSide side, const RenderStyle* style)
+{
+    FloatPoint quad[4];
+    int tx = box.x();
+    int ty = box.y();
+    int w = box.width();
+    int h = box.height();
+
+    // For each side, create an array of FloatPoints where each point is based on whichever value in each corner
+    // is larger -- the radius width/height or the border width/height -- as appropriate.
+    switch (side) {
+    case BSTop:
+        quad[0] = FloatPoint(tx, ty);
+        quad[1] = FloatPoint(
+            tx + max(topLeft.width(), (int) style->borderLeftWidth()), 
+            ty + max(topLeft.height(), (int) style->borderTopWidth()));
+        quad[2] = FloatPoint(
+            tx + w - max(topRight.width(), (int) style->borderRightWidth()), 
+            ty + max(topRight.height(), (int)style->borderTopWidth()));
+        quad[3] = FloatPoint(tx + w, ty);
+        break;
+    case BSLeft:
+        quad[0] = FloatPoint(tx, ty);
+        quad[1] = FloatPoint(
+            tx + max(topLeft.width(), (int) style->borderLeftWidth()), 
+            ty + max(topLeft.height(), (int) style->borderTopWidth()));
+        quad[2] = FloatPoint(
+            tx + max(bottomLeft.width(), (int) style->borderLeftWidth()), 
+            ty + h - max(bottomLeft.height(), (int)style->borderBottomWidth()));
+        quad[3] = FloatPoint(tx, ty + h);
+        break;
+    case BSBottom:
+        quad[0] = FloatPoint(tx, ty + h);
+        quad[1] = FloatPoint(
+            tx + max(bottomLeft.width(), (int) style->borderLeftWidth()), 
+            ty + h - max(bottomLeft.height(), (int)style->borderBottomWidth()));
+        quad[2] = FloatPoint(
+            tx + w - max(bottomRight.width(), (int) style->borderRightWidth()), 
+            ty + h - max(bottomRight.height(), (int)style->borderBottomWidth()));
+        quad[3] = FloatPoint(tx + w, ty + h);
+        break;
+    case BSRight:
+        quad[0] = FloatPoint(tx + w, ty);
+        quad[1] = FloatPoint(
+            tx + w - max(topRight.width(), (int) style->borderRightWidth()), 
+            ty + max(topRight.height(), (int) style->borderTopWidth()));
+        quad[2] = FloatPoint(
+            tx + w - max(bottomRight.width(), (int) style->borderRightWidth()), 
+            ty + h - max(bottomRight.height(), (int)style->borderBottomWidth()));
+        quad[3] = FloatPoint(tx + w, ty + h);
+        break;
+    default:
+        break;
+    }
+
+    graphicsContext->clipConvexPolygon(4, quad);
+}
 
 void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int ty, int w, int h, const RenderStyle* s, ShadowStyle shadowStyle, bool begin, bool end)
 {
diff --git a/WebCore/rendering/RenderBoxModelObject.h b/WebCore/rendering/RenderBoxModelObject.h
index f022495..45602f0 100644
--- a/WebCore/rendering/RenderBoxModelObject.h
+++ b/WebCore/rendering/RenderBoxModelObject.h
@@ -115,6 +115,8 @@ private:
 
     IntSize calculateFillTileSize(const FillLayer*, IntSize scaledSize) const;
 
+    void clipBorderSidePolygon(GraphicsContext*, const IntRect&, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const BoxSide side, const RenderStyle* style);
+
     friend class RenderView;
 
     RenderLayer* m_layer;
diff --git a/WebCore/rendering/RenderEmbeddedObject.cpp b/WebCore/rendering/RenderEmbeddedObject.cpp
index 7ab12a1..3d6575c 100644
--- a/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -67,6 +67,7 @@ static const float replacementTextTextOpacity = 0.55f;
 RenderEmbeddedObject::RenderEmbeddedObject(Element* element)
     : RenderPart(element)
     , m_hasFallbackContent(false)
+    , m_showsMissingPluginIndicator(false)
 {
     view()->frameView()->setIsVisuallyNonEmpty();
 }
@@ -344,11 +345,14 @@ void RenderEmbeddedObject::updateWidget(bool onlyCreateNonNetscapePlugins)
 
 void RenderEmbeddedObject::setShowsMissingPluginIndicator()
 {
+    ASSERT(m_replacementText.isEmpty());
     m_replacementText = missingPluginText();
+    m_showsMissingPluginIndicator = true;
 }
 
 void RenderEmbeddedObject::setShowsCrashedPluginIndicator()
 {
+    ASSERT(m_replacementText.isEmpty());
     m_replacementText = crashedPluginText();
 }
 
diff --git a/WebCore/rendering/RenderEmbeddedObject.h b/WebCore/rendering/RenderEmbeddedObject.h
index b68108d..bfb7b96 100644
--- a/WebCore/rendering/RenderEmbeddedObject.h
+++ b/WebCore/rendering/RenderEmbeddedObject.h
@@ -37,6 +37,7 @@ public:
     void updateWidget(bool onlyCreateNonNetscapePlugins);
     void setShowsMissingPluginIndicator();
     void setShowsCrashedPluginIndicator();
+    bool showsMissingPluginIndicator() const { return m_showsMissingPluginIndicator; }
 
     bool hasFallbackContent() const { return m_hasFallbackContent; }
 
@@ -60,6 +61,7 @@ private:
 
     String m_replacementText;
     bool m_hasFallbackContent;
+    bool m_showsMissingPluginIndicator;
 };
 
 inline RenderEmbeddedObject* toRenderEmbeddedObject(RenderObject* object)
diff --git a/WebCore/rendering/RenderFieldset.cpp b/WebCore/rendering/RenderFieldset.cpp
index 734c348..bd245c7 100644
--- a/WebCore/rendering/RenderFieldset.cpp
+++ b/WebCore/rendering/RenderFieldset.cpp
@@ -120,7 +120,7 @@ RenderBox* RenderFieldset::findLegend() const
 
 void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!shouldPaintWithinRoot(paintInfo))
+    if (!paintInfo.shouldPaintWithinRoot(this))
         return;
 
     int w = width();
diff --git a/WebCore/rendering/RenderForeignObject.cpp b/WebCore/rendering/RenderForeignObject.cpp
index 9f0889b..4b94bab 100644
--- a/WebCore/rendering/RenderForeignObject.cpp
+++ b/WebCore/rendering/RenderForeignObject.cpp
@@ -47,10 +47,9 @@ void RenderForeignObject::paint(PaintInfo& paintInfo, int, int)
 
     PaintInfo childPaintInfo(paintInfo);
     childPaintInfo.context->save();
+    childPaintInfo.applyTransform(localTransform());
 
-    applyTransformToPaintInfo(childPaintInfo, localTransform());
-
-    if (SVGRenderBase::isOverflowHidden(this))
+    if (SVGRenderSupport::isOverflowHidden(this))
         childPaintInfo.context->clip(m_viewport);
 
     float opacity = style()->opacity();
@@ -67,12 +66,12 @@ void RenderForeignObject::paint(PaintInfo& paintInfo, int, int)
 
 IntRect RenderForeignObject::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
-    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
+    return SVGRenderSupport::clippedOverflowRectForRepaint(this, repaintContainer);
 }
 
 void RenderForeignObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
-    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
+    SVGRenderSupport::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
 const AffineTransform& RenderForeignObject::localToParentTransform() const
@@ -128,7 +127,7 @@ bool RenderForeignObject::nodeAtFloatPoint(const HitTestRequest& request, HitTes
     FloatPoint localPoint = localTransform().inverse().mapPoint(pointInParent);
 
     // Early exit if local point is not contained in clipped viewport area
-    if (SVGRenderBase::isOverflowHidden(this) && !m_viewport.contains(localPoint))
+    if (SVGRenderSupport::isOverflowHidden(this) && !m_viewport.contains(localPoint))
         return false;
 
     IntPoint roundedLocalPoint = roundedIntPoint(localPoint);
@@ -146,7 +145,7 @@ void RenderForeignObject::mapLocalToContainer(RenderBoxModelObject* repaintConta
     // When crawling up the hierachy starting from foreignObject child content, useTransforms may not be set to true.
     if (!useTransforms)
         useTransforms = true;
-    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
+    SVGRenderSupport::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
 }
 
 }
diff --git a/WebCore/rendering/RenderInputSpeech.cpp b/WebCore/rendering/RenderInputSpeech.cpp
new file mode 100644
index 0000000..df17944
--- /dev/null
+++ b/WebCore/rendering/RenderInputSpeech.cpp
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "RenderInputSpeech.h"
+
+#if ENABLE(INPUT_SPEECH)
+
+#include "GraphicsContext.h"
+#include "HTMLNames.h"
+#include "RenderBox.h"
+
+namespace WebCore {
+
+static const float defaultControlFontPixelSize = 13;
+static const float defaultSpeechButtonSize = 16;
+static const float minSpeechButtonSize = 8;
+static const float maxSpeechButtonSize = 40;
+
+void RenderInputSpeech::adjustInputFieldSpeechButtonStyle(CSSStyleSelector*, RenderStyle* style, Element*)
+{
+    // Scale the button size based on the font size.
+    float fontScale = style->fontSize() / defaultControlFontPixelSize;
+    int speechButtonSize = lroundf(std::min(std::max(minSpeechButtonSize, defaultSpeechButtonSize * fontScale), maxSpeechButtonSize));
+    style->setWidth(Length(speechButtonSize, Fixed));
+    style->setHeight(Length(speechButtonSize, Fixed));
+}
+
+bool RenderInputSpeech::paintInputFieldSpeechButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    // Get the renderer of <input> element.
+    Node* input = object->node()->shadowAncestorNode();
+    if (!input->renderer()->isBox())
+        return false;
+    RenderBox* inputRenderBox = toRenderBox(input->renderer());
+    IntRect inputContentBox = inputRenderBox->contentBoxRect();
+
+    // Make sure the scaled button stays square and will fit in its parent's box.
+    int buttonSize = std::min(inputContentBox.width(), std::min(inputContentBox.height(), rect.height()));
+    // Calculate button's coordinates relative to the input element.
+    // Center the button vertically.  Round up though, so if it has to be one pixel off-center, it will
+    // be one pixel closer to the bottom of the field.  This tends to look better with the text.
+    IntRect buttonRect(object->offsetFromAncestorContainer(inputRenderBox).width(),
+                       inputContentBox.y() + (inputContentBox.height() - buttonSize + 1) / 2,
+                       buttonSize, buttonSize);
+
+    // Compute an offset between the part renderer and the input renderer.
+    IntSize offsetFromInputRenderer = -(object->offsetFromAncestorContainer(inputRenderBox));
+    // Move the rect into partRenderer's coords.
+    buttonRect.move(offsetFromInputRenderer);
+    // Account for the local drawing offset.
+    buttonRect.move(rect.x(), rect.y());
+
+    DEFINE_STATIC_LOCAL(RefPtr<Image>, imageStateNormal, (Image::loadPlatformResource("inputSpeech")));
+    paintInfo.context->drawImage(imageStateNormal.get(), object->style()->colorSpace(), buttonRect);
+
+    return false;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INPUT_SPEECH)
diff --git a/WebCore/rendering/RenderInputSpeech.h b/WebCore/rendering/RenderInputSpeech.h
new file mode 100644
index 0000000..63ef8ae
--- /dev/null
+++ b/WebCore/rendering/RenderInputSpeech.h
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef RenderInputSpeech_h
+#define RenderInputSpeech_h
+
+#include "RenderObject.h"
+
+#if ENABLE(INPUT_SPEECH)
+
+namespace WebCore {
+
+class RenderInputSpeech {
+public:
+    static void adjustInputFieldSpeechButtonStyle(CSSStyleSelector*, RenderStyle*, Element*);
+    static bool paintInputFieldSpeechButton(RenderObject*, const PaintInfo&, const IntRect&);
+};
+
+} // namespace WebCore
+
+#endif
+#endif // RenderInputSpeech_h
diff --git a/WebCore/rendering/RenderLayer.cpp b/WebCore/rendering/RenderLayer.cpp
index fcb9c07..a672f4b 100644
--- a/WebCore/rendering/RenderLayer.cpp
+++ b/WebCore/rendering/RenderLayer.cpp
@@ -2257,10 +2257,10 @@ bool RenderLayer::scroll(ScrollDirection direction, ScrollGranularity granularit
 
 void RenderLayer::paint(GraphicsContext* p, const IntRect& damageRect, PaintBehavior paintBehavior, RenderObject *paintingRoot)
 {
-    RenderObject::OverlapTestRequestMap overlapTestRequests;
+    OverlapTestRequestMap overlapTestRequests;
     paintLayer(this, p, damageRect, paintBehavior, paintingRoot, &overlapTestRequests);
-    RenderObject::OverlapTestRequestMap::iterator end = overlapTestRequests.end();
-    for (RenderObject::OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it)
+    OverlapTestRequestMap::iterator end = overlapTestRequests.end();
+    for (OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it)
         it->first->setOverlapTestResult(false);
 }
 
@@ -2279,11 +2279,11 @@ static void restoreClip(GraphicsContext* p, const IntRect& paintDirtyRect, const
     p->restore();
 }
 
-static void performOverlapTests(RenderObject::OverlapTestRequestMap& overlapTestRequests, const IntRect& layerBounds)
+static void performOverlapTests(OverlapTestRequestMap& overlapTestRequests, const IntRect& layerBounds)
 {
     Vector<OverlapTestRequestClient*> overlappedRequestClients;
-    RenderObject::OverlapTestRequestMap::iterator end = overlapTestRequests.end();
-    for (RenderObject::OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it) {
+    OverlapTestRequestMap::iterator end = overlapTestRequests.end();
+    for (OverlapTestRequestMap::iterator it = overlapTestRequests.begin(); it != end; ++it) {
         if (!layerBounds.intersects(it->second))
             continue;
 
@@ -2303,7 +2303,7 @@ static bool shouldDoSoftwarePaint(const RenderLayer* layer, bool paintingReflect
 
 void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
                         const IntRect& paintDirtyRect, PaintBehavior paintBehavior,
-                        RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* overlapTestRequests,
+                        RenderObject* paintingRoot, OverlapTestRequestMap* overlapTestRequests,
                         PaintLayerFlags paintFlags)
 {
 #if USE(ACCELERATED_COMPOSITING)
@@ -2425,7 +2425,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         setClip(p, paintDirtyRect, damageRect);
 
         // Paint the background.
-        RenderObject::PaintInfo paintInfo(p, damageRect, PaintPhaseBlockBackground, false, paintingRootForRenderer, 0);
+        PaintInfo paintInfo(p, damageRect, PaintPhaseBlockBackground, false, paintingRootForRenderer, 0);
         renderer()->paint(paintInfo, tx, ty);
 
         // Restore the clip.
@@ -2443,7 +2443,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
 
         // Set up the clip used when painting our children.
         setClip(p, paintDirtyRect, clipRectToApply);
-        RenderObject::PaintInfo paintInfo(p, clipRectToApply, 
+        PaintInfo paintInfo(p, clipRectToApply, 
                                           selectionOnly ? PaintPhaseSelection : PaintPhaseChildBlockBackgrounds,
                                           forceBlackText, paintingRootForRenderer, 0);
         renderer()->paint(paintInfo, tx, ty);
@@ -2463,7 +2463,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
     
     if (!outlineRect.isEmpty() && isSelfPaintingLayer()) {
         // Paint our own outline
-        RenderObject::PaintInfo paintInfo(p, outlineRect, PaintPhaseSelfOutline, false, paintingRootForRenderer, 0);
+        PaintInfo paintInfo(p, outlineRect, PaintPhaseSelfOutline, false, paintingRootForRenderer, 0);
         setClip(p, paintDirtyRect, outlineRect);
         renderer()->paint(paintInfo, tx, ty);
         restoreClip(p, paintDirtyRect, outlineRect);
@@ -2479,7 +2479,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
         setClip(p, paintDirtyRect, damageRect);
 
         // Paint the mask.
-        RenderObject::PaintInfo paintInfo(p, damageRect, PaintPhaseMask, false, paintingRootForRenderer, 0);
+        PaintInfo paintInfo(p, damageRect, PaintPhaseMask, false, paintingRootForRenderer, 0);
         renderer()->paint(paintInfo, tx, ty);
         
         // Restore the clip.
@@ -2496,7 +2496,7 @@ void RenderLayer::paintLayer(RenderLayer* rootLayer, GraphicsContext* p,
 
 void RenderLayer::paintList(Vector<RenderLayer*>* list, RenderLayer* rootLayer, GraphicsContext* p,
                             const IntRect& paintDirtyRect, PaintBehavior paintBehavior,
-                            RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* overlapTestRequests,
+                            RenderObject* paintingRoot, OverlapTestRequestMap* overlapTestRequests,
                             PaintLayerFlags paintFlags)
 {
     if (!list)
@@ -2513,7 +2513,7 @@ void RenderLayer::paintList(Vector<RenderLayer*>* list, RenderLayer* rootLayer,
 
 void RenderLayer::paintPaginatedChildLayer(RenderLayer* childLayer, RenderLayer* rootLayer, GraphicsContext* context,
                                              const IntRect& paintDirtyRect, PaintBehavior paintBehavior,
-                                             RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* overlapTestRequests,
+                                             RenderObject* paintingRoot, OverlapTestRequestMap* overlapTestRequests,
                                              PaintLayerFlags paintFlags)
 {
     // We need to do multiple passes, breaking up our child layer into strips.
@@ -2534,7 +2534,7 @@ void RenderLayer::paintPaginatedChildLayer(RenderLayer* childLayer, RenderLayer*
 
 void RenderLayer::paintChildLayerIntoColumns(RenderLayer* childLayer, RenderLayer* rootLayer, GraphicsContext* context,
                                              const IntRect& paintDirtyRect, PaintBehavior paintBehavior,
-                                             RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* overlapTestRequests,
+                                             RenderObject* paintingRoot, OverlapTestRequestMap* overlapTestRequests,
                                              PaintLayerFlags paintFlags, const Vector<RenderLayer*>& columnLayers, size_t colIndex)
 {
     RenderBlock* columnBlock = toRenderBlock(columnLayers[colIndex]->renderer());
diff --git a/WebCore/rendering/RenderLayer.h b/WebCore/rendering/RenderLayer.h
index 45b64e0..e8c290b 100644
--- a/WebCore/rendering/RenderLayer.h
+++ b/WebCore/rendering/RenderLayer.h
@@ -487,19 +487,19 @@ private:
     typedef unsigned PaintLayerFlags;
 
     void paintLayer(RenderLayer* rootLayer, GraphicsContext*, const IntRect& paintDirtyRect,
-                    PaintBehavior, RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap* = 0,
+                    PaintBehavior, RenderObject* paintingRoot, OverlapTestRequestMap* = 0,
                     PaintLayerFlags = 0);
     void paintList(Vector<RenderLayer*>*, RenderLayer* rootLayer, GraphicsContext* p,
                    const IntRect& paintDirtyRect, PaintBehavior,
-                   RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap*,
+                   RenderObject* paintingRoot, OverlapTestRequestMap*,
                    PaintLayerFlags);
     void paintPaginatedChildLayer(RenderLayer* childLayer, RenderLayer* rootLayer, GraphicsContext*,
                                   const IntRect& paintDirtyRect, PaintBehavior,
-                                  RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap*,
+                                  RenderObject* paintingRoot, OverlapTestRequestMap*,
                                   PaintLayerFlags);
     void paintChildLayerIntoColumns(RenderLayer* childLayer, RenderLayer* rootLayer, GraphicsContext*,
                                     const IntRect& paintDirtyRect, PaintBehavior,
-                                    RenderObject* paintingRoot, RenderObject::OverlapTestRequestMap*,
+                                    RenderObject* paintingRoot, OverlapTestRequestMap*,
                                     PaintLayerFlags, const Vector<RenderLayer*>& columnLayers, size_t columnIndex);
 
     RenderLayer* hitTestLayer(RenderLayer* rootLayer, RenderLayer* containerLayer, const HitTestRequest& request, HitTestResult& result,
diff --git a/WebCore/rendering/RenderLayerBacking.cpp b/WebCore/rendering/RenderLayerBacking.cpp
index 794b55a..c5a7e19 100644
--- a/WebCore/rendering/RenderLayerBacking.cpp
+++ b/WebCore/rendering/RenderLayerBacking.cpp
@@ -955,7 +955,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
         // Establish the clip used to paint our background.
         setClip(context, paintDirtyRect, damageRect);
         
-        RenderObject::PaintInfo info(context, paintBox, PaintPhaseBlockBackground, false, paintingRootForRenderer, 0);
+        PaintInfo info(context, paintBox, PaintPhaseBlockBackground, false, paintingRootForRenderer, 0);
         renderer()->paint(info, tx, ty);
 
         // Our scrollbar widgets paint exactly when we tell them to, so that they work properly with
@@ -981,7 +981,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 
         // Set up the clip used when painting our children.
         setClip(context, paintDirtyRect, clipRectToApply);
-        RenderObject::PaintInfo paintInfo(context, clipRectToApply, 
+        PaintInfo paintInfo(context, clipRectToApply, 
                                           selectionOnly ? PaintPhaseSelection : PaintPhaseChildBlockBackgrounds,
                                           forceBlackText, paintingRootForRenderer, 0);
         renderer()->paint(paintInfo, tx, ty);
@@ -1002,7 +1002,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
 
         if (!outlineRect.isEmpty()) {
             // Paint our own outline
-            RenderObject::PaintInfo paintInfo(context, outlineRect, PaintPhaseSelfOutline, false, paintingRootForRenderer, 0);
+            PaintInfo paintInfo(context, outlineRect, PaintPhaseSelfOutline, false, paintingRootForRenderer, 0);
             setClip(context, paintDirtyRect, outlineRect);
             renderer()->paint(paintInfo, tx, ty);
             restoreClip(context, paintDirtyRect, outlineRect);
@@ -1028,7 +1028,7 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
             setClip(context, paintDirtyRect, damageRect);
 
             // Paint the mask.
-            RenderObject::PaintInfo paintInfo(context, damageRect, PaintPhaseMask, false, paintingRootForRenderer, 0);
+            PaintInfo paintInfo(context, damageRect, PaintPhaseMask, false, paintingRootForRenderer, 0);
             renderer()->paint(paintInfo, tx, ty);
             
             // Restore the clip.
diff --git a/WebCore/rendering/RenderLineBoxList.cpp b/WebCore/rendering/RenderLineBoxList.cpp
index 2d3ee7e..3e4c882 100644
--- a/WebCore/rendering/RenderLineBoxList.cpp
+++ b/WebCore/rendering/RenderLineBoxList.cpp
@@ -148,7 +148,7 @@ void RenderLineBoxList::dirtyLineBoxes()
         curr->dirtyLineBoxes();
 }
 
-void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::PaintInfo& paintInfo, int tx, int ty) const
+void RenderLineBoxList::paint(RenderBoxModelObject* renderer, PaintInfo& paintInfo, int tx, int ty) const
 {
     // Only paint during the foreground/selection phases.
     if (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection && paintInfo.phase != PaintPhaseOutline 
@@ -181,7 +181,7 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, RenderObject::Pain
     if (yPos >= paintInfo.rect.bottom() || yPos + h <= paintInfo.rect.y())
         return;
 
-    RenderObject::PaintInfo info(paintInfo);
+    PaintInfo info(paintInfo);
     ListHashSet<RenderInline*> outlineObjects;
     info.outlineObjects = &outlineObjects;
 
diff --git a/WebCore/rendering/RenderLineBoxList.h b/WebCore/rendering/RenderLineBoxList.h
index 52d7542..f7d9960 100644
--- a/WebCore/rendering/RenderLineBoxList.h
+++ b/WebCore/rendering/RenderLineBoxList.h
@@ -63,7 +63,7 @@ public:
     void dirtyLineBoxes();
     void dirtyLinesFromChangedChild(RenderObject* parent, RenderObject* child);
 
-    void paint(RenderBoxModelObject*, RenderObject::PaintInfo&, int x, int y) const;
+    void paint(RenderBoxModelObject*, PaintInfo&, int x, int y) const;
     bool hitTest(RenderBoxModelObject*, const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction) const;
     
 private:
diff --git a/WebCore/rendering/RenderMediaControls.cpp b/WebCore/rendering/RenderMediaControls.cpp
index 17576ae..f75da70 100644
--- a/WebCore/rendering/RenderMediaControls.cpp
+++ b/WebCore/rendering/RenderMediaControls.cpp
@@ -82,7 +82,7 @@ void RenderMediaControls::adjustMediaSliderThumbSize(RenderObject* o)
     o->style()->setHeight(Length(static_cast<int>(mediaSliderThumbHeight * zoomLevel), Fixed));
 }
 
-bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderMediaControls::paintMediaControlsPart(MediaControlElementType part, RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
 
diff --git a/WebCore/rendering/RenderMediaControls.h b/WebCore/rendering/RenderMediaControls.h
index 529dbac..9683dd7 100644
--- a/WebCore/rendering/RenderMediaControls.h
+++ b/WebCore/rendering/RenderMediaControls.h
@@ -34,7 +34,7 @@ namespace WebCore {
 class HTMLMediaElement;
 class RenderMediaControls {
 public:
-    static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const PaintInfo&, const IntRect&);
     static void adjustMediaSliderThumbSize(RenderObject*);
 };
 
diff --git a/WebCore/rendering/RenderMediaControlsChromium.cpp b/WebCore/rendering/RenderMediaControlsChromium.cpp
index ede3d11..ffd7a1e 100644
--- a/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -67,7 +67,7 @@ static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Imag
     return true;
 }
 
-static bool paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+static bool paintMediaMuteButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     HTMLMediaElement* mediaElement = toParentMediaElement(object);
     if (!mediaElement)
@@ -83,7 +83,7 @@ static bool paintMediaMuteButton(RenderObject* object, const RenderObject::Paint
     return paintMediaButton(paintInfo.context, rect, mediaElement->muted() ? soundNone: soundFull);
 }
 
-static bool paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+static bool paintMediaPlayButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     HTMLMediaElement* mediaElement = toParentMediaElement(object);
     if (!mediaElement)
@@ -105,7 +105,7 @@ static Image* getMediaSliderThumb()
     return mediaSliderThumb;
 }
 
-static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+static bool paintMediaSlider(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     HTMLMediaElement* mediaElement = toParentMediaElement(object);
     if (!mediaElement)
@@ -164,7 +164,7 @@ static bool paintMediaSlider(RenderObject* object, const RenderObject::PaintInfo
     return true;
 }
 
-static bool paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+static bool paintMediaSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     if (!object->parent()->isSlider())
         return false;
@@ -180,7 +180,7 @@ static bool paintMediaSliderThumb(RenderObject* object, const RenderObject::Pain
     return paintMediaButton(paintInfo.context, rect, mediaSliderThumb);
 }
 
-static bool paintMediaVolumeSlider(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+static bool paintMediaVolumeSlider(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     HTMLMediaElement* mediaElement = toParentMediaElement(object);
     if (!mediaElement)
@@ -199,7 +199,7 @@ static bool paintMediaVolumeSlider(RenderObject* object, const RenderObject::Pai
     return true;
 }
 
-static bool paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+static bool paintMediaVolumeSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     if (!object->parent()->isSlider())
         return false;
@@ -208,7 +208,7 @@ static bool paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject
     return paintMediaButton(paintInfo.context, rect, mediaVolumeSliderThumb);
 }
 
-static bool paintMediaTimelineContainer(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+static bool paintMediaTimelineContainer(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     HTMLMediaElement* mediaElement = toParentMediaElement(object);
     if (!mediaElement)
@@ -263,7 +263,7 @@ bool RenderMediaControlsChromium::shouldRenderMediaControlPart(ControlPart part,
     return false;
 }
 
-bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType part, RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderMediaControlsChromium::paintMediaControlsPart(MediaControlElementType part, RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     switch (part) {
     case MediaMuteButton:
diff --git a/WebCore/rendering/RenderMediaControlsChromium.h b/WebCore/rendering/RenderMediaControlsChromium.h
index d6d986c..060a9d4 100644
--- a/WebCore/rendering/RenderMediaControlsChromium.h
+++ b/WebCore/rendering/RenderMediaControlsChromium.h
@@ -37,7 +37,7 @@ class HTMLMediaElement;
 class RenderMediaControlsChromium {
 public:
     static bool shouldRenderMediaControlPart(ControlPart, Element*);
-    static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    static bool paintMediaControlsPart(MediaControlElementType, RenderObject*, const PaintInfo&, const IntRect&);
     static void adjustMediaSliderThumbSize(RenderObject*);
 };
 
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index 143e2c0..156df15 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -30,6 +30,7 @@
 #include "AXObjectCache.h"
 #include "Chrome.h"
 #include "CSSStyleSelector.h"
+#include "DashArray.h"
 #include "FloatQuad.h"
 #include "Frame.h"
 #include "FrameView.h"
@@ -880,10 +881,186 @@ void RenderObject::drawLineForBoxSide(GraphicsContext* graphicsContext, int x1,
     }
 }
 
+IntRect RenderObject::borderInnerRect(const IntRect& borderRect, unsigned short topWidth, unsigned short bottomWidth, unsigned short leftWidth, unsigned short rightWidth) const
+{
+    return IntRect(
+            borderRect.x() + leftWidth, 
+            borderRect.y() + topWidth, 
+            borderRect.width() - leftWidth - rightWidth, 
+            borderRect.height() - topWidth - bottomWidth);
+}
+
+#if HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
+void RenderObject::drawBoxSideFromPath(GraphicsContext* graphicsContext, IntRect borderRect, Path borderPath, 
+                                    float thickness, float drawThickness, BoxSide s, const RenderStyle* style, 
+                                    Color c, EBorderStyle borderStyle)
+{
+    if (thickness <= 0)
+        return;
+
+    if (borderStyle == DOUBLE && thickness < 3)
+        borderStyle = SOLID;
+
+    switch (borderStyle) {
+    case BNONE:
+    case BHIDDEN:
+        return;
+    case DOTTED:
+    case DASHED: {
+        graphicsContext->setStrokeColor(c, style->colorSpace());
+
+        // The stroke is doubled here because the provided path is the 
+        // outside edge of the border so half the stroke is clipped off. 
+        // The extra multiplier is so that the clipping mask can antialias
+        // the edges to prevent jaggies.
+        graphicsContext->setStrokeThickness(drawThickness * 2 * 1.1f);
+        graphicsContext->setStrokeStyle(borderStyle == DASHED ? DashedStroke : DottedStroke);
+
+        // If the number of dashes that fit in the path is odd and non-integral then we
+        // will have an awkwardly-sized dash at the end of the path. To try to avoid that
+        // here, we simply make the whitespace dashes ever so slightly bigger.
+        // FIXME: This could be even better if we tried to manipulate the dash offset
+        // and possibly the whiteSpaceWidth to get the corners dash-symmetrical.
+        float patWidth = thickness * ((borderStyle == DASHED) ? 3.0f : 1.0f);
+        float whiteSpaceWidth = patWidth;
+        float numberOfDashes = borderPath.length() / patWidth;
+        bool evenNumberOfFullDashes = !((int)numberOfDashes % 2);
+        bool integralNumberOfDashes = !(numberOfDashes - (int)numberOfDashes);
+        if (!evenNumberOfFullDashes && !integralNumberOfDashes) {
+            float numberOfWhitespaceDashes = numberOfDashes / 2;
+            whiteSpaceWidth += (patWidth  / numberOfWhitespaceDashes);
+        }
+
+        DashArray* lineDash = new DashArray();
+        lineDash->append(patWidth);
+        lineDash->append(whiteSpaceWidth);
+        graphicsContext->setLineDash(*lineDash, patWidth);
+        graphicsContext->addPath(borderPath);
+        graphicsContext->strokePath();
+        return;
+    }
+    case DOUBLE: {
+        int outerBorderTopWidth = style->borderTopWidth() / 3;
+        int outerBorderRightWidth = style->borderRightWidth() / 3;
+        int outerBorderBottomWidth = style->borderBottomWidth() / 3;
+        int outerBorderLeftWidth = style->borderLeftWidth() / 3;
+
+        int innerBorderTopWidth = style->borderTopWidth() * 2 / 3;
+        int innerBorderRightWidth = style->borderRightWidth() * 2 / 3;
+        int innerBorderBottomWidth = style->borderBottomWidth() * 2 / 3;
+        int innerBorderLeftWidth = style->borderLeftWidth() * 2 / 3;
+
+        // We need certain integer rounding results
+        if (style->borderTopWidth() % 3 == 2)
+            outerBorderTopWidth += 1;
+        if (style->borderRightWidth() % 3 == 2)
+            outerBorderRightWidth += 1;
+        if (style->borderBottomWidth() % 3 == 2)
+            outerBorderBottomWidth += 1;
+        if (style->borderLeftWidth() % 3 == 2)
+            outerBorderLeftWidth += 1;
+
+        if (style->borderTopWidth() % 3 == 1)
+            innerBorderTopWidth += 1;
+        if (style->borderRightWidth() % 3 == 1)
+            innerBorderRightWidth += 1;
+        if (style->borderBottomWidth() % 3 == 1)
+            innerBorderBottomWidth += 1;
+        if (style->borderLeftWidth() % 3 == 1)
+            innerBorderLeftWidth += 1;
+
+        // Get the inner border rects for both the outer border line and the inner border line
+        IntRect outerBorderInnerRect = borderInnerRect(borderRect, outerBorderTopWidth, outerBorderBottomWidth, 
+            outerBorderLeftWidth, outerBorderRightWidth);
+        IntRect innerBorderInnerRect = borderInnerRect(borderRect, innerBorderTopWidth, innerBorderBottomWidth, 
+            innerBorderLeftWidth, innerBorderRightWidth);
+
+        // Get the inner radii for the outer border line
+        IntSize outerBorderTopLeftInnerRadius, outerBorderTopRightInnerRadius, outerBorderBottomLeftInnerRadius, 
+            outerBorderBottomRightInnerRadius;
+        style->getInnerBorderRadiiForRectWithBorderWidths(outerBorderInnerRect, outerBorderTopWidth, outerBorderBottomWidth, 
+            outerBorderLeftWidth, outerBorderRightWidth, outerBorderTopLeftInnerRadius, outerBorderTopRightInnerRadius, 
+            outerBorderBottomLeftInnerRadius, outerBorderBottomRightInnerRadius);
+
+        // Get the inner radii for the inner border line
+        IntSize innerBorderTopLeftInnerRadius, innerBorderTopRightInnerRadius, innerBorderBottomLeftInnerRadius, 
+            innerBorderBottomRightInnerRadius;
+        style->getInnerBorderRadiiForRectWithBorderWidths(innerBorderInnerRect, innerBorderTopWidth, innerBorderBottomWidth, 
+            innerBorderLeftWidth, innerBorderRightWidth, innerBorderTopLeftInnerRadius, innerBorderTopRightInnerRadius, 
+            innerBorderBottomLeftInnerRadius, innerBorderBottomRightInnerRadius);
+
+        // Draw inner border line
+        graphicsContext->save();
+        graphicsContext->addRoundedRectClip(innerBorderInnerRect, innerBorderTopLeftInnerRadius, 
+            innerBorderTopRightInnerRadius, innerBorderBottomLeftInnerRadius, innerBorderBottomRightInnerRadius);
+        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, thickness, drawThickness, s, style, c, SOLID);
+        graphicsContext->restore();
+
+        // Draw outer border line
+        graphicsContext->save();
+        graphicsContext->clipOutRoundedRect(outerBorderInnerRect, outerBorderTopLeftInnerRadius, 
+            outerBorderTopRightInnerRadius, outerBorderBottomLeftInnerRadius, outerBorderBottomRightInnerRadius);
+        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, thickness, drawThickness, s, style, c, SOLID);
+        graphicsContext->restore();
+
+        return;
+    }
+    case RIDGE:
+    case GROOVE:
+    {
+        EBorderStyle s1;
+        EBorderStyle s2;
+        if (borderStyle == GROOVE) {
+            s1 = INSET;
+            s2 = OUTSET;
+        } else {
+            s1 = OUTSET;
+            s2 = INSET;
+        }
+
+        IntRect halfBorderRect = borderInnerRect(borderRect, style->borderLeftWidth() / 2, style->borderBottomWidth() / 2, 
+            style->borderLeftWidth() / 2, style->borderRightWidth() / 2);
+
+        IntSize topLeftHalfRadius, topRightHalfRadius, bottomLeftHalfRadius, bottomRightHalfRadius;
+        style->getInnerBorderRadiiForRectWithBorderWidths(halfBorderRect, style->borderLeftWidth() / 2, 
+            style->borderBottomWidth() / 2, style->borderLeftWidth() / 2, style->borderRightWidth() / 2, 
+            topLeftHalfRadius, topRightHalfRadius, bottomLeftHalfRadius, bottomRightHalfRadius);
+
+        // Paint full border
+        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, thickness, drawThickness, s, style, c, s1);
+
+        // Paint inner only
+        graphicsContext->save();
+        graphicsContext->addRoundedRectClip(halfBorderRect, topLeftHalfRadius, topRightHalfRadius,
+            bottomLeftHalfRadius, bottomRightHalfRadius);
+        drawBoxSideFromPath(graphicsContext, borderRect, borderPath, thickness, drawThickness, s, style, c, s2);
+        graphicsContext->restore();
+
+        return;
+    }
+    case INSET:
+        if (s == BSTop || s == BSLeft)
+            c = c.dark();
+        break;
+    case OUTSET:
+        if (s == BSBottom || s == BSRight)
+            c = c.dark();
+        break;
+    default:
+        break;
+    }
+
+    graphicsContext->setStrokeStyle(NoStroke);
+    graphicsContext->setFillColor(c, style->colorSpace());
+    graphicsContext->drawRect(borderRect);
+}
+#else
 void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, int y, float thickness, IntSize radius,
                                      int angleStart, int angleSpan, BoxSide s, Color c,
                                      EBorderStyle style, bool firstCorner)
 {
+    // FIXME: This function should be removed when all ports implement GraphicsContext::clipConvexPolygon()!!
+    // At that time, everyone can use RenderObject::drawBoxSideFromPath() instead. This should happen soon.
     if ((style == DOUBLE && thickness / 2 < 3) || ((style == RIDGE || style == GROOVE) && thickness / 2 < 2))
         style = SOLID;
 
@@ -960,6 +1137,7 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
             break;
     }
 }
+#endif
 
 void RenderObject::addPDFURLRect(GraphicsContext* context, const IntRect& rect)
 {
diff --git a/WebCore/rendering/RenderObject.h b/WebCore/rendering/RenderObject.h
index 3446a00..33271df 100644
--- a/WebCore/rendering/RenderObject.h
+++ b/WebCore/rendering/RenderObject.h
@@ -31,12 +31,17 @@
 #include "Document.h"
 #include "Element.h"
 #include "FloatQuad.h"
+#include "PaintInfo.h"
 #include "RenderObjectChildList.h"
 #include "RenderStyle.h"
 #include "TextAffinity.h"
 #include "TransformationMatrix.h"
 #include <wtf/UnusedParam.h>
 
+#if PLATFORM(CG)
+#define HAVE_PATH_BASED_BORDER_RADIUS_DRAWING 1
+#endif
+
 namespace WebCore {
 
 class AnimationController;
@@ -44,6 +49,7 @@ class HitTestResult;
 class InlineBox;
 class InlineFlowBox;
 class OverlapTestRequestClient;
+class Path;
 class Position;
 class RenderBoxModelObject;
 class RenderInline;
@@ -57,39 +63,6 @@ class VisiblePosition;
 class RenderSVGResourceContainer;
 #endif
 
-/*
- *  The painting of a layer occurs in three distinct phases.  Each phase involves
- *  a recursive descent into the layer's render objects. The first phase is the background phase.
- *  The backgrounds and borders of all blocks are painted.  Inlines are not painted at all.
- *  Floats must paint above block backgrounds but entirely below inline content that can overlap them.
- *  In the foreground phase, all inlines are fully painted.  Inline replaced elements will get all
- *  three phases invoked on them during this phase.
- */
-
-// FIXME: These enums should move to their own header since they're used by other headers.
-enum PaintPhase {
-    PaintPhaseBlockBackground,
-    PaintPhaseChildBlockBackground,
-    PaintPhaseChildBlockBackgrounds,
-    PaintPhaseFloat,
-    PaintPhaseForeground,
-    PaintPhaseOutline,
-    PaintPhaseChildOutlines,
-    PaintPhaseSelfOutline,
-    PaintPhaseSelection,
-    PaintPhaseCollapsedTableBorders,
-    PaintPhaseTextClip,
-    PaintPhaseMask
-};
-
-enum PaintBehaviorFlags {
-    PaintBehaviorNormal = 0,
-    PaintBehaviorSelectionOnly = 1 << 0,
-    PaintBehaviorForceBlackText = 1 << 1,
-    PaintBehaviorFlattenCompositingLayers = 1 << 2
-};
-typedef unsigned PaintBehavior;
-
 enum HitTestFilter {
     HitTestAll,
     HitTestSelf,
@@ -436,8 +409,19 @@ public:
 
     void drawLineForBoxSide(GraphicsContext*, int x1, int y1, int x2, int y2, BoxSide,
                             Color, EBorderStyle, int adjbw1, int adjbw2);
+#if HAVE(PATH_BASED_BORDER_RADIUS_DRAWING)
+    void drawBoxSideFromPath(GraphicsContext*, IntRect, Path, 
+                            float thickness, float drawThickness, BoxSide, const RenderStyle*, 
+                            Color, EBorderStyle);
+#else
+    // FIXME: This function should be removed when all ports implement GraphicsContext::clipConvexPolygon()!!
+    // At that time, everyone can use RenderObject::drawBoxSideFromPath() instead. This should happen soon.
     void drawArcForBoxSide(GraphicsContext*, int x, int y, float thickness, IntSize radius, int angleStart,
                            int angleSpan, BoxSide, Color, EBorderStyle, bool firstCorner);
+#endif
+
+    IntRect borderInnerRect(const IntRect&, unsigned short topWidth, unsigned short bottomWidth,
+                            unsigned short leftWidth, unsigned short rightWidth) const;
 
     // The pseudo element style can be cached or uncached.  Use the cached method if the pseudo element doesn't respect
     // any pseudo classes (and therefore has no concept of changing state).
@@ -506,36 +490,6 @@ public:
     // for the vertical-align property of inline elements
     // the offset of baseline from the top of the object.
     virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
-
-    typedef HashMap<OverlapTestRequestClient*, IntRect> OverlapTestRequestMap;
-
-    /*
-     * Paint the object and its children, clipped by (x|y|w|h).
-     * (tx|ty) is the calculated position of the parent
-     */
-    struct PaintInfo {
-        PaintInfo(GraphicsContext* newContext, const IntRect& newRect, PaintPhase newPhase, bool newForceBlackText,
-                  RenderObject* newPaintingRoot, ListHashSet<RenderInline*>* newOutlineObjects,
-                  OverlapTestRequestMap* overlapTestRequests = 0)
-            : context(newContext)
-            , rect(newRect)
-            , phase(newPhase)
-            , forceBlackText(newForceBlackText)
-            , paintingRoot(newPaintingRoot)
-            , outlineObjects(newOutlineObjects)
-            , overlapTestRequests(overlapTestRequests)
-        {
-        }
-
-        GraphicsContext* context;
-        IntRect rect;
-        PaintPhase phase;
-        bool forceBlackText;
-        RenderObject* paintingRoot; // used to draw just one element and its visual kids
-        ListHashSet<RenderInline*>* outlineObjects; // used to list outlines that should be painted by a block with inline children
-        OverlapTestRequestMap* overlapTestRequests;
-    };
-
     virtual void paint(PaintInfo&, int tx, int ty);
 
     // Recursive function that computes the size and position of this object and all its descendants.
@@ -768,17 +722,6 @@ public:
 
     void selectionStartEnd(int& spos, int& epos) const;
 
-    RenderObject* paintingRootForChildren(PaintInfo& paintInfo) const
-    {
-        // if we're the painting root, kids draw normally, and see root of 0
-        return (!paintInfo.paintingRoot || paintInfo.paintingRoot == this) ? 0 : paintInfo.paintingRoot;
-    }
-
-    bool shouldPaintWithinRoot(PaintInfo& paintInfo) const
-    {
-        return !paintInfo.paintingRoot || paintInfo.paintingRoot == this;
-    }
-
     bool hasOverrideSize() const { return m_hasOverrideSize; }
     void setHasOverrideSize(bool b) { m_hasOverrideSize = b; }
     
diff --git a/WebCore/rendering/RenderPath.cpp b/WebCore/rendering/RenderPath.cpp
index 238a4e6..0010e3f 100644
--- a/WebCore/rendering/RenderPath.cpp
+++ b/WebCore/rendering/RenderPath.cpp
@@ -34,7 +34,6 @@
 #include "HitTestRequest.h"
 #include "PointerEventsHitRules.h"
 #include "RenderSVGContainer.h"
-#include "RenderSVGResourceFilter.h"
 #include "RenderSVGResourceMarker.h"
 #include "StrokeStyleApplier.h"
 #include "SVGRenderSupport.h"
@@ -57,7 +56,7 @@ public:
 
     void strokeStyle(GraphicsContext* gc)
     {
-        applyStrokeStyleToContext(gc, m_style, m_object);
+        SVGRenderSupport::applyStrokeStyleToContext(gc, m_style, m_object);
     }
 
 private:
@@ -105,7 +104,7 @@ void RenderPath::layout()
     // as the viewport size may have changed. It would be nice to optimize this to detect these changes, and only
     // update when needed, even when using relative values.
     bool needsPathUpdate = m_needsPathUpdate;
-    if (!needsPathUpdate && element->hasRelativeValues())
+    if (!needsPathUpdate && element->hasRelativeLengths())
         needsPathUpdate = true;
 
     if (needsPathUpdate) {
@@ -172,13 +171,12 @@ void RenderPath::paint(PaintInfo& paintInfo, int, int)
     bool drawsOutline = style()->outlineWidth() && (childPaintInfo.phase == PaintPhaseOutline || childPaintInfo.phase == PaintPhaseSelfOutline);
     if (drawsOutline || childPaintInfo.phase == PaintPhaseForeground) {
         childPaintInfo.context->save();
-        applyTransformToPaintInfo(childPaintInfo, m_localTransform);
-        RenderSVGResourceFilter* filter = 0;
+        childPaintInfo.applyTransform(m_localTransform);
 
         if (childPaintInfo.phase == PaintPhaseForeground) {
             PaintInfo savedInfo(childPaintInfo);
 
-            if (prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter)) {
+            if (SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo)) {
                 const SVGRenderStyle* svgStyle = style()->svgStyle();
                 if (svgStyle->shapeRendering() == SR_CRISPEDGES)
                     childPaintInfo.context->setShouldAntialias(false);
@@ -189,7 +187,7 @@ void RenderPath::paint(PaintInfo& paintInfo, int, int)
                     m_markerLayoutInfo.drawMarkers(childPaintInfo);
             }
 
-            finishRenderSVGContent(this, childPaintInfo, filter, savedInfo.context);
+            SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, savedInfo.context);
         }
 
         if (drawsOutline)
@@ -217,7 +215,7 @@ bool RenderPath::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult&
 
     FloatPoint localPoint = m_localTransform.inverse().mapPoint(pointInParent);
 
-    if (!pointInClippingArea(this, localPoint))
+    if (!SVGRenderSupport::pointInClippingArea(this, localPoint))
         return false;
 
     PointerEventsHitRules hitRules(PointerEventsHitRules::SVG_PATH_HITTESTING, request, style()->pointerEvents());
@@ -317,7 +315,7 @@ void RenderPath::updateCachedBoundaries()
 
     // Cache smallest possible repaint rectangle
     m_repaintBoundingBox = m_strokeAndMarkerBoundingBox;
-    intersectRepaintRectWithResources(this, m_repaintBoundingBox);
+    SVGRenderSupport::intersectRepaintRectWithResources(this, m_repaintBoundingBox);
 }
 
 }
diff --git a/WebCore/rendering/RenderProgress.cpp b/WebCore/rendering/RenderProgress.cpp
index 2587e4b..6072e1e 100644
--- a/WebCore/rendering/RenderProgress.cpp
+++ b/WebCore/rendering/RenderProgress.cpp
@@ -98,12 +98,17 @@ void RenderProgress::layoutParts()
 
 bool RenderProgress::shouldHaveParts() const
 {
-    return !style()->hasAppearance();
+    if (!style()->hasAppearance())
+        return true;
+    if (ShadowBlockElement::partShouldHaveStyle(this, PROGRESS_BAR_VALUE))
+        return true;
+    return false;
 }
 
 void RenderProgress::updatePartsState()
 {
     if (shouldHaveParts() && !m_valuePart) {
+        style()->setAppearance(NoControlPart);
         m_valuePart = ShadowBlockElement::createForPart(this->node(), PROGRESS_BAR_VALUE);
         addChild(m_valuePart->renderer());
     } else if (!shouldHaveParts() && m_valuePart) {
diff --git a/WebCore/rendering/RenderReplaced.cpp b/WebCore/rendering/RenderReplaced.cpp
index d579b99..0da321e 100644
--- a/WebCore/rendering/RenderReplaced.cpp
+++ b/WebCore/rendering/RenderReplaced.cpp
@@ -114,7 +114,7 @@ void RenderReplaced::paint(PaintInfo& paintInfo, int tx, int ty)
     if (paintInfo.phase != PaintPhaseForeground && paintInfo.phase != PaintPhaseSelection)
         return;
     
-    if (!shouldPaintWithinRoot(paintInfo))
+    if (!paintInfo.shouldPaintWithinRoot(this))
         return;
     
     bool drawSelectionTint = selectionState() != SelectionNone && !document()->printing();
@@ -163,7 +163,7 @@ bool RenderReplaced::shouldPaint(PaintInfo& paintInfo, int& tx, int& ty)
             && paintInfo.phase != PaintPhaseSelection && paintInfo.phase != PaintPhaseMask)
         return false;
 
-    if (!shouldPaintWithinRoot(paintInfo))
+    if (!paintInfo.shouldPaintWithinRoot(this))
         return false;
         
     // if we're invisible or haven't received a layout yet, then just bail.
diff --git a/WebCore/rendering/RenderSVGAllInOne.cpp b/WebCore/rendering/RenderSVGAllInOne.cpp
new file mode 100644
index 0000000..da86f84
--- /dev/null
+++ b/WebCore/rendering/RenderSVGAllInOne.cpp
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2009, 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "RenderSVGBlock.cpp"
+#include "RenderSVGContainer.cpp"
+#include "RenderSVGGradientStop.cpp"
+#include "RenderSVGHiddenContainer.cpp"
+#include "RenderSVGImage.cpp"
+#include "RenderSVGInline.cpp"
+#include "RenderSVGInlineText.cpp"
+#include "RenderSVGModelObject.cpp"
+#include "RenderSVGResource.cpp"
+#include "RenderSVGResourceClipper.cpp"
+#include "RenderSVGResourceFilter.cpp"
+#include "RenderSVGResourceGradient.cpp"
+#include "RenderSVGResourceLinearGradient.cpp"
+#include "RenderSVGResourceMarker.cpp"
+#include "RenderSVGResourceMasker.cpp"
+#include "RenderSVGResourcePattern.cpp"
+#include "RenderSVGResourceRadialGradient.cpp"
+#include "RenderSVGResourceSolidColor.cpp"
+#include "RenderSVGRoot.cpp"
+#include "RenderSVGShadowTreeRootContainer.cpp"
+#include "RenderSVGTSpan.cpp"
+#include "RenderSVGText.cpp"
+#include "RenderSVGTextPath.cpp"
+#include "RenderSVGTransformableContainer.cpp"
+#include "RenderSVGViewportContainer.cpp"
+#include "SVGCharacterData.cpp"
+#include "SVGCharacterLayoutInfo.cpp"
+#include "SVGInlineFlowBox.cpp"
+#include "SVGInlineTextBox.cpp"
+#include "SVGMarkerLayoutInfo.cpp"
+#include "SVGRenderSupport.cpp"
+#include "SVGRenderTreeAsText.cpp"
+#include "SVGRootInlineBox.cpp"
+#include "SVGShadowTreeElements.cpp"
+#include "SVGTextChunkLayoutInfo.cpp"
+#include "SVGTextLayoutUtilities.cpp"
+#include "SVGTextQuery.cpp"
diff --git a/WebCore/rendering/RenderSVGBlock.h b/WebCore/rendering/RenderSVGBlock.h
index af819fd..8dd140b 100644
--- a/WebCore/rendering/RenderSVGBlock.h
+++ b/WebCore/rendering/RenderSVGBlock.h
@@ -29,8 +29,7 @@ namespace WebCore {
 
 class SVGElement;
 
-class RenderSVGBlock : public RenderBlock
-                     , protected SVGRenderBase {
+class RenderSVGBlock : public RenderBlock {
 public:
     RenderSVGBlock(SVGElement*);
 
diff --git a/WebCore/rendering/RenderSVGContainer.cpp b/WebCore/rendering/RenderSVGContainer.cpp
index 66889ac..27584d9 100644
--- a/WebCore/rendering/RenderSVGContainer.cpp
+++ b/WebCore/rendering/RenderSVGContainer.cpp
@@ -60,7 +60,7 @@ void RenderSVGContainer::layout()
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout() || selfWillPaint());
     calculateLocalTransform(); // Allow RenderSVGTransformableContainer to update its transform
 
-    layoutChildren(this, selfNeedsLayout());
+    SVGRenderSupport::layoutChildren(this, selfNeedsLayout());
     repainter.repaintAfterLayout();
 
     setNeedsLayout(false);
@@ -87,29 +87,25 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, int, int)
         return;
 
     PaintInfo childPaintInfo(paintInfo);
-
     childPaintInfo.context->save();
 
     // Let the RenderSVGViewportContainer subclass clip if necessary
     applyViewportClip(childPaintInfo);
 
-    applyTransformToPaintInfo(childPaintInfo, localToParentTransform());
-
-    RenderSVGResourceFilter* filter = 0;
-    FloatRect boundingBox = repaintRectInLocalCoordinates();
+    childPaintInfo.applyTransform(localToParentTransform());
 
     bool continueRendering = true;
     if (childPaintInfo.phase == PaintPhaseForeground)
-        continueRendering = prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);
+        continueRendering = SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo);
 
     if (continueRendering) {
-        childPaintInfo.paintingRoot = paintingRootForChildren(childPaintInfo);
+        childPaintInfo.updatePaintingRootForChildren(this);
         for (RenderObject* child = firstChild(); child; child = child->nextSibling())
             child->paint(childPaintInfo, 0, 0);
     }
 
     if (paintInfo.phase == PaintPhaseForeground)
-        finishRenderSVGContent(this, childPaintInfo, filter, paintInfo.context);
+        SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, paintInfo.context);
 
     childPaintInfo.context->restore();
 
@@ -118,9 +114,10 @@ void RenderSVGContainer::paint(PaintInfo& paintInfo, int, int)
     // outline rect into parent coords before drawing.
     // FIXME: This means our focus ring won't share our rotation like it should.
     // We should instead disable our clip during PaintPhaseOutline
-    IntRect paintRectInParent = enclosingIntRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
-    if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth() && style()->visibility() == VISIBLE)
+    if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth() && style()->visibility() == VISIBLE) {
+        IntRect paintRectInParent = enclosingIntRect(localToParentTransform().mapRect(repaintRectInLocalCoordinates()));
         paintOutline(paintInfo.context, paintRectInParent.x(), paintRectInParent.y(), paintRectInParent.width(), paintRectInParent.height());
+    }
 }
 
 // addFocusRingRects is called from paintOutline and needs to be in the same coordinates as the paintOuline call
@@ -133,21 +130,18 @@ void RenderSVGContainer::addFocusRingRects(Vector<IntRect>& rects, int, int)
 
 FloatRect RenderSVGContainer::objectBoundingBox() const
 {
-    return computeContainerBoundingBox(this, false);
+    return SVGRenderSupport::computeContainerBoundingBox(this, SVGRenderSupport::ObjectBoundingBox);
 }
 
 FloatRect RenderSVGContainer::strokeBoundingBox() const
 {
-    return computeContainerBoundingBox(this, true);
+    return SVGRenderSupport::computeContainerBoundingBox(this, SVGRenderSupport::StrokeBoundingBox);
 }
 
-// RenderSVGContainer is used for <g> elements which do not themselves have a
-// width or height, so we union all of our child rects as our repaint rect.
 FloatRect RenderSVGContainer::repaintRectInLocalCoordinates() const
 {
-    FloatRect repaintRect = computeContainerBoundingBox(this, true);
-    intersectRepaintRectWithResources(this, repaintRect);
-
+    FloatRect repaintRect = SVGRenderSupport::computeContainerBoundingBox(this, SVGRenderSupport::RepaintBoundingBox);
+    SVGRenderSupport::intersectRepaintRectWithResources(this, repaintRect);
     return repaintRect;
 }
 
@@ -159,7 +153,7 @@ bool RenderSVGContainer::nodeAtFloatPoint(const HitTestRequest& request, HitTest
 
     FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
 
-    if (!pointInClippingArea(this, localPoint))
+    if (!SVGRenderSupport::pointInClippingArea(this, localPoint))
         return false;
                 
     for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
diff --git a/WebCore/rendering/RenderSVGHiddenContainer.cpp b/WebCore/rendering/RenderSVGHiddenContainer.cpp
index 5d6bd25..0af4236 100644
--- a/WebCore/rendering/RenderSVGHiddenContainer.cpp
+++ b/WebCore/rendering/RenderSVGHiddenContainer.cpp
@@ -38,7 +38,7 @@ RenderSVGHiddenContainer::RenderSVGHiddenContainer(SVGStyledElement* element)
 void RenderSVGHiddenContainer::layout()
 {
     ASSERT(needsLayout());
-    layoutChildren(this, selfNeedsLayout()); 
+    SVGRenderSupport::layoutChildren(this, selfNeedsLayout()); 
     setNeedsLayout(false);    
 }
 
diff --git a/WebCore/rendering/RenderSVGImage.cpp b/WebCore/rendering/RenderSVGImage.cpp
index 45898c7..a4572e6 100644
--- a/WebCore/rendering/RenderSVGImage.cpp
+++ b/WebCore/rendering/RenderSVGImage.cpp
@@ -83,11 +83,9 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
     paintInfo.context->concatCTM(localToParentTransform());
 
     if (paintInfo.phase == PaintPhaseForeground) {
-        RenderSVGResourceFilter* filter = 0;
-
         PaintInfo savedInfo(paintInfo);
 
-        if (prepareToRenderSVGContent(this, paintInfo, m_localBounds, filter)) {
+        if (SVGRenderSupport::prepareToRenderSVGContent(this, paintInfo)) {
             FloatRect destRect = m_localBounds;
             FloatRect srcRect(0, 0, image()->width(), image()->height());
 
@@ -97,7 +95,7 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
 
             paintInfo.context->drawImage(image(), DeviceColorSpace, destRect, srcRect);
         }
-        finishRenderSVGContent(this, paintInfo, filter, savedInfo.context);
+        SVGRenderSupport::finishRenderSVGContent(this, paintInfo, savedInfo.context);
     }
 
     if ((paintInfo.phase == PaintPhaseOutline || paintInfo.phase == PaintPhaseSelfOutline) && style()->outlineWidth())
@@ -108,7 +106,7 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
 
 void RenderSVGImage::destroy()
 {
-    deregisterFromResources(this);
+    RenderSVGResource::invalidateAllResourcesOfRenderer(this);
     RenderImage::destroy();
 }
 
@@ -123,7 +121,7 @@ bool RenderSVGImage::nodeAtFloatPoint(const HitTestRequest& request, HitTestResu
     if (isVisible || !hitRules.requireVisible) {
         FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
             
-        if (!pointInClippingArea(this, localPoint))
+        if (!SVGRenderSupport::pointInClippingArea(this, localPoint))
             return false;
 
         if (hitRules.canHitFill) {
@@ -150,7 +148,7 @@ FloatRect RenderSVGImage::repaintRectInLocalCoordinates() const
         return m_cachedLocalRepaintRect;
 
     m_cachedLocalRepaintRect = m_localBounds;
-    intersectRepaintRectWithResources(this, m_cachedLocalRepaintRect);
+    SVGRenderSupport::intersectRepaintRectWithResources(this, m_cachedLocalRepaintRect);
 
     return m_cachedLocalRepaintRect;
 }
@@ -169,17 +167,17 @@ void RenderSVGImage::imageChanged(WrappedImagePtr image, const IntRect* rect)
 
 IntRect RenderSVGImage::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
-    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
+    return SVGRenderSupport::clippedOverflowRectForRepaint(this, repaintContainer);
 }
 
 void RenderSVGImage::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
-    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
+    SVGRenderSupport::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
 void RenderSVGImage::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const
 {
-    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
+    SVGRenderSupport::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
 }
 
 void RenderSVGImage::addFocusRingRects(Vector<IntRect>& rects, int, int)
diff --git a/WebCore/rendering/RenderSVGImage.h b/WebCore/rendering/RenderSVGImage.h
index 37d2aee..3baac23 100644
--- a/WebCore/rendering/RenderSVGImage.h
+++ b/WebCore/rendering/RenderSVGImage.h
@@ -34,8 +34,7 @@ namespace WebCore {
 
 class SVGImageElement;
 
-class RenderSVGImage : public RenderImage
-                     , protected SVGRenderBase {
+class RenderSVGImage : public RenderImage {
 public:
     RenderSVGImage(SVGImageElement*);
 
diff --git a/WebCore/rendering/RenderSVGInline.cpp b/WebCore/rendering/RenderSVGInline.cpp
index ca0fdb5..ffc6b62 100644
--- a/WebCore/rendering/RenderSVGInline.cpp
+++ b/WebCore/rendering/RenderSVGInline.cpp
@@ -44,7 +44,7 @@ InlineFlowBox* RenderSVGInline::createInlineFlowBox()
 
 FloatRect RenderSVGInline::objectBoundingBox() const
 {
-    if (const RenderObject* object = findTextRootObject(this))
+    if (const RenderObject* object = SVGRenderSupport::findTextRootObject(this))
         return object->objectBoundingBox();
 
     return FloatRect();
@@ -52,7 +52,7 @@ FloatRect RenderSVGInline::objectBoundingBox() const
 
 FloatRect RenderSVGInline::strokeBoundingBox() const
 {
-    if (const RenderObject* object = findTextRootObject(this))
+    if (const RenderObject* object = SVGRenderSupport::findTextRootObject(this))
         return object->strokeBoundingBox();
 
     return FloatRect();
@@ -60,7 +60,7 @@ FloatRect RenderSVGInline::strokeBoundingBox() const
 
 FloatRect RenderSVGInline::repaintRectInLocalCoordinates() const
 {
-    if (const RenderObject* object = findTextRootObject(this))
+    if (const RenderObject* object = SVGRenderSupport::findTextRootObject(this))
         return object->repaintRectInLocalCoordinates();
 
     return FloatRect();
@@ -68,22 +68,22 @@ FloatRect RenderSVGInline::repaintRectInLocalCoordinates() const
 
 IntRect RenderSVGInline::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
-    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
+    return SVGRenderSupport::clippedOverflowRectForRepaint(this, repaintContainer);
 }
 
 void RenderSVGInline::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
-    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
+    SVGRenderSupport::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
 void RenderSVGInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState& transformState) const
 {
-    SVGRenderBase::mapLocalToContainer(this, repaintContainer, useTransforms, fixed, transformState);
+    SVGRenderSupport::mapLocalToContainer(this, repaintContainer, useTransforms, fixed, transformState);
 }
 
 void RenderSVGInline::absoluteQuads(Vector<FloatQuad>& quads)
 {
-    const RenderObject* object = findTextRootObject(this);
+    const RenderObject* object = SVGRenderSupport::findTextRootObject(this);
     if (!object)
         return;
 
diff --git a/WebCore/rendering/RenderSVGInline.h b/WebCore/rendering/RenderSVGInline.h
index 2efb1aa..6f44162 100644
--- a/WebCore/rendering/RenderSVGInline.h
+++ b/WebCore/rendering/RenderSVGInline.h
@@ -31,8 +31,7 @@
 
 namespace WebCore {
 
-class RenderSVGInline : public RenderInline
-                      , protected SVGRenderBase {
+class RenderSVGInline : public RenderInline {
 public:
     RenderSVGInline(Node*);
 
diff --git a/WebCore/rendering/RenderSVGModelObject.cpp b/WebCore/rendering/RenderSVGModelObject.cpp
index a80a963..3d22e7a 100644
--- a/WebCore/rendering/RenderSVGModelObject.cpp
+++ b/WebCore/rendering/RenderSVGModelObject.cpp
@@ -33,9 +33,7 @@
 #if ENABLE(SVG)
 #include "RenderSVGModelObject.h"
 
-#include "GraphicsContext.h"
-#include "RenderLayer.h"
-#include "RenderView.h"
+#include "RenderSVGResource.h"
 #include "SVGStyledElement.h"
 
 namespace WebCore {
@@ -47,21 +45,21 @@ RenderSVGModelObject::RenderSVGModelObject(SVGStyledElement* node)
 
 IntRect RenderSVGModelObject::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
-    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
+    return SVGRenderSupport::clippedOverflowRectForRepaint(this, repaintContainer);
 }
 
 void RenderSVGModelObject::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
-    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
+    SVGRenderSupport::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
 void RenderSVGModelObject::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState) const
 {
-    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
+    SVGRenderSupport::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
 }
 
 // Copied from RenderBox, this method likely requires further refactoring to work easily for both SVG and CSS Box Model content.
-// FIXME: This may also need to move into SVGRenderBase as the RenderBox version depends
+// FIXME: This may also need to move into SVGRenderSupport as the RenderBox version depends
 // on borderBoundingBox() which SVG RenderBox subclases (like SVGRenderBlock) do not implement.
 IntRect RenderSVGModelObject::outlineBoundsForRepaint(RenderBoxModelObject* repaintContainer, IntPoint*) const
 {
@@ -85,7 +83,7 @@ void RenderSVGModelObject::absoluteQuads(Vector<FloatQuad>& quads)
 
 void RenderSVGModelObject::destroy()
 {
-    deregisterFromResources(this);
+    RenderSVGResource::invalidateAllResourcesOfRenderer(this);
     RenderObject::destroy();
 }
 
diff --git a/WebCore/rendering/RenderSVGModelObject.h b/WebCore/rendering/RenderSVGModelObject.h
index 42ca27f..82c08c0 100644
--- a/WebCore/rendering/RenderSVGModelObject.h
+++ b/WebCore/rendering/RenderSVGModelObject.h
@@ -41,11 +41,11 @@ namespace WebCore {
 // Most renderers in the SVG rendering tree will inherit from this class
 // but not all. (e.g. RenderSVGForeignObject, RenderSVGBlock, RenderSVGImage) thus methods
 // required by SVG renders need to be declared on RenderObject, but shared
-// logic can go in this class or in SVGRenderBase.
+// logic can go in this class or in SVGRenderSupport.
 
 class SVGStyledElement;
 
-class RenderSVGModelObject : public RenderObject, protected SVGRenderBase {
+class RenderSVGModelObject : public RenderObject {
 public:
     RenderSVGModelObject(SVGStyledElement*);
 
diff --git a/WebCore/rendering/RenderSVGResource.cpp b/WebCore/rendering/RenderSVGResource.cpp
index 129d800..0aa7182 100644
--- a/WebCore/rendering/RenderSVGResource.cpp
+++ b/WebCore/rendering/RenderSVGResource.cpp
@@ -26,7 +26,11 @@
 #if ENABLE(SVG)
 #include "RenderSVGResource.h"
 
+#include "RenderSVGResourceClipper.h"
 #include "RenderSVGResourceContainer.h"
+#include "RenderSVGResourceFilter.h"
+#include "RenderSVGResourceMarker.h"
+#include "RenderSVGResourceMasker.h"
 #include "RenderSVGResourceSolidColor.h"
 #include "SVGURIReference.h"
 
@@ -197,6 +201,59 @@ void RenderSVGResource::markForLayoutAndResourceInvalidation(RenderObject* objec
     static_cast<SVGStyledElement*>(element)->invalidateResourcesInAncestorChain();
 }
 
+static inline void invalidatePaintingResource(SVGPaint* paint, RenderObject* object)
+{
+    ASSERT(paint);
+
+    SVGPaint::SVGPaintType paintType = paint->paintType();
+    if (paintType != SVGPaint::SVG_PAINTTYPE_URI && paintType != SVGPaint::SVG_PAINTTYPE_URI_RGBCOLOR)
+        return;
+
+    AtomicString id(SVGURIReference::getTarget(paint->uri()));
+    if (RenderSVGResourceContainer* paintingResource = getRenderSVGResourceContainerById(object->document(), id))
+        paintingResource->invalidateClient(object);
+}
+
+void RenderSVGResource::invalidateAllResourcesOfRenderer(RenderObject* object)
+{
+    ASSERT(object);
+    ASSERT(object->style());
+
+    Document* document = object->document();
+    ASSERT(document);
+
+    const SVGRenderStyle* svgStyle = object->style()->svgStyle();
+    ASSERT(svgStyle);
+
+    // Masker
+    if (RenderSVGResourceMasker* masker = getRenderSVGResourceById<RenderSVGResourceMasker>(document, svgStyle->maskerResource()))
+        masker->invalidateClient(object);
+
+    // Clipper
+    if (RenderSVGResourceClipper* clipper = getRenderSVGResourceById<RenderSVGResourceClipper>(document, svgStyle->clipperResource()))
+        clipper->invalidateClient(object);
+
+    // Filter
+#if ENABLE(FILTERS)
+    if (RenderSVGResourceFilter* filter = getRenderSVGResourceById<RenderSVGResourceFilter>(document, svgStyle->filterResource()))
+        filter->invalidateClient(object);
+#endif
+
+    // Markers
+    if (RenderSVGResourceMarker* startMarker = getRenderSVGResourceById<RenderSVGResourceMarker>(document, svgStyle->markerStartResource()))
+        startMarker->invalidateClient(object);
+    if (RenderSVGResourceMarker* midMarker = getRenderSVGResourceById<RenderSVGResourceMarker>(document, svgStyle->markerMidResource()))
+        midMarker->invalidateClient(object);
+    if (RenderSVGResourceMarker* endMarker = getRenderSVGResourceById<RenderSVGResourceMarker>(document, svgStyle->markerEndResource()))
+        endMarker->invalidateClient(object);
+
+    // Gradients/Patterns
+    if (svgStyle->hasFill())
+        invalidatePaintingResource(svgStyle->fillPaint(), object);
+    if (svgStyle->hasStroke())
+        invalidatePaintingResource(svgStyle->strokePaint(), object);
+}
+
 }
 
 #endif
diff --git a/WebCore/rendering/RenderSVGResource.h b/WebCore/rendering/RenderSVGResource.h
index a14a972..34ff14e 100644
--- a/WebCore/rendering/RenderSVGResource.h
+++ b/WebCore/rendering/RenderSVGResource.h
@@ -79,6 +79,8 @@ public:
     static RenderSVGResource* strokePaintingResource(const RenderObject*, const RenderStyle*);
     static RenderSVGResourceSolidColor* sharedSolidPaintingResource();
 
+    static void invalidateAllResourcesOfRenderer(RenderObject*);
+
 private:
     static void adjustColorForPseudoRules(const RenderStyle*, bool useFillPaint, Color&);
     
diff --git a/WebCore/rendering/RenderSVGResourceClipper.cpp b/WebCore/rendering/RenderSVGResourceClipper.cpp
index 450c5d6..cc499bf 100644
--- a/WebCore/rendering/RenderSVGResourceClipper.cpp
+++ b/WebCore/rendering/RenderSVGResourceClipper.cpp
@@ -242,7 +242,7 @@ bool RenderSVGResourceClipper::createClipData(ClipperData* clipperData, const Fl
         // In the case of a <use> element, we obtained its renderere above, to retrieve its clipRule.
         // We hsve to pass the <use> renderer itself to renderSubtreeToImage() to apply it's x/y/transform/etc. values when rendering.
         // So if isUseElement is true, refetch the childNode->renderer(), as renderer got overriden above.
-        renderSubtreeToImage(clipperData->clipMaskImage.get(), isUseElement ? childNode->renderer() : renderer);
+        SVGRenderSupport::renderSubtreeToImage(clipperData->clipMaskImage.get(), isUseElement ? childNode->renderer() : renderer);
 
         renderer->setStyle(oldRenderStyle.release());
     }
@@ -271,7 +271,7 @@ void RenderSVGResourceClipper::calculateClipContentRepaintRect()
 bool RenderSVGResourceClipper::hitTestClipContent(const FloatRect& objectBoundingBox, const FloatPoint& nodeAtPoint)
 {
     FloatPoint point = nodeAtPoint;
-    if (!pointInClippingArea(this, point))
+    if (!SVGRenderSupport::pointInClippingArea(this, point))
         return false;
 
     if (static_cast<SVGClipPathElement*>(node())->clipPathUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX) {
diff --git a/WebCore/rendering/RenderSVGResourceGradient.cpp b/WebCore/rendering/RenderSVGResourceGradient.cpp
index e715f6f..7ea70d2 100644
--- a/WebCore/rendering/RenderSVGResourceGradient.cpp
+++ b/WebCore/rendering/RenderSVGResourceGradient.cpp
@@ -91,7 +91,7 @@ static inline bool createMaskAndSwapContextForTextGradient(GraphicsContext*& con
                                                            OwnPtr<ImageBuffer>& imageBuffer,
                                                            const RenderObject* object)
 {
-    const RenderObject* textRootBlock = findTextRootObject(object);
+    const RenderObject* textRootBlock = SVGRenderSupport::findTextRootObject(object);
 
     AffineTransform transform = absoluteTransformForRenderer(textRootBlock);
     FloatRect maskAbsoluteBoundingBox = transform.mapRect(textRootBlock->repaintRectInLocalCoordinates());
@@ -123,7 +123,7 @@ static inline AffineTransform clipToTextMask(GraphicsContext* context,
                                              const RenderObject* object,
                                              GradientData* gradientData)
 {
-    const RenderObject* textRootBlock = findTextRootObject(object);
+    const RenderObject* textRootBlock = SVGRenderSupport::findTextRootObject(object);
     context->clipToImageBuffer(textRootBlock->repaintRectInLocalCoordinates(), imageBuffer.get());
 
     AffineTransform matrix;
@@ -211,7 +211,7 @@ bool RenderSVGResourceGradient::applyResource(RenderObject* object, RenderStyle*
             gradientData->gradient->setGradientSpaceTransform(transformOnNonScalingStroke(object, gradientData->userspaceTransform));
         context->setAlpha(svgStyle->strokeOpacity());
         context->setStrokeGradient(gradientData->gradient);
-        applyStrokeStyleToContext(context, style, object);
+        SVGRenderSupport::applyStrokeStyleToContext(context, style, object);
     }
 
     return true;
@@ -235,7 +235,7 @@ void RenderSVGResourceGradient::postApplyResource(RenderObject* object, Graphics
             gradientData->gradient->setGradientSpaceTransform(clipToTextMask(context, m_imageBuffer, object, gradientData));
             context->setFillGradient(gradientData->gradient);
 
-            const RenderObject* textRootBlock = findTextRootObject(object);
+            const RenderObject* textRootBlock = SVGRenderSupport::findTextRootObject(object);
             context->fillRect(textRootBlock->repaintRectInLocalCoordinates());
 
             m_imageBuffer.clear();
diff --git a/WebCore/rendering/RenderSVGResourceMarker.cpp b/WebCore/rendering/RenderSVGResourceMarker.cpp
index 4a300c2..ce331a7 100644
--- a/WebCore/rendering/RenderSVGResourceMarker.cpp
+++ b/WebCore/rendering/RenderSVGResourceMarker.cpp
@@ -88,7 +88,7 @@ void RenderSVGResourceMarker::invalidateClient(RenderObject* object)
 
 void RenderSVGResourceMarker::applyViewportClip(PaintInfo& paintInfo)
 {
-    if (SVGRenderBase::isOverflowHidden(this))
+    if (SVGRenderSupport::isOverflowHidden(this))
         paintInfo.context->clip(m_viewport);
 }
 
@@ -146,7 +146,7 @@ AffineTransform RenderSVGResourceMarker::markerTransformation(const FloatPoint&
     return transform;
 }
 
-void RenderSVGResourceMarker::draw(RenderObject::PaintInfo& paintInfo, const AffineTransform& transform)
+void RenderSVGResourceMarker::draw(PaintInfo& paintInfo, const AffineTransform& transform)
 {
     DEFINE_STATIC_LOCAL(HashSet<RenderSVGResourceMarker*>, currentlyDrawingMarkers, ());
 
@@ -155,9 +155,9 @@ void RenderSVGResourceMarker::draw(RenderObject::PaintInfo& paintInfo, const Aff
         return;
 
     currentlyDrawingMarkers.add(this);
-    RenderObject::PaintInfo info(paintInfo);
+    PaintInfo info(paintInfo);
     info.context->save();
-    applyTransformToPaintInfo(info, transform);
+    info.applyTransform(transform);
     RenderSVGContainer::paint(info, 0, 0);
     info.context->restore();
 
diff --git a/WebCore/rendering/RenderSVGResourceMarker.h b/WebCore/rendering/RenderSVGResourceMarker.h
index 533a03b..75c442e 100644
--- a/WebCore/rendering/RenderSVGResourceMarker.h
+++ b/WebCore/rendering/RenderSVGResourceMarker.h
@@ -45,7 +45,7 @@ public:
     virtual void invalidateClients();
     virtual void invalidateClient(RenderObject*);
 
-    void draw(RenderObject::PaintInfo&, const AffineTransform&);
+    void draw(PaintInfo&, const AffineTransform&);
 
     // Calculates marker boundaries, mapped to the target element's coordinate space
     FloatRect markerBoundaries(const AffineTransform& markerTransformation) const;
diff --git a/WebCore/rendering/RenderSVGResourceMasker.cpp b/WebCore/rendering/RenderSVGResourceMasker.cpp
index ea79439..74d3fe6 100644
--- a/WebCore/rendering/RenderSVGResourceMasker.cpp
+++ b/WebCore/rendering/RenderSVGResourceMasker.cpp
@@ -173,7 +173,7 @@ void RenderSVGResourceMasker::createMaskImage(MaskerData* maskerData, const SVGM
         RenderStyle* style = renderer->style();
         if (!style || style->display() == NONE || style->visibility() != VISIBLE)
             continue;
-        renderSubtreeToImage(maskerData->maskImage.get(), renderer);
+        SVGRenderSupport::renderSubtreeToImage(maskerData->maskImage.get(), renderer);
     }
 
     maskImageContext->restore();
diff --git a/WebCore/rendering/RenderSVGResourcePattern.cpp b/WebCore/rendering/RenderSVGResourcePattern.cpp
index 040b2e2..ba24fcf 100644
--- a/WebCore/rendering/RenderSVGResourcePattern.cpp
+++ b/WebCore/rendering/RenderSVGResourcePattern.cpp
@@ -24,6 +24,7 @@
 #if ENABLE(SVG)
 #include "RenderSVGResourcePattern.h"
 
+#include "FrameView.h"
 #include "GraphicsContext.h"
 #include "PatternAttributes.h"
 #include "SVGRenderSupport.h"
@@ -120,7 +121,7 @@ bool RenderSVGResourcePattern::applyResource(RenderObject* object, RenderStyle*
             patternData->pattern->setPatternSpaceTransform(transformOnNonScalingStroke(object, patternData->transform));
         context->setAlpha(svgStyle->strokeOpacity());
         context->setStrokePattern(patternData->pattern);
-        applyStrokeStyleToContext(context, style, object);
+        SVGRenderSupport::applyStrokeStyleToContext(context, style, object);
     }
 
     if (resourceMode & ApplyToTextMode) {
@@ -208,6 +209,22 @@ FloatRect RenderSVGResourcePattern::calculatePatternBoundariesIncludingOverflow(
     return patternBoundariesIncludingOverflow;
 }
 
+// FIXME: This method should be removed. RenderSVGResourcePatterns usage of it is just wrong.
+static inline void clampImageBufferSizeToViewport(FrameView* frameView, IntSize& size)
+{
+    if (!frameView)
+        return;
+
+    int viewWidth = frameView->visibleWidth();
+    int viewHeight = frameView->visibleHeight();
+
+    if (size.width() > viewWidth)
+        size.setWidth(viewWidth);
+
+    if (size.height() > viewHeight)
+        size.setHeight(viewHeight);
+}
+
 PassOwnPtr<ImageBuffer> RenderSVGResourcePattern::createTileImage(PatternData* patternData,
                                                                   const SVGPatternElement* patternElement,
                                                                   RenderObject* object) const
@@ -268,7 +285,7 @@ PassOwnPtr<ImageBuffer> RenderSVGResourcePattern::createTileImage(PatternData* p
     for (Node* node = attributes.patternContentElement()->firstChild(); node; node = node->nextSibling()) {
         if (!node->isSVGElement() || !static_cast<SVGElement*>(node)->isStyled() || !node->renderer())
             continue;
-        renderSubtreeToImage(tileImage.get(), node->renderer());
+        SVGRenderSupport::renderSubtreeToImage(tileImage.get(), node->renderer());
     }
 
     patternData->boundaries = patternBoundaries;
diff --git a/WebCore/rendering/RenderSVGResourceSolidColor.cpp b/WebCore/rendering/RenderSVGResourceSolidColor.cpp
index 792908f..51ad658 100644
--- a/WebCore/rendering/RenderSVGResourceSolidColor.cpp
+++ b/WebCore/rendering/RenderSVGResourceSolidColor.cpp
@@ -24,6 +24,7 @@
 #include "RenderSVGResourceSolidColor.h"
 
 #include "GraphicsContext.h"
+#include "RenderStyle.h"
 #include "SVGRenderSupport.h"
 
 #if PLATFORM(SKIA) && !PLATFORM(ANDROID)
@@ -65,7 +66,7 @@ bool RenderSVGResourceSolidColor::applyResource(RenderObject* object, RenderStyl
         context->setStrokeColor(m_color, colorSpace);
 
         if (style)
-            applyStrokeStyleToContext(context, style, object);
+            SVGRenderSupport::applyStrokeStyleToContext(context, style, object);
 
         if (resourceMode & ApplyToTextMode)
             context->setTextDrawingMode(cTextStroke);
diff --git a/WebCore/rendering/RenderSVGRoot.cpp b/WebCore/rendering/RenderSVGRoot.cpp
index 70ff938..ad3303f 100644
--- a/WebCore/rendering/RenderSVGRoot.cpp
+++ b/WebCore/rendering/RenderSVGRoot.cpp
@@ -30,6 +30,7 @@
 #include "HitTestResult.h"
 #endif
 #include "RenderSVGContainer.h"
+#include "RenderSVGResource.h"
 #include "RenderView.h"
 #include "SVGLength.h"
 #include "SVGRenderSupport.h"
@@ -121,7 +122,7 @@ void RenderSVGRoot::layout()
     // RenderSVGRoot needs to take special care to propagate window size changes to the children,
     // if the outermost <svg> is using relative x/y/width/height values. Hence the additonal parameters.
     SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
-    layoutChildren(this, needsLayout || (svg->hasRelativeValues() && oldSize != size()));
+    SVGRenderSupport::layoutChildren(this, needsLayout || (svg->hasRelativeLengths() && oldSize != size()));
     repainter.repaintAfterLayout();
 
     view()->enableLayoutState();
@@ -162,8 +163,8 @@ void RenderSVGRoot::paint(PaintInfo& paintInfo, int parentX, int parentY)
     if (!firstChild() && !selfWillPaint())
         return;
 
-    // Make a copy of the PaintInfo because applyTransformToPaintInfo will modify the damage rect.
-    RenderObject::PaintInfo childPaintInfo(paintInfo);
+    // Make a copy of the PaintInfo because applyTransform will modify the damage rect.
+    PaintInfo childPaintInfo(paintInfo);
     childPaintInfo.context->save();
 
     // Apply initial viewport clip - not affected by overflow handling
@@ -171,20 +172,17 @@ void RenderSVGRoot::paint(PaintInfo& paintInfo, int parentX, int parentY)
 
     // Convert from container offsets (html renderers) to a relative transform (svg renderers).
     // Transform from our paint container's coordinate system to our local coords.
-    applyTransformToPaintInfo(childPaintInfo, localToRepaintContainerTransform(parentOriginInContainer));
-
-    RenderSVGResourceFilter* filter = 0;
-    FloatRect boundingBox = repaintRectInLocalCoordinates();
+    childPaintInfo.applyTransform(localToRepaintContainerTransform(parentOriginInContainer));
 
     bool continueRendering = true;
     if (childPaintInfo.phase == PaintPhaseForeground)
-        continueRendering = prepareToRenderSVGContent(this, childPaintInfo, boundingBox, filter);
+        continueRendering = SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo);
 
     if (continueRendering)
         RenderBox::paint(childPaintInfo, 0, 0);
 
     if (childPaintInfo.phase == PaintPhaseForeground)
-        finishRenderSVGContent(this, childPaintInfo, filter, paintInfo.context);
+        SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, paintInfo.context);
 
     childPaintInfo.context->restore();
 
@@ -194,7 +192,7 @@ void RenderSVGRoot::paint(PaintInfo& paintInfo, int parentX, int parentY)
 
 void RenderSVGRoot::destroy()
 {
-    deregisterFromResources(this);
+    RenderSVGResource::invalidateAllResourcesOfRenderer(this);
     RenderBox::destroy();
 }
 
@@ -202,7 +200,7 @@ void RenderSVGRoot::calcViewport()
 {
     SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
 
-    if (!selfNeedsLayout() && !svg->hasRelativeValues())
+    if (!selfNeedsLayout() && !svg->hasRelativeLengths())
         return;
 
     if (!svg->hasSetContainerSize()) {
@@ -262,22 +260,22 @@ const AffineTransform& RenderSVGRoot::localToParentTransform() const
 
 FloatRect RenderSVGRoot::objectBoundingBox() const
 {
-    return computeContainerBoundingBox(this, false);
+    return SVGRenderSupport::computeContainerBoundingBox(this, SVGRenderSupport::ObjectBoundingBox);
+}
+
+FloatRect RenderSVGRoot::strokeBoundingBox() const
+{
+    return SVGRenderSupport::computeContainerBoundingBox(this, SVGRenderSupport::StrokeBoundingBox);
 }
 
 FloatRect RenderSVGRoot::repaintRectInLocalCoordinates() const
 {
     // FIXME: This does not include the border but it should!
-    FloatRect repaintRect = computeContainerBoundingBox(this, true);
+    FloatRect repaintRect = SVGRenderSupport::computeContainerBoundingBox(this, SVGRenderSupport::RepaintBoundingBox);
     style()->svgStyle()->inflateForShadow(repaintRect);
     return repaintRect;
 }
 
-AffineTransform RenderSVGRoot::localTransform() const
-{
-    return AffineTransform();
-}
-
 void RenderSVGRoot::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
     // Apply our local transforms (except for x/y translation), then our shadow, 
diff --git a/WebCore/rendering/RenderSVGRoot.h b/WebCore/rendering/RenderSVGRoot.h
index 53c1298..48263aa 100644
--- a/WebCore/rendering/RenderSVGRoot.h
+++ b/WebCore/rendering/RenderSVGRoot.h
@@ -33,7 +33,7 @@ namespace WebCore {
 class SVGStyledElement;
 class AffineTransform;
 
-class RenderSVGRoot : public RenderBox, protected SVGRenderBase {
+class RenderSVGRoot : public RenderBox {
 public:
     RenderSVGRoot(SVGStyledElement*);
 
@@ -63,12 +63,9 @@ private:
     bool strokeContains(const FloatPoint&) const;
 
     virtual FloatRect objectBoundingBox() const;
-    virtual FloatRect strokeBoundingBox() const { return computeContainerBoundingBox(this, true); }
+    virtual FloatRect strokeBoundingBox() const;
     virtual FloatRect repaintRectInLocalCoordinates() const;
 
-    // FIXME: This override should be removed.
-    virtual AffineTransform localTransform() const;
-
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed);
@@ -108,5 +105,3 @@ void toRenderSVGRoot(const RenderSVGRoot*);
 
 #endif // ENABLE(SVG)
 #endif // RenderSVGRoot_h
-
-// vim:ts=4:noet
diff --git a/WebCore/rendering/RenderSVGText.cpp b/WebCore/rendering/RenderSVGText.cpp
index 84f5329..12f3cb5 100644
--- a/WebCore/rendering/RenderSVGText.cpp
+++ b/WebCore/rendering/RenderSVGText.cpp
@@ -36,6 +36,7 @@
 #include "HitTestRequest.h"
 #include "PointerEventsHitRules.h"
 #include "RenderLayer.h"
+#include "RenderSVGResource.h"
 #include "RenderSVGRoot.h"
 #include "SVGLengthList.h"
 #include "SVGRenderSupport.h"
@@ -56,17 +57,17 @@ RenderSVGText::RenderSVGText(SVGTextElement* node)
 
 IntRect RenderSVGText::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
-    return SVGRenderBase::clippedOverflowRectForRepaint(this, repaintContainer);
+    return SVGRenderSupport::clippedOverflowRectForRepaint(this, repaintContainer);
 }
 
 void RenderSVGText::computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
-    SVGRenderBase::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
+    SVGRenderSupport::computeRectForRepaint(this, repaintContainer, repaintRect, fixed);
 }
 
 void RenderSVGText::mapLocalToContainer(RenderBoxModelObject* repaintContainer, bool fixed, bool useTransforms, TransformState& transformState) const
 {
-    SVGRenderBase::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
+    SVGRenderSupport::mapLocalToContainer(this, repaintContainer, fixed, useTransforms, transformState);
 }
 
 void RenderSVGText::layout()
@@ -117,7 +118,7 @@ bool RenderSVGText::nodeAtFloatPoint(const HitTestRequest& request, HitTestResul
             || (hitRules.canHitFill && (style()->svgStyle()->hasFill() || !hitRules.requireFill))) {
             FloatPoint localPoint = localToParentTransform().inverse().mapPoint(pointInParent);
 
-            if (!pointInClippingArea(this, localPoint))
+            if (!SVGRenderSupport::pointInClippingArea(this, localPoint))
                 return false;       
 
             return RenderBlock::nodeAtPoint(request, result, (int)localPoint.x(), (int)localPoint.y(), 0, 0, hitTestAction);
@@ -129,7 +130,7 @@ bool RenderSVGText::nodeAtFloatPoint(const HitTestRequest& request, HitTestResul
 
 void RenderSVGText::destroy()
 {
-    deregisterFromResources(this);
+    RenderSVGResource::invalidateAllResourcesOfRenderer(this);
     RenderSVGBlock::destroy();
 }
 
@@ -156,7 +157,7 @@ void RenderSVGText::paint(PaintInfo& paintInfo, int, int)
 
     PaintInfo blockInfo(paintInfo);
     blockInfo.context->save();
-    applyTransformToPaintInfo(blockInfo, localToParentTransform());
+    blockInfo.applyTransform(localToParentTransform());
     RenderBlock::paint(blockInfo, 0, 0);
     blockInfo.context->restore();
 }
@@ -174,7 +175,7 @@ FloatRect RenderSVGText::strokeBoundingBox() const
 FloatRect RenderSVGText::repaintRectInLocalCoordinates() const
 {
     FloatRect repaintRect = strokeBoundingBox();
-    intersectRepaintRectWithResources(this, repaintRect);
+    SVGRenderSupport::intersectRepaintRectWithResources(this, repaintRect);
 
     return repaintRect;
 }
diff --git a/WebCore/rendering/RenderSVGViewportContainer.cpp b/WebCore/rendering/RenderSVGViewportContainer.cpp
index 1587e7f..ca735d2 100644
--- a/WebCore/rendering/RenderSVGViewportContainer.cpp
+++ b/WebCore/rendering/RenderSVGViewportContainer.cpp
@@ -39,7 +39,7 @@ RenderSVGViewportContainer::RenderSVGViewportContainer(SVGStyledElement* node)
 
 void RenderSVGViewportContainer::applyViewportClip(PaintInfo& paintInfo)
 {
-    if (SVGRenderBase::isOverflowHidden(this))
+    if (SVGRenderSupport::isOverflowHidden(this))
         paintInfo.context->clip(m_viewport);
 }
 
@@ -49,7 +49,7 @@ void RenderSVGViewportContainer::calcViewport()
     if (svgelem->hasTagName(SVGNames::svgTag)) {
         SVGSVGElement* svg = static_cast<SVGSVGElement*>(node());
 
-        if (!selfNeedsLayout() && !svg->hasRelativeValues())
+        if (!selfNeedsLayout() && !svg->hasRelativeLengths())
             return;
 
         float x = svg->x().value(svg);
@@ -82,7 +82,7 @@ const AffineTransform& RenderSVGViewportContainer::localToParentTransform() cons
 bool RenderSVGViewportContainer::pointIsInsideViewportClip(const FloatPoint& pointInParent)
 {
     // Respect the viewport clip (which is in parent coords)
-    if (!SVGRenderBase::isOverflowHidden(this))
+    if (!SVGRenderSupport::isOverflowHidden(this))
         return true;
     
     return m_viewport.contains(pointInParent);
diff --git a/WebCore/rendering/RenderScrollbarPart.cpp b/WebCore/rendering/RenderScrollbarPart.cpp
index c83248a..d2f1612 100644
--- a/WebCore/rendering/RenderScrollbarPart.cpp
+++ b/WebCore/rendering/RenderScrollbarPart.cpp
@@ -164,7 +164,7 @@ void RenderScrollbarPart::paintIntoRect(GraphicsContext* graphicsContext, int tx
         return;
 
     // Now do the paint.
-    RenderObject::PaintInfo paintInfo(graphicsContext, rect, PaintPhaseBlockBackground, false, 0, 0);
+    PaintInfo paintInfo(graphicsContext, rect, PaintPhaseBlockBackground, false, 0, 0);
     paint(paintInfo, tx, ty);
     paintInfo.phase = PaintPhaseChildBlockBackgrounds;
     paint(paintInfo, tx, ty);
diff --git a/WebCore/rendering/RenderTable.cpp b/WebCore/rendering/RenderTable.cpp
index 00c6ac0..65a0cde 100644
--- a/WebCore/rendering/RenderTable.cpp
+++ b/WebCore/rendering/RenderTable.cpp
@@ -524,7 +524,7 @@ void RenderTable::paintObject(PaintInfo& paintInfo, int tx, int ty)
 
     PaintInfo info(paintInfo);
     info.phase = paintPhase;
-    info.paintingRoot = paintingRootForChildren(paintInfo);
+    info.updatePaintingRootForChildren(this);
 
     for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
         if (child->isBox() && !toRenderBox(child)->hasSelfPaintingLayer() && (child->isTableSection() || child == m_caption))
@@ -555,7 +555,7 @@ void RenderTable::paintObject(PaintInfo& paintInfo, int tx, int ty)
 
 void RenderTable::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!shouldPaintWithinRoot(paintInfo))
+    if (!paintInfo.shouldPaintWithinRoot(this))
         return;
 
     int w = width();
diff --git a/WebCore/rendering/RenderTableCell.cpp b/WebCore/rendering/RenderTableCell.cpp
index de93107..11f3b52 100644
--- a/WebCore/rendering/RenderTableCell.cpp
+++ b/WebCore/rendering/RenderTableCell.cpp
@@ -681,7 +681,7 @@ int RenderTableCell::borderHalfBottom(bool outer) const
 void RenderTableCell::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     if (paintInfo.phase == PaintPhaseCollapsedTableBorders && style()->visibility() == VISIBLE) {
-        if (!shouldPaintWithinRoot(paintInfo))
+        if (!paintInfo.shouldPaintWithinRoot(this))
             return;
 
         tx += x();
@@ -855,7 +855,7 @@ void RenderTableCell::paintCollapsedBorder(GraphicsContext* graphicsContext, int
 
 void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, int ty, RenderObject* backgroundObject)
 {
-    if (!shouldPaintWithinRoot(paintInfo))
+    if (!paintInfo.shouldPaintWithinRoot(this))
         return;
 
     if (!backgroundObject)
@@ -897,7 +897,7 @@ void RenderTableCell::paintBackgroundsBehindCell(PaintInfo& paintInfo, int tx, i
 
 void RenderTableCell::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!shouldPaintWithinRoot(paintInfo))
+    if (!paintInfo.shouldPaintWithinRoot(this))
         return;
 
     RenderTable* tableElt = table();
diff --git a/WebCore/rendering/RenderTextControlSingleLine.cpp b/WebCore/rendering/RenderTextControlSingleLine.cpp
index ab56036..84ed8aa 100644
--- a/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -276,7 +276,8 @@ void RenderTextControlSingleLine::layout()
         // remaining one pixel. It's good for Mac NSStepper because it has
         // shadow at the bottom.
         int y = (diff / 2) + (diff % 2);
-        spinBox->setLocation(spinBox->x() + paddingRight() + borderRight(), y);
+        int x = width() - borderRight() - paddingRight() - spinBox->width();
+        spinBox->setLocation(x, y);
     }
 }
 
@@ -368,20 +369,18 @@ void RenderTextControlSingleLine::forwardEvent(Event* event)
 
     FloatPoint localPoint = innerTextRenderer->absoluteToLocal(static_cast<MouseEvent*>(event)->absoluteLocation(), false, true);
     int textRight = innerTextRenderer->borderBoxRect().right();
+
 #if ENABLE(INPUT_SPEECH)
-    int cancelRight = textRight;
-    if (m_cancelButton && m_cancelButton->renderBox()) {
-        RenderBox* cancelRenderer = m_cancelButton->renderBox();
-        cancelRight += cancelRenderer->width() + cancelRenderer->marginLeft() + cancelRenderer->marginRight();
+    if (RenderBox* speechBox = m_speechButton ? m_speechButton->renderBox() : 0) {
+        if (localPoint.x() >= speechBox->x() && localPoint.x() < speechBox->x() + speechBox->width()) {
+            m_speechButton->defaultEventHandler(event);
+            return;
+        }
     }
 #endif
 
     if (m_resultsButton && localPoint.x() < innerTextRenderer->borderBoxRect().x())
         m_resultsButton->defaultEventHandler(event);
-#if ENABLE(INPUT_SPEECH)
-    else if (m_speechButton && localPoint.x() > cancelRight)
-        m_speechButton->defaultEventHandler(event);
-#endif
     else if (m_cancelButton && localPoint.x() > textRight)
         m_cancelButton->defaultEventHandler(event);
     else if (m_outerSpinButton && localPoint.x() > textRight)
@@ -618,6 +617,10 @@ void RenderTextControlSingleLine::createSubtreeIfNeeded()
         m_innerBlock = TextControlInnerElement::create(node());
         m_innerBlock->attachInnerElement(node(), createInnerBlockStyle(style()), renderArena());
     }
+    if (inputElement()->hasSpinButton() && !m_outerSpinButton) {
+        m_outerSpinButton = SpinButtonElement::create(node());
+        m_outerSpinButton->attachInnerElement(node(), createOuterSpinButtonStyle(), renderArena());
+    }
 
     if (inputElement()->isSearchField()) {
         if (!m_resultsButton) {
@@ -722,7 +725,7 @@ PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerBlockStyle(const
     RefPtr<RenderStyle> innerBlockStyle = RenderStyle::create();
     innerBlockStyle->inheritFrom(startStyle);
 
-    innerBlockStyle->setDisplay(BLOCK);
+    innerBlockStyle->setDisplay(inputElement()->hasSpinButton() ? INLINE_BLOCK : BLOCK);
     innerBlockStyle->setDirection(LTR);
 
     // We don't want the shadow dom to be editable, so we set this block to read-only in case the input itself is editable.
diff --git a/WebCore/rendering/RenderTheme.cpp b/WebCore/rendering/RenderTheme.cpp
index 407f273..2c6e9da 100644
--- a/WebCore/rendering/RenderTheme.cpp
+++ b/WebCore/rendering/RenderTheme.cpp
@@ -44,6 +44,10 @@
 #include "RenderMeter.h"
 #endif
 
+#if ENABLE(INPUT_SPEECH)
+#include "RenderInputSpeech.h"
+#endif
+
 // The methods in this file are shared by all themes on every platform.
 
 namespace WebCore {
@@ -234,14 +238,14 @@ void RenderTheme::adjustStyle(CSSStyleSelector* selector, RenderStyle* style, El
 #endif
 #if ENABLE(INPUT_SPEECH)
         case InputSpeechButtonPart:
-            // FIXME: Adjust the speech button's style and sizes.
+            return adjustInputFieldSpeechButtonStyle(selector, style, e);
 #endif
         default:
             break;
     }
 }
 
-bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderTheme::paint(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     // If painting is disabled, but we aren't updating control tints, then just bail.
     // If we are updating control tints, just schedule a repaint if the theme supports tinting
@@ -368,7 +372,7 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
             return paintSearchFieldResultsButton(o, paintInfo, r);
 #if ENABLE(INPUT_SPEECH)
         case InputSpeechButtonPart:
-            // FIXME: Add painting code to draw the speech button.
+            return paintInputFieldSpeechButton(o, paintInfo, r);
 #endif
         default:
             break;
@@ -377,7 +381,7 @@ bool RenderTheme::paint(RenderObject* o, const RenderObject::PaintInfo& paintInf
     return true; // We don't support the appearance, so let the normal background/border paint.
 }
 
-bool RenderTheme::paintBorderOnly(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderTheme::paintBorderOnly(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     if (paintInfo.context->paintingDisabled())
         return false;
@@ -428,7 +432,7 @@ bool RenderTheme::paintBorderOnly(RenderObject* o, const RenderObject::PaintInfo
     return false;
 }
 
-bool RenderTheme::paintDecorations(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderTheme::paintDecorations(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     if (paintInfo.context->paintingDisabled())
         return false;
@@ -926,6 +930,18 @@ void RenderTheme::adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*)
 {
 }
 
+#if ENABLE(INPUT_SPEECH)
+void RenderTheme::adjustInputFieldSpeechButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* element) const
+{
+    RenderInputSpeech::adjustInputFieldSpeechButtonStyle(selector, style, element);
+}
+
+bool RenderTheme::paintInputFieldSpeechButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
+{
+    return RenderInputSpeech::paintInputFieldSpeechButton(object, paintInfo, rect);
+}
+#endif
+
 #if ENABLE(METER_TAG)
 void RenderTheme::adjustMeterStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
 {
@@ -942,7 +958,7 @@ bool RenderTheme::supportsMeter(ControlPart, bool) const
     return false;
 }
 
-bool RenderTheme::paintMeter(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
+bool RenderTheme::paintMeter(RenderObject*, const PaintInfo&, const IntRect&)
 {
     return true;
 }
diff --git a/WebCore/rendering/RenderTheme.h b/WebCore/rendering/RenderTheme.h
index 72a33dc..47217ca 100644
--- a/WebCore/rendering/RenderTheme.h
+++ b/WebCore/rendering/RenderTheme.h
@@ -76,9 +76,9 @@ public:
     // This method is called to paint the widget as a background of the RenderObject.  A widget's foreground, e.g., the
     // text of a button, is always rendered by the engine itself.  The boolean return value indicates
     // whether the CSS border/background should also be painted.
-    bool paint(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    bool paintBorderOnly(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    bool paintDecorations(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    bool paint(RenderObject*, const PaintInfo&, const IntRect&);
+    bool paintBorderOnly(RenderObject*, const PaintInfo&, const IntRect&);
+    bool paintDecorations(RenderObject*, const PaintInfo&, const IntRect&);
 
     // The remaining methods should be implemented by the platform-specific portion of the theme, e.g.,
     // RenderThemeMac.cpp for Mac OS X.
@@ -173,7 +173,7 @@ public:
     virtual ScrollbarControlSize scrollbarControlSizeForPart(ControlPart) { return RegularScrollbar; }
 
     // Method for painting the caps lock indicator
-    virtual bool paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return 0; };
+    virtual bool paintCapsLockIndicator(RenderObject*, const PaintInfo&, const IntRect&) { return 0; };
 
 #if ENABLE(PROGRESS_TAG)
     // Returns the repeat interval of the animation for the progress bar.
@@ -216,85 +216,90 @@ protected:
 #if !USE(NEW_THEME)
     // Methods for each appearance value.
     virtual void adjustCheckboxStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintCheckbox(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
     virtual void setCheckboxSize(RenderStyle*) const { }
 
     virtual void adjustRadioStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintRadio(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
     virtual void setRadioSize(RenderStyle*) const { }
 
     virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
     virtual void setButtonSize(RenderStyle*) const { }
 
     virtual void adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintInnerSpinButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintInnerSpinButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
     virtual void adjustOuterSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintOuterSpinButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintOuterSpinButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 #endif
 
     virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
     virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
 #ifdef ANDROID_LISTBOX_USES_MENU_LIST
     virtual void adjustListboxStyle(CSSStyleSelector*, RenderStyle*, Element*) const {}
 #endif
     virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
     virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
 #if ENABLE(METER_TAG)
     virtual void adjustMeterStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintMeter(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMeter(RenderObject*, const PaintInfo&, const IntRect&);
 #endif
 
 #if ENABLE(PROGRESS_TAG)
     virtual void adjustProgressBarStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintProgressBar(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+#endif
+
+#if ENABLE(INPUT_SPEECH)
+    virtual void adjustInputFieldSpeechButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintInputFieldSpeechButton(RenderObject*, const PaintInfo&, const IntRect&);
 #endif
 
     virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintSliderTrack(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
     virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
     virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
     virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
     virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintSearchFieldDecoration(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
     virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
     virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-
-    virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaVolumeSliderContainer(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
-    virtual bool paintMediaTimeRemaining(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintSearchFieldResultsButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaSeekBackButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaSeekForwardButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderContainer(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaRewindButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaControlsBackground(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaCurrentTime(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
+    virtual bool paintMediaTimeRemaining(RenderObject*, const PaintInfo&, const IntRect&) { return true; }
 
 public:
     // Methods for state querying
diff --git a/WebCore/rendering/RenderThemeChromiumLinux.cpp b/WebCore/rendering/RenderThemeChromiumLinux.cpp
index 13c9cd6..c29353d 100644
--- a/WebCore/rendering/RenderThemeChromiumLinux.cpp
+++ b/WebCore/rendering/RenderThemeChromiumLinux.cpp
@@ -32,9 +32,9 @@
 
 namespace WebCore {
 
-unsigned RenderThemeChromiumLinux::m_thumbInactiveColor = 0xf0ebe5;
-unsigned RenderThemeChromiumLinux::m_thumbActiveColor = 0xfaf8f5;
-unsigned RenderThemeChromiumLinux::m_trackColor = 0xe3ddd8;
+unsigned RenderThemeChromiumLinux::m_thumbInactiveColor = 0xeaeaea;
+unsigned RenderThemeChromiumLinux::m_thumbActiveColor = 0xf4f4f4;
+unsigned RenderThemeChromiumLinux::m_trackColor = 0xd3d3d3;
 unsigned RenderThemeChromiumLinux::m_activeSelectionBackgroundColor =
     0xff1e90ff;
 unsigned RenderThemeChromiumLinux::m_activeSelectionForegroundColor =
diff --git a/WebCore/rendering/RenderThemeChromiumMac.h b/WebCore/rendering/RenderThemeChromiumMac.h
index aaaade0..2309081 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.h
+++ b/WebCore/rendering/RenderThemeChromiumMac.h
@@ -34,15 +34,15 @@ public:
 protected:
 #if ENABLE(VIDEO)
     virtual void adjustMediaSliderThumbSize(RenderObject*) const;
-    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaControlsBackground(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
     virtual String extraMediaControlsStyleSheet();
 
-    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
 
 #endif
 
diff --git a/WebCore/rendering/RenderThemeChromiumMac.mm b/WebCore/rendering/RenderThemeChromiumMac.mm
index e572b69..a43da1e 100644
--- a/WebCore/rendering/RenderThemeChromiumMac.mm
+++ b/WebCore/rendering/RenderThemeChromiumMac.mm
@@ -109,22 +109,22 @@ bool RenderThemeChromiumMac::shouldRenderMediaControlPart(ControlPart part, Elem
     return RenderMediaControlsChromium::shouldRenderMediaControlPart(part, e);
 }
 
-bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumMac::paintMediaPlayButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumMac::paintMediaMuteButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaMuteButton, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumMac::paintMediaSliderTrack(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaSlider, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumMac::paintMediaControlsBackground(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
 }
@@ -134,12 +134,12 @@ String RenderThemeChromiumMac::extraMediaControlsStyleSheet()
     return String(mediaControlsChromiumUserAgentStyleSheet, sizeof(mediaControlsChromiumUserAgentStyleSheet));
 }
 
-bool RenderThemeChromiumMac::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumMac::paintMediaVolumeSliderTrack(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSlider, object, paintInfo, rect);
 }
 
-bool RenderThemeChromiumMac::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumMac::paintMediaVolumeSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSliderThumb, object, paintInfo, rect);
 }
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.cpp b/WebCore/rendering/RenderThemeChromiumSkia.cpp
index e3afd1f..d90bbc2 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.cpp
+++ b/WebCore/rendering/RenderThemeChromiumSkia.cpp
@@ -235,19 +235,23 @@ IntRect center(const IntRect& original, int width, int height)
     return IntRect(x, y, width, height);
 }
 
-bool RenderThemeChromiumSkia::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintCheckbox(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     static Image* const checkedImage = Image::loadPlatformResource("linuxCheckboxOn").releaseRef();
     static Image* const uncheckedImage = Image::loadPlatformResource("linuxCheckboxOff").releaseRef();
+    static Image* const indeterminateImage = Image::loadPlatformResource("linuxCheckboxIndeterminate").releaseRef();
     static Image* const disabledCheckedImage = Image::loadPlatformResource("linuxCheckboxDisabledOn").releaseRef();
     static Image* const disabledUncheckedImage = Image::loadPlatformResource("linuxCheckboxDisabledOff").releaseRef();
+    static Image* const disabledIndeterminateImage = Image::loadPlatformResource("linuxCheckboxDisabledIndeterminate").releaseRef();
 
     Image* image;
 
-    if (this->isEnabled(o))
-        image = this->isChecked(o) ? checkedImage : uncheckedImage;
+    if (isIndeterminate(o))
+        image = isEnabled(o) ? indeterminateImage : disabledIndeterminateImage;
+    else if (isChecked(o))
+        image = isEnabled(o) ? checkedImage : disabledCheckedImage;
     else
-        image = this->isChecked(o) ? disabledCheckedImage : disabledUncheckedImage;
+        image = isEnabled(o) ? uncheckedImage : disabledUncheckedImage;
 
     i.context->drawImage(image, o->style()->colorSpace(), center(rect, widgetStandardHeight, widgetStandardWidth));
     return false;
@@ -268,7 +272,7 @@ void RenderThemeChromiumSkia::setCheckboxSize(RenderStyle* style) const
     setSizeIfAuto(style, size);
 }
 
-bool RenderThemeChromiumSkia::paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintRadio(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     static Image* const checkedImage = Image::loadPlatformResource("linuxRadioOn").releaseRef();
     static Image* const uncheckedImage = Image::loadPlatformResource("linuxRadioOff").releaseRef();
@@ -302,7 +306,7 @@ static SkColor brightenColor(double h, double s, double l, float brightenAmount)
     return makeRGBAFromHSLA(h, s, l, 1.0);
 }
 
-static void paintButtonLike(RenderTheme* theme, RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+static void paintButtonLike(RenderTheme* theme, RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     SkCanvas* const canvas = i.context->platformContext()->canvas();
     SkPaint paint;
@@ -360,7 +364,7 @@ static void paintButtonLike(RenderTheme* theme, RenderObject* o, const RenderObj
     canvas->drawPoint(right - 2, bottom - 2, paint);
 }
 
-bool RenderThemeChromiumSkia::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     paintButtonLike(this, o, i, rect);
     return false;
@@ -375,12 +379,12 @@ void RenderThemeChromiumSkia::adjustButtonStyle(CSSStyleSelector*, RenderStyle*
 }
 
 
-bool RenderThemeChromiumSkia::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintTextField(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return true;
 }
 
-bool RenderThemeChromiumSkia::paintTextArea(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumSkia::paintTextArea(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintTextField(o, i, r);
 }
@@ -391,7 +395,7 @@ void RenderThemeChromiumSkia::adjustSearchFieldStyle(CSSStyleSelector*, RenderSt
      style->setLineHeight(RenderStyle::initialLineHeight());
 }
 
-bool RenderThemeChromiumSkia::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumSkia::paintSearchField(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintTextField(o, i, r);
 }
@@ -417,7 +421,7 @@ IntRect RenderThemeChromiumSkia::convertToPaintingRect(RenderObject* inputRender
     return partRect;
 }
 
-bool RenderThemeChromiumSkia::paintSearchFieldCancelButton(RenderObject* cancelButtonObject, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumSkia::paintSearchFieldCancelButton(RenderObject* cancelButtonObject, const PaintInfo& paintInfo, const IntRect& r)
 {
     // Get the renderer of <input> element.
     Node* input = cancelButtonObject->node()->shadowAncestorNode();
@@ -460,7 +464,7 @@ void RenderThemeChromiumSkia::adjustSearchFieldResultsDecorationStyle(CSSStyleSe
     style->setHeight(Length(magnifierSize, Fixed));
 }
 
-bool RenderThemeChromiumSkia::paintSearchFieldResultsDecoration(RenderObject* magnifierObject, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumSkia::paintSearchFieldResultsDecoration(RenderObject* magnifierObject, const PaintInfo& paintInfo, const IntRect& r)
 {
     // Get the renderer of <input> element.
     Node* input = magnifierObject->node()->shadowAncestorNode();
@@ -495,7 +499,7 @@ void RenderThemeChromiumSkia::adjustSearchFieldResultsButtonStyle(CSSStyleSelect
     style->setHeight(Length(magnifierHeight, Fixed));
 }
 
-bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* magnifierObject, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* magnifierObject, const PaintInfo& paintInfo, const IntRect& r)
 {
     // Get the renderer of <input> element.
     Node* input = magnifierObject->node()->shadowAncestorNode();
@@ -517,7 +521,7 @@ bool RenderThemeChromiumSkia::paintSearchFieldResultsButton(RenderObject* magnif
     return false;
 }
 
-bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaTimelineContainer, object, paintInfo, rect);
@@ -529,7 +533,7 @@ bool RenderThemeChromiumSkia::paintMediaControlsBackground(RenderObject* object,
 #endif
 }
 
-bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaSlider, object, paintInfo, rect);
@@ -541,7 +545,7 @@ bool RenderThemeChromiumSkia::paintMediaSliderTrack(RenderObject* object, const
 #endif
 }
 
-bool RenderThemeChromiumSkia::paintMediaVolumeSliderTrack(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMediaVolumeSliderTrack(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSlider, object, paintInfo, rect);
@@ -562,7 +566,7 @@ void RenderThemeChromiumSkia::adjustSliderThumbSize(RenderObject* object) const
 #endif
 }
 
-bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaSliderThumb, object, paintInfo, rect);
@@ -574,7 +578,7 @@ bool RenderThemeChromiumSkia::paintMediaSliderThumb(RenderObject* object, const
 #endif
 }
 
-bool RenderThemeChromiumSkia::paintMediaVolumeSliderThumb(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMediaVolumeSliderThumb(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaVolumeSliderThumb, object, paintInfo, rect);
@@ -586,7 +590,7 @@ bool RenderThemeChromiumSkia::paintMediaVolumeSliderThumb(RenderObject* object,
 #endif
 }
 
-bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaPlayButton, object, paintInfo, rect);
@@ -598,7 +602,7 @@ bool RenderThemeChromiumSkia::paintMediaPlayButton(RenderObject* object, const R
 #endif
 }
 
-bool RenderThemeChromiumSkia::paintMediaMuteButton(RenderObject* object, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMediaMuteButton(RenderObject* object, const PaintInfo& paintInfo, const IntRect& rect)
 {
 #if ENABLE(VIDEO)
     return RenderMediaControlsChromium::paintMediaControlsPart(MediaMuteButton, object, paintInfo, rect);
@@ -616,7 +620,7 @@ void RenderThemeChromiumSkia::adjustMenuListStyle(CSSStyleSelector* selector, Re
     style->setLineHeight(RenderStyle::initialLineHeight());
 }
 
-bool RenderThemeChromiumSkia::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     SkCanvas* const canvas = i.context->platformContext()->canvas();
     const int right = rect.x() + rect.width();
@@ -646,12 +650,12 @@ void RenderThemeChromiumSkia::adjustMenuListButtonStyle(CSSStyleSelector* select
 }
 
 // Used to paint styled menulists (i.e. with a non-default border)
-bool RenderThemeChromiumSkia::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintMenuListButton(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     return paintMenuList(o, i, rect);
 }
 
-bool RenderThemeChromiumSkia::paintSliderTrack(RenderObject*, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintSliderTrack(RenderObject*, const PaintInfo& i, const IntRect& rect)
 {
     // Just paint a grey box for now (matches the color of a scrollbar background.
     SkCanvas* const canvas = i.context->platformContext()->canvas();
@@ -670,7 +674,7 @@ bool RenderThemeChromiumSkia::paintSliderTrack(RenderObject*, const RenderObject
     return false;
 }
 
-bool RenderThemeChromiumSkia::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintSliderThumb(RenderObject* o, const PaintInfo& i, const IntRect& rect)
 {
     // Make a thumb similar to the scrollbar thumb.
     const bool hovered = isHovered(o) || toRenderSlider(o->parent())->inDragMode();
@@ -812,7 +816,7 @@ double RenderThemeChromiumSkia::animationDurationForProgressBar(RenderProgress*
     return progressAnimationInterval * progressAnimationFrmaes * 2; // "2" for back and forth
 }
 
-bool RenderThemeChromiumSkia::paintProgressBar(RenderObject* renderObject, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeChromiumSkia::paintProgressBar(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
 {
     static Image* barImage = Image::loadPlatformResource("linuxProgressBar").releaseRef();
     static Image* valueImage = Image::loadPlatformResource("linuxProgressValue").releaseRef();
diff --git a/WebCore/rendering/RenderThemeChromiumSkia.h b/WebCore/rendering/RenderThemeChromiumSkia.h
index 56c315e..a11046d 100644
--- a/WebCore/rendering/RenderThemeChromiumSkia.h
+++ b/WebCore/rendering/RenderThemeChromiumSkia.h
@@ -66,41 +66,41 @@ class RenderProgress;
 
         virtual int minimumMenuListSize(RenderStyle*) const;
 
-        virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintCheckbox(RenderObject*, const PaintInfo&, const IntRect&);
         virtual void setCheckboxSize(RenderStyle*) const;
 
-        virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintRadio(RenderObject*, const PaintInfo&, const IntRect&);
         virtual void setRadioSize(RenderStyle*) const;
 
-        virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
         virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-        virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
 
-        virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&);
 
         virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
 
         virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&);
 
         virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
         virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
         virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSearchFieldResultsButton(RenderObject*, const PaintInfo&, const IntRect&);
 
-        virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaVolumeSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaControlsBackground(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaVolumeSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
         virtual void adjustSliderThumbSize(RenderObject*) const;
-        virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaVolumeSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaVolumeSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
 
         // MenuList refers to an unstyled menulist (meaning a menulist without
         // background-color or border set) and MenuListButton refers to a styled
@@ -112,17 +112,17 @@ class RenderProgress;
         // codepath. We never go down both. And in both cases, they render the
         // entire menulist.
         virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
         virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
 
-        virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
 
 #if ENABLE(PROGRESS_TAG)
         virtual double animationRepeatIntervalForProgressBar(RenderProgress*) const;
         virtual double animationDurationForProgressBar(RenderProgress*) const;
-        virtual bool paintProgressBar(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&);
 #endif
 
         // These methods define the padding for the MenuList's inner block.
diff --git a/WebCore/rendering/RenderThemeChromiumWin.cpp b/WebCore/rendering/RenderThemeChromiumWin.cpp
index d82fddc..1172f96 100644
--- a/WebCore/rendering/RenderThemeChromiumWin.cpp
+++ b/WebCore/rendering/RenderThemeChromiumWin.cpp
@@ -374,16 +374,16 @@ void RenderThemeChromiumWin::adjustSliderThumbSize(RenderObject* o) const
         RenderThemeChromiumSkia::adjustSliderThumbSize(o);
 }
 
-bool RenderThemeChromiumWin::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumWin::paintCheckbox(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintButton(o, i, r);
 }
-bool RenderThemeChromiumWin::paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumWin::paintRadio(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintButton(o, i, r);
 }
 
-bool RenderThemeChromiumWin::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumWin::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     const ThemeData& themeData = getThemeData(o);
 
@@ -396,12 +396,12 @@ bool RenderThemeChromiumWin::paintButton(RenderObject* o, const RenderObject::Pa
     return false;
 }
 
-bool RenderThemeChromiumWin::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumWin::paintTextField(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintTextFieldInternal(o, i, r, true);
 }
 
-bool RenderThemeChromiumWin::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumWin::paintSliderTrack(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     const ThemeData& themeData = getThemeData(o);
 
@@ -414,13 +414,13 @@ bool RenderThemeChromiumWin::paintSliderTrack(RenderObject* o, const RenderObjec
     return false;
 }
 
-bool RenderThemeChromiumWin::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumWin::paintSliderThumb(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintSliderTrack(o, i, r);
 }
 
 // Used to paint unstyled menulists (i.e. with the default border)
-bool RenderThemeChromiumWin::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumWin::paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     if (!o->isBox())
         return false;
@@ -501,8 +501,14 @@ unsigned RenderThemeChromiumWin::determineState(RenderObject* o)
         result = ETS_FOCUSED;
     else if (isHovered(o))
         result = TS_HOT;
-    if (isChecked(o))
-        result += 4; // 4 unchecked states, 4 checked states.
+
+    // CBS_UNCHECKED*: 1-4
+    // CBS_CHECKED*: 5-8
+    // CBS_MIXED*: 9-12
+    if (isIndeterminate(o))
+        result += 8;
+    else if (isChecked(o))
+        result += 4;
     return result;
 }
 
@@ -550,7 +556,8 @@ unsigned RenderThemeChromiumWin::determineClassicState(RenderObject* o)
             result = 0;
         else if (isHovered(o))
             result = DFCS_HOT;
-        if (isChecked(o))
+        // Classic theme can't represent indeterminate states. Use unchecked appearance.
+        if (isChecked(o) && !isIndeterminate(o))
             result |= DFCS_CHECKED;
     }
     return result;
@@ -609,7 +616,7 @@ ThemeData RenderThemeChromiumWin::getThemeData(RenderObject* o)
 }
 
 bool RenderThemeChromiumWin::paintTextFieldInternal(RenderObject* o,
-                                                    const RenderObject::PaintInfo& i,
+                                                    const PaintInfo& i,
                                                     const IntRect& r,
                                                     bool drawEdges)
 {
@@ -677,7 +684,7 @@ void RenderThemeChromiumWin::adjustProgressBarStyle(CSSStyleSelector*, RenderSty
 {
 }
 
-bool RenderThemeChromiumWin::paintProgressBar(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeChromiumWin::paintProgressBar(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     if (!o->isProgress())
         return true;
@@ -689,7 +696,7 @@ bool RenderThemeChromiumWin::paintProgressBar(RenderObject* o, const RenderObjec
     double animatedSeconds = renderProgress->animationStartTime() ?  WTF::currentTime() - renderProgress->animationStartTime() : 0;
     ThemePainter painter(i.context, r);
     ChromiumBridge::paintProgressBar(painter.context(), r, valueRect, renderProgress->isDeterminate(), animatedSeconds);
-    return true;
+    return false;
 }
 
 #endif
diff --git a/WebCore/rendering/RenderThemeChromiumWin.h b/WebCore/rendering/RenderThemeChromiumWin.h
index 131314a..c6c95e6 100644
--- a/WebCore/rendering/RenderThemeChromiumWin.h
+++ b/WebCore/rendering/RenderThemeChromiumWin.h
@@ -64,12 +64,12 @@ namespace WebCore {
         virtual void adjustSliderThumbSize(RenderObject*) const;
 
         // Various paint functions.
-        virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintCheckbox(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintRadio(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
 
         // MenuList refers to an unstyled menulist (meaning a menulist without
         // background-color or border set) and MenuListButton refers to a styled
@@ -80,7 +80,7 @@ namespace WebCore {
         // In short, we either go down the MenuList code path or the MenuListButton
         // codepath. We never go down both. And in both cases, they render the
         // entire menulist.
-        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
 
         // Override RenderThemeChromiumSkia's setDefaultFontSize method to also reset the local font property caches.
         // See comment in RenderThemeChromiumSkia::setDefaultFontSize() regarding ugliness of this hack.
@@ -91,7 +91,7 @@ namespace WebCore {
         virtual double animationRepeatIntervalForProgressBar(RenderProgress*) const;
         virtual double animationDurationForProgressBar(RenderProgress*) const;
         virtual void adjustProgressBarStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintProgressBar(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&);
 #endif
 
     protected:
@@ -107,7 +107,7 @@ namespace WebCore {
 
         ThemeData getThemeData(RenderObject*);
 
-        bool paintTextFieldInternal(RenderObject*, const RenderObject::PaintInfo&, const IntRect&, bool);
+        bool paintTextFieldInternal(RenderObject*, const PaintInfo&, const IntRect&, bool);
     };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderThemeMac.h b/WebCore/rendering/RenderThemeMac.h
index 34dbed3..44d9189 100644
--- a/WebCore/rendering/RenderThemeMac.h
+++ b/WebCore/rendering/RenderThemeMac.h
@@ -78,11 +78,11 @@ public:
     virtual int popupInternalPaddingTop(RenderStyle*) const;
     virtual int popupInternalPaddingBottom(RenderStyle*) const;
     
-    virtual bool paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintCapsLockIndicator(RenderObject*, const PaintInfo&, const IntRect&);
 
 #if ENABLE(METER_TAG)
     virtual IntSize meterSizeForBounds(const RenderMeter*, const IntRect&) const;
-    virtual bool paintMeter(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMeter(RenderObject*, const PaintInfo&, const IntRect&);
     virtual bool supportsMeter(ControlPart, bool isHorizontal) const;
 #endif
 
@@ -104,58 +104,58 @@ protected:
 
     virtual bool supportsSelectionForegroundColors() const { return false; }
 
-    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
 #if ENABLE(PROGRESS_TAG)
     virtual void adjustProgressBarStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintProgressBar(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&);
 #endif
 
-    virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
     virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsButton(RenderObject*, const PaintInfo&, const IntRect&);
 
 #if ENABLE(VIDEO)
-    virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaRewindButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaControlsBackground(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaCurrentTime(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaTimeRemaining(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekBackButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekForwardButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaRewindButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaReturnToRealtimeButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaControlsBackground(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaCurrentTime(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaTimeRemaining(RenderObject*, const PaintInfo&, const IntRect&);
 
     // Media controls
     virtual String extraMediaControlsStyleSheet();
@@ -192,7 +192,7 @@ private:
     const IntSize* popupButtonSizes() const;
     const int* popupButtonMargins() const;
     const int* popupButtonPadding(NSControlSize) const;
-    void paintMenuListButtonGradients(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    void paintMenuListButtonGradients(RenderObject*, const PaintInfo&, const IntRect&);
     const IntSize* menuListSizes() const;
 
     const IntSize* searchFieldSizes() const;
diff --git a/WebCore/rendering/RenderThemeMac.mm b/WebCore/rendering/RenderThemeMac.mm
index 9c79386..993bc72 100644
--- a/WebCore/rendering/RenderThemeMac.mm
+++ b/WebCore/rendering/RenderThemeMac.mm
@@ -706,7 +706,7 @@ NSControlSize RenderThemeMac::controlSizeForSystemFont(RenderStyle* style) const
     return NSMiniControlSize;
 }
 
-bool RenderThemeMac::paintTextField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintTextField(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     LocalCurrentGraphicsContext localContext(paintInfo.context);
     wkDrawBezeledTextFieldCell(r, isEnabled(o) && !isReadOnlyControl(o));
@@ -717,7 +717,7 @@ void RenderThemeMac::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Eleme
 {
 }
 
-bool RenderThemeMac::paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintCapsLockIndicator(RenderObject*, const PaintInfo& paintInfo, const IntRect& r)
 {
     if (paintInfo.context->paintingDisabled())
         return true;
@@ -728,7 +728,7 @@ bool RenderThemeMac::paintCapsLockIndicator(RenderObject*, const RenderObject::P
     return false;
 }
 
-bool RenderThemeMac::paintTextArea(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintTextArea(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     LocalCurrentGraphicsContext localContext(paintInfo.context);
     wkDrawBezeledTextArea(r, isEnabled(o) && !isReadOnlyControl(o));
@@ -767,7 +767,7 @@ const int* RenderThemeMac::popupButtonPadding(NSControlSize size) const
     return padding[size];
 }
 
-bool RenderThemeMac::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMenuList(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     LocalCurrentGraphicsContext localContext(paintInfo.context);
     setPopupButtonCellState(o, r);
@@ -821,7 +821,7 @@ IntSize RenderThemeMac::meterSizeForBounds(const RenderMeter* renderMeter, const
                    bounds.height() < cellSize.height ? cellSize.height : bounds.height());
 }
 
-bool RenderThemeMac::paintMeter(RenderObject* renderObject, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeMac::paintMeter(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
 {
     if (!renderObject->isMeter())
         return true;
@@ -930,7 +930,7 @@ void RenderThemeMac::adjustProgressBarStyle(CSSStyleSelector*, RenderStyle*, Ele
 {
 }
 
-bool RenderThemeMac::paintProgressBar(RenderObject* renderObject, const RenderObject::PaintInfo& paintInfo, const IntRect& rect)
+bool RenderThemeMac::paintProgressBar(RenderObject* renderObject, const PaintInfo& paintInfo, const IntRect& rect)
 {
     if (!renderObject->isProgress())
         return true;
@@ -1020,7 +1020,7 @@ static void TrackGradientInterpolate(void*, const CGFloat* inData, CGFloat* outD
         outData[i] = (1.0f - a) * dark[i] + a * light[i];
 }
 
-void RenderThemeMac::paintMenuListButtonGradients(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+void RenderThemeMac::paintMenuListButtonGradients(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     if (r.isEmpty())
         return;
@@ -1087,7 +1087,7 @@ void RenderThemeMac::paintMenuListButtonGradients(RenderObject* o, const RenderO
     paintInfo.context->restore();
 }
 
-bool RenderThemeMac::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMenuListButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     IntRect bounds = IntRect(r.x() + o->style()->borderLeftWidth(),
                              r.y() + o->style()->borderTopWidth(),
@@ -1270,7 +1270,7 @@ void RenderThemeMac::adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle* styl
     style->setBoxShadow(0);
 }
 
-bool RenderThemeMac::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     IntRect bounds = r;
     float zoomLevel = o->style()->effectiveZoom();
@@ -1316,7 +1316,7 @@ void RenderThemeMac::adjustSliderThumbStyle(CSSStyleSelector*, RenderStyle* styl
 
 const float verticalSliderHeightPadding = 0.1f;
 
-bool RenderThemeMac::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(o->parent()->isSlider());
 
@@ -1377,7 +1377,7 @@ bool RenderThemeMac::paintSliderThumb(RenderObject* o, const RenderObject::Paint
     return false;
 }
 
-bool RenderThemeMac::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintSearchField(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     NSSearchFieldCell* search = this->search();
     LocalCurrentGraphicsContext localContext(paintInfo.context);
@@ -1474,7 +1474,7 @@ void RenderThemeMac::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderSt
     style->setBoxShadow(0);
 }
 
-bool RenderThemeMac::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* input = o->node()->shadowAncestorNode();
     if (!input->renderer()->isBox())
@@ -1492,6 +1492,16 @@ bool RenderThemeMac::paintSearchFieldCancelButton(RenderObject* o, const RenderO
     float zoomLevel = o->style()->effectiveZoom();
 
     FloatRect localBounds = [search cancelButtonRectForBounds:NSRect(input->renderBox()->borderBoxRect())];
+
+#if ENABLE(INPUT_SPEECH)
+    // Take care of cases where the cancel button was not aligned with the right border of the input element (for e.g.
+    // when speech input is enabled for the input element.
+    IntRect absBoundingBox = input->renderer()->absoluteBoundingBoxRect();
+    int absRight = absBoundingBox.x() + absBoundingBox.width() - input->renderBox()->paddingRight() - input->renderBox()->borderRight();
+    int spaceToRightOfCancelButton = absRight - (r.x() + r.width());
+    localBounds.setX(localBounds.x() - spaceToRightOfCancelButton);
+#endif
+
     localBounds = convertToPaintingRect(input->renderer(), o, localBounds, r);
 
     FloatRect unzoomedRect(localBounds);
@@ -1539,7 +1549,7 @@ void RenderThemeMac::adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderS
     style->setBoxShadow(0);
 }
 
-bool RenderThemeMac::paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
+bool RenderThemeMac::paintSearchFieldDecoration(RenderObject*, const PaintInfo&, const IntRect&)
 {
     return false;
 }
@@ -1552,7 +1562,7 @@ void RenderThemeMac::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*,
     style->setBoxShadow(0);
 }
 
-bool RenderThemeMac::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo&, const IntRect& r)
+bool RenderThemeMac::paintSearchFieldResultsDecoration(RenderObject* o, const PaintInfo&, const IntRect& r)
 {
     Node* input = o->node()->shadowAncestorNode();
     if (!input->renderer()->isBox())
@@ -1584,7 +1594,7 @@ void RenderThemeMac::adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, Rend
     style->setBoxShadow(0);
 }
 
-bool RenderThemeMac::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintSearchFieldResultsButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* input = o->node()->shadowAncestorNode();
     if (!input->renderer()->isBox())
@@ -1712,7 +1722,7 @@ static unsigned getMediaUIPartStateFlags(Node* node)
 }
 
 // Utility to scale when the UI part are not scaled by wkDrawMediaUIPart
-static FloatRect getUnzoomedRectAndAdjustCurrentContext(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect &originalRect)
+static FloatRect getUnzoomedRectAndAdjustCurrentContext(RenderObject* o, const PaintInfo& paintInfo, const IntRect &originalRect)
 {
     float zoomLevel = o->style()->effectiveZoom();
     FloatRect unzoomedRect(originalRect);
@@ -1727,7 +1737,7 @@ static FloatRect getUnzoomedRectAndAdjustCurrentContext(RenderObject* o, const R
 }
 
 
-bool RenderThemeMac::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaFullscreenButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     if (!node)
@@ -1738,7 +1748,7 @@ bool RenderThemeMac::paintMediaFullscreenButton(RenderObject* o, const RenderObj
     return false;
 }
 
-bool RenderThemeMac::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaMuteButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     Node* mediaNode = node ? node->shadowAncestorNode() : 0;
@@ -1753,7 +1763,7 @@ bool RenderThemeMac::paintMediaMuteButton(RenderObject* o, const RenderObject::P
     return false;
 }
 
-bool RenderThemeMac::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaPlayButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     Node* mediaNode = node ? node->shadowAncestorNode() : 0;
@@ -1767,7 +1777,7 @@ bool RenderThemeMac::paintMediaPlayButton(RenderObject* o, const RenderObject::P
     return false;
 }
 
-bool RenderThemeMac::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaSeekBackButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     if (!node)
@@ -1778,7 +1788,7 @@ bool RenderThemeMac::paintMediaSeekBackButton(RenderObject* o, const RenderObjec
     return false;
 }
 
-bool RenderThemeMac::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaSeekForwardButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     if (!node)
@@ -1789,7 +1799,7 @@ bool RenderThemeMac::paintMediaSeekForwardButton(RenderObject* o, const RenderOb
     return false;
 }
 
-bool RenderThemeMac::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     Node* mediaNode = node ? node->shadowAncestorNode() : 0;
@@ -1817,7 +1827,7 @@ bool RenderThemeMac::paintMediaSliderTrack(RenderObject* o, const RenderObject::
     return false;
 }
 
-bool RenderThemeMac::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     if (!node)
@@ -1828,7 +1838,7 @@ bool RenderThemeMac::paintMediaSliderThumb(RenderObject* o, const RenderObject::
     return false;
 }
     
-bool RenderThemeMac::paintMediaRewindButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaRewindButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     if (!node)
@@ -1839,7 +1849,7 @@ bool RenderThemeMac::paintMediaRewindButton(RenderObject* o, const RenderObject:
     return false;
 }
 
-bool RenderThemeMac::paintMediaReturnToRealtimeButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaReturnToRealtimeButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     if (!node)
@@ -1850,7 +1860,7 @@ bool RenderThemeMac::paintMediaReturnToRealtimeButton(RenderObject* o, const Ren
     return false;
 }
 
-bool RenderThemeMac::paintMediaToggleClosedCaptionsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaToggleClosedCaptionsButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     HTMLInputElement* node = static_cast<HTMLInputElement*>(o->node());
     if (!node)
@@ -1866,7 +1876,7 @@ bool RenderThemeMac::paintMediaToggleClosedCaptionsButton(RenderObject* o, const
     return false;
 }
  
-bool RenderThemeMac::paintMediaControlsBackground(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaControlsBackground(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     if (!node)
@@ -1877,7 +1887,7 @@ bool RenderThemeMac::paintMediaControlsBackground(RenderObject* o, const RenderO
     return false;
 }
 
-bool RenderThemeMac::paintMediaCurrentTime(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaCurrentTime(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     if (!node)
@@ -1890,7 +1900,7 @@ bool RenderThemeMac::paintMediaCurrentTime(RenderObject* o, const RenderObject::
     return false;
 }
 
-bool RenderThemeMac::paintMediaTimeRemaining(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeMac::paintMediaTimeRemaining(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Node* node = o->node();
     if (!node)
diff --git a/WebCore/rendering/RenderThemeSafari.cpp b/WebCore/rendering/RenderThemeSafari.cpp
index 6a62384..07b8eb8 100644
--- a/WebCore/rendering/RenderThemeSafari.cpp
+++ b/WebCore/rendering/RenderThemeSafari.cpp
@@ -409,7 +409,7 @@ NSControlSize RenderThemeSafari::controlSizeForSystemFont(RenderStyle* style) co
     return NSMiniControlSize;
 }
 
-bool RenderThemeSafari::paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintCheckbox(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -448,7 +448,7 @@ void RenderThemeSafari::setCheckboxSize(RenderStyle* style) const
     setSizeFromFont(style, checkboxSizes());
 }
 
-bool RenderThemeSafari::paintRadio(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintRadio(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -572,7 +572,7 @@ void RenderThemeSafari::setButtonSize(RenderStyle* style) const
     setSizeFromFont(style, buttonSizes());
 }
 
-bool RenderThemeSafari::paintButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -605,7 +605,7 @@ bool RenderThemeSafari::paintButton(RenderObject* o, const RenderObject::PaintIn
     return false;
 }
 
-bool RenderThemeSafari::paintTextField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintTextField(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -617,7 +617,7 @@ void RenderThemeSafari::adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, El
 {
 }
 
-bool RenderThemeSafari::paintCapsLockIndicator(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintCapsLockIndicator(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {    
 #if defined(SAFARI_THEME_VERSION) && SAFARI_THEME_VERSION >= 1
     ASSERT(SafariThemeLibrary());
@@ -633,7 +633,7 @@ bool RenderThemeSafari::paintCapsLockIndicator(RenderObject* o, const RenderObje
 #endif
 }
 
-bool RenderThemeSafari::paintTextArea(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintTextArea(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -673,7 +673,7 @@ const int* RenderThemeSafari::popupButtonPadding(NSControlSize size) const
     return padding[size];
 }
 
-bool RenderThemeSafari::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& info, const IntRect& r)
+bool RenderThemeSafari::paintMenuList(RenderObject* o, const PaintInfo& info, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -742,7 +742,7 @@ static void TrackGradientInterpolate(void* info, const CGFloat* inData, CGFloat*
         outData[i] = (1.0f - a) * dark[i] + a * light[i];
 }
 
-void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     if (r.isEmpty())
         return;
@@ -809,7 +809,7 @@ void RenderThemeSafari::paintMenuListButtonGradients(RenderObject* o, const Rend
     paintInfo.context->restore();
 }
 
-bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     IntRect bounds = IntRect(r.x() + o->style()->borderLeftWidth(),
                              r.y() + o->style()->borderTopWidth(),
@@ -955,7 +955,7 @@ int RenderThemeSafari::minimumMenuListSize(RenderStyle* style) const
 const int trackWidth = 5;
 const int trackRadius = 2;
 
-bool RenderThemeSafari::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     IntRect bounds = r;
 
@@ -998,7 +998,7 @@ void RenderThemeSafari::adjustSliderThumbStyle(CSSStyleSelector* selector, Rende
 
 const float verticalSliderHeightPadding = 0.1f;
 
-bool RenderThemeSafari::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -1029,7 +1029,7 @@ void RenderThemeSafari::adjustSliderThumbSize(RenderObject* o) const
 #endif
 }
 
-bool RenderThemeSafari::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintSearchField(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -1082,7 +1082,7 @@ void RenderThemeSafari::adjustSearchFieldStyle(CSSStyleSelector* selector, Rende
     setFontFromControlSize(selector, style, controlSize);
 }
 
-bool RenderThemeSafari::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect&)
+bool RenderThemeSafari::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect&)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -1124,7 +1124,7 @@ void RenderThemeSafari::adjustSearchFieldDecorationStyle(CSSStyleSelector* selec
     style->setHeight(Length(size.height(), Fixed));
 }
 
-bool RenderThemeSafari::paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&)
+bool RenderThemeSafari::paintSearchFieldDecoration(RenderObject*, const PaintInfo&, const IntRect&)
 {
     return false;
 }
@@ -1136,7 +1136,7 @@ void RenderThemeSafari::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector
     style->setHeight(Length(size.height(), Fixed));
 }
 
-bool RenderThemeSafari::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect&)
+bool RenderThemeSafari::paintSearchFieldResultsDecoration(RenderObject* o, const PaintInfo& paintInfo, const IntRect&)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -1159,7 +1159,7 @@ void RenderThemeSafari::adjustSearchFieldResultsButtonStyle(CSSStyleSelector* se
     style->setHeight(Length(size.height(), Fixed));
 }
 
-bool RenderThemeSafari::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect&)
+bool RenderThemeSafari::paintSearchFieldResultsButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect&)
 {
     ASSERT(SafariThemeLibrary());
 
@@ -1174,37 +1174,37 @@ bool RenderThemeSafari::paintSearchFieldResultsButton(RenderObject* o, const Ren
     return false;
 }
 #if ENABLE(VIDEO)
-bool RenderThemeSafari::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintMediaFullscreenButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaFullscreenButton, o, paintInfo, r);
 }
 
-bool RenderThemeSafari::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintMediaMuteButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaMuteButton, o, paintInfo, r);
 }
 
-bool RenderThemeSafari::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintMediaPlayButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaPlayButton, o, paintInfo, r);
 }
 
-bool RenderThemeSafari::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintMediaSeekBackButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSeekBackButton, o, paintInfo, r);
 }
 
-bool RenderThemeSafari::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintMediaSeekForwardButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSeekForwardButton, o, paintInfo, r);
 }
 
-bool RenderThemeSafari::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintMediaSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSlider, o, paintInfo, r);
 }
 
-bool RenderThemeSafari::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeSafari::paintMediaSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSliderThumb, o, paintInfo, r);
 }
diff --git a/WebCore/rendering/RenderThemeSafari.h b/WebCore/rendering/RenderThemeSafari.h
index fb8ffb0..b91e28e 100644
--- a/WebCore/rendering/RenderThemeSafari.h
+++ b/WebCore/rendering/RenderThemeSafari.h
@@ -86,56 +86,56 @@ public:
 
 protected:
     // Methods for each appearance value.
-    virtual bool paintCheckbox(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintCheckbox(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void setCheckboxSize(RenderStyle*) const;
 
-    virtual bool paintRadio(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintRadio(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void setRadioSize(RenderStyle*) const;
 
     virtual void adjustButtonStyle(CSSStyleSelector*, RenderStyle*, WebCore::Element*) const;
-    virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void setButtonSize(RenderStyle*) const;
 
-    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustTextFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintTextArea(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextArea(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustTextAreaStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustMenuListStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustMenuListButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
-    virtual bool paintSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
 
-    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
 
     virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsButton(RenderObject*, const PaintInfo&, const IntRect&);
  
-    virtual bool paintCapsLockIndicator(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintCapsLockIndicator(RenderObject*, const PaintInfo&, const IntRect&);
 
 #if ENABLE(VIDEO)
-    virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekBackButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekForwardButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
 #endif
 
 private:
@@ -168,7 +168,7 @@ private:
     const IntSize* popupButtonSizes() const;
     const int* popupButtonMargins(NSControlSize) const;
     const int* popupButtonPadding(NSControlSize) const;
-    void paintMenuListButtonGradients(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    void paintMenuListButtonGradients(RenderObject*, const PaintInfo&, const IntRect&);
     const IntSize* menuListSizes() const;
 
     const IntSize* searchFieldSizes() const;
diff --git a/WebCore/rendering/RenderThemeWin.cpp b/WebCore/rendering/RenderThemeWin.cpp
index 52afbd6..38daf98 100644
--- a/WebCore/rendering/RenderThemeWin.cpp
+++ b/WebCore/rendering/RenderThemeWin.cpp
@@ -611,7 +611,7 @@ static void drawControl(GraphicsContext* context, RenderObject* o, HANDLE theme,
     context->releaseWindowsContext(hdc, r, alphaBlend);
 }
 
-bool RenderThemeWin::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWin::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {  
     drawControl(i.context,  o, buttonTheme(), getThemeData(o), r);
     return false;
@@ -633,13 +633,13 @@ void RenderThemeWin::setCheckboxSize(RenderStyle* style) const
         style->setHeight(Length(13, Fixed));
 }
 
-bool RenderThemeWin::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWin::paintTextField(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     drawControl(i.context,  o, textFieldTheme(), getThemeData(o), r);
     return false;
 }
 
-bool RenderThemeWin::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWin::paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     HANDLE theme;
     int part;
@@ -694,7 +694,7 @@ void RenderThemeWin::adjustMenuListButtonStyle(CSSStyleSelector* selector, Rende
     style->setWhiteSpace(PRE);
 }
 
-bool RenderThemeWin::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWin::paintMenuListButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     // FIXME: Don't make hardcoded assumptions about the thickness of the textfield border.
     int borderThickness = haveTheme ? 1 : 2;
@@ -721,7 +721,7 @@ bool RenderThemeWin::paintMenuListButton(RenderObject* o, const RenderObject::Pa
 
 const int trackWidth = 4;
 
-bool RenderThemeWin::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWin::paintSliderTrack(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     IntRect bounds = r;
     
@@ -737,7 +737,7 @@ bool RenderThemeWin::paintSliderTrack(RenderObject* o, const RenderObject::Paint
     return false;
 }
 
-bool RenderThemeWin::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWin::paintSliderThumb(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {   
     drawControl(i.context,  o, sliderTheme(), getThemeData(o), r);
     return false;
@@ -781,7 +781,7 @@ int RenderThemeWin::buttonInternalPaddingBottom() const
     return 1;
 }
 
-bool RenderThemeWin::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWin::paintSearchField(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintTextField(o, i, r);
 }
@@ -798,7 +798,7 @@ void RenderThemeWin::adjustSearchFieldStyle(CSSStyleSelector* selector, RenderSt
         style->setOutlineOffset(-2);
 }
 
-bool RenderThemeWin::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     IntRect bounds = r;
     ASSERT(o->parent());
@@ -849,7 +849,7 @@ void RenderThemeWin::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* s
     style->setHeight(Length(magnifierSize, Fixed));
 }
 
-bool RenderThemeWin::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintSearchFieldResultsDecoration(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     IntRect bounds = r;
     ASSERT(o->parent());
@@ -883,7 +883,7 @@ void RenderThemeWin::adjustSearchFieldResultsButtonStyle(CSSStyleSelector* selec
     style->setHeight(Length(magnifierHeight, Fixed));
 }
 
-bool RenderThemeWin::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintSearchFieldResultsButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     IntRect bounds = r;
     ASSERT(o->parent());
@@ -972,42 +972,42 @@ bool RenderThemeWin::shouldRenderMediaControlPart(ControlPart part, Element* ele
 }
 
 
-bool RenderThemeWin::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintMediaFullscreenButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaFullscreenButton, o, paintInfo, r);
 }
 
-bool RenderThemeWin::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintMediaMuteButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaMuteButton, o, paintInfo, r);
 }
 
-bool RenderThemeWin::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintMediaPlayButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaPlayButton, o, paintInfo, r);
 }
 
-bool RenderThemeWin::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintMediaSeekBackButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSeekBackButton, o, paintInfo, r);
 }
 
-bool RenderThemeWin::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintMediaSeekForwardButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSeekForwardButton, o, paintInfo, r);
 }
 
-bool RenderThemeWin::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintMediaSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSlider, o, paintInfo, r);
 }
 
-bool RenderThemeWin::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintMediaSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaSliderThumb, o, paintInfo, r);
 }
 
-bool RenderThemeWin::paintMediaToggleClosedCaptionsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWin::paintMediaToggleClosedCaptionsButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return RenderMediaControls::paintMediaControlsPart(MediaShowClosedCaptionsButton, o, paintInfo, r);
 }
diff --git a/WebCore/rendering/RenderThemeWin.h b/WebCore/rendering/RenderThemeWin.h
index a9fa5e6..2e80032 100644
--- a/WebCore/rendering/RenderThemeWin.h
+++ b/WebCore/rendering/RenderThemeWin.h
@@ -66,30 +66,30 @@ public:
     virtual void systemFont(int propId, FontDescription&) const;
     virtual Color systemColor(int cssValueId) const;
 
-    virtual bool paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+    virtual bool paintCheckbox(RenderObject* o, const PaintInfo& i, const IntRect& r)
     { return paintButton(o, i, r); }
     virtual void setCheckboxSize(RenderStyle*) const;
 
-    virtual bool paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+    virtual bool paintRadio(RenderObject* o, const PaintInfo& i, const IntRect& r)
     { return paintButton(o, i, r); }
     virtual void setRadioSize(RenderStyle* style) const
     { return setCheckboxSize(style); }
 
-    virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
 
-    virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
 
-    virtual bool paintTextArea(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+    virtual bool paintTextArea(RenderObject* o, const PaintInfo& i, const IntRect& r)
     { return paintTextField(o, i, r); }
 
     virtual void adjustMenuListStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const;
-    virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
     virtual void adjustMenuListButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const;
 
-    virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
 
-    virtual bool paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r);
-    virtual bool paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r);
+    virtual bool paintSliderTrack(RenderObject* o, const PaintInfo& i, const IntRect& r);
+    virtual bool paintSliderThumb(RenderObject* o, const PaintInfo& i, const IntRect& r);
     virtual void adjustSliderThumbSize(RenderObject*) const;
 
     virtual bool popupOptionSupportsTextIndent() const { return true; }
@@ -100,19 +100,19 @@ public:
     virtual int buttonInternalPaddingBottom() const;
 
     virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return false; }
+    virtual bool paintSearchFieldDecoration(RenderObject*, const PaintInfo&, const IntRect&) { return false; }
 
     virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-    virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintSearchFieldResultsButton(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual void themeChanged();
 
@@ -126,14 +126,14 @@ public:
 
 #if ENABLE(VIDEO)
     virtual bool shouldRenderMediaControlPart(ControlPart, Element*);
-    virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+    virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekBackButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSeekForwardButton(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
+    virtual bool paintMediaToggleClosedCaptionsButton(RenderObject*, const PaintInfo&, const IntRect&);
 #endif
 
 private:
diff --git a/WebCore/rendering/RenderThemeWince.cpp b/WebCore/rendering/RenderThemeWince.cpp
index c4aaaad..4fd6de9 100644
--- a/WebCore/rendering/RenderThemeWince.cpp
+++ b/WebCore/rendering/RenderThemeWince.cpp
@@ -188,7 +188,7 @@ ThemeData RenderThemeWince::getThemeData(RenderObject* o)
     return result;
 }
 
-bool RenderThemeWince::paintButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWince::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     // Get the correct theme data for a button
     ThemeData themeData = getThemeData(o);
@@ -223,7 +223,7 @@ void RenderThemeWince::setCheckboxSize(RenderStyle* style) const
         style->setHeight(Length(13, Fixed));
 }
 
-bool RenderThemeWince::paintTextField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWince::paintTextField(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     // Get the correct theme data for a textfield
     ThemeData themeData = getThemeData(o);
@@ -240,14 +240,14 @@ void RenderThemeWince::adjustMenuListStyle(CSSStyleSelector* selector, RenderSty
     adjustMenuListButtonStyle(selector, style, e);
 }
 
-bool RenderThemeWince::paintMenuList(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWince::paintMenuList(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     paintTextField(o, i, r);
     paintMenuListButton(o, i, r);
     return true;
 }
 
-bool RenderThemeWince::paintMenuListButton(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWince::paintMenuListButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     IntRect buttonRect(r.right() - dropDownButtonWidth - 1, r.y(), dropDownButtonWidth, r.height());
     buttonRect.inflateY(-1);
@@ -362,12 +362,12 @@ void RenderThemeWince::adjustSearchFieldStyle(CSSStyleSelector* selector, Render
 }
 #endif
 
-bool RenderThemeWince::paintSearchField(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWince::paintSearchField(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     return paintTextField(o, i, r);
 }
 
-bool RenderThemeWince::paintSearchFieldCancelButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWince::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     Color buttonColor = (o->node() && o->node()->active()) ? Color(138, 138, 138) : Color(186, 186, 186);
 
@@ -412,7 +412,7 @@ void RenderThemeWince::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*
     style->setHeight(Length(magnifierSize.height(), Fixed));
 }
 
-bool RenderThemeWince::paintSearchFieldResultsDecoration(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWince::paintSearchFieldResultsDecoration(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     notImplemented();
     return false;
@@ -425,7 +425,7 @@ void RenderThemeWince::adjustSearchFieldResultsButtonStyle(CSSStyleSelector* sel
     style->setHeight(Length(magnifierSize.height(), Fixed));
 }
 
-bool RenderThemeWince::paintSearchFieldResultsButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWince::paintSearchFieldResultsButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     paintSearchFieldResultsDecoration(o, paintInfo, r);
     return false;
@@ -485,7 +485,7 @@ static HTMLMediaElement* mediaElementParent(Node* node)
 }
 #endif
 
-bool RenderThemeWince::paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWince::paintSliderTrack(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     bool rc = RenderTheme::paintSliderTrack(o, i, r);
     IntPoint left = IntPoint(r.x() + 2, (r.y() + r.bottom()) / 2);
@@ -508,7 +508,7 @@ bool RenderThemeWince::paintSliderTrack(RenderObject* o, const RenderObject::Pai
     return rc;
 }
 
-bool RenderThemeWince::paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+bool RenderThemeWince::paintSliderThumb(RenderObject* o, const PaintInfo& i, const IntRect& r)
 {
     bool rc = RenderTheme::paintSliderThumb(o, i, r);
     i.context->save();
@@ -559,7 +559,7 @@ void RenderThemeWince::adjustSearchFieldStyle(CSSStyleSelector* selector, Render
 
 #if ENABLE(VIDEO)
 
-bool RenderThemeWince::paintMediaFullscreenButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWince::paintMediaFullscreenButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     bool rc = paintButton(o, paintInfo, r);
     FloatRect imRect = r;
@@ -572,7 +572,7 @@ bool RenderThemeWince::paintMediaFullscreenButton(RenderObject* o, const RenderO
     return rc;
 }
 
-bool RenderThemeWince::paintMediaMuteButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWince::paintMediaMuteButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     bool rc = paintButton(o, paintInfo, r);
     HTMLMediaElement* mediaElement = mediaElementParent(o->node());
@@ -597,7 +597,7 @@ bool RenderThemeWince::paintMediaMuteButton(RenderObject* o, const RenderObject:
     return rc;
 }
 
-bool RenderThemeWince::paintMediaPlayButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWince::paintMediaPlayButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     bool rc = paintButton(o, paintInfo, r);
     FloatRect imRect = r;
@@ -621,7 +621,7 @@ bool RenderThemeWince::paintMediaPlayButton(RenderObject* o, const RenderObject:
     return rc;
 }
 
-bool RenderThemeWince::paintMediaSeekBackButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWince::paintMediaSeekBackButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     bool rc = paintButton(o, paintInfo, r);
     FloatRect imRect = r;
@@ -637,7 +637,7 @@ bool RenderThemeWince::paintMediaSeekBackButton(RenderObject* o, const RenderObj
     return rc;
 }
 
-bool RenderThemeWince::paintMediaSeekForwardButton(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWince::paintMediaSeekForwardButton(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     bool rc = paintButton(o, paintInfo, r);
     FloatRect imRect = r;
@@ -653,12 +653,12 @@ bool RenderThemeWince::paintMediaSeekForwardButton(RenderObject* o, const Render
     return rc;
 }
 
-bool RenderThemeWince::paintMediaSliderTrack(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWince::paintMediaSliderTrack(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return paintSliderTrack(o, paintInfo, r);
 }
 
-bool RenderThemeWince::paintMediaSliderThumb(RenderObject* o, const RenderObject::PaintInfo& paintInfo, const IntRect& r)
+bool RenderThemeWince::paintMediaSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     return paintSliderThumb(o, paintInfo, r);
 }
diff --git a/WebCore/rendering/RenderThemeWince.h b/WebCore/rendering/RenderThemeWince.h
index a2d04e1..61a4ac5 100644
--- a/WebCore/rendering/RenderThemeWince.h
+++ b/WebCore/rendering/RenderThemeWince.h
@@ -65,30 +65,30 @@ namespace WebCore {
         virtual void systemFont(int propId, FontDescription&) const;
         virtual Color systemColor(int cssValueId) const;
 
-        virtual bool paintCheckbox(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+        virtual bool paintCheckbox(RenderObject* o, const PaintInfo& i, const IntRect& r)
         { return paintButton(o, i, r); }
         virtual void setCheckboxSize(RenderStyle*) const;
 
-        virtual bool paintRadio(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+        virtual bool paintRadio(RenderObject* o, const PaintInfo& i, const IntRect& r)
         { return paintButton(o, i, r); }
         virtual void setRadioSize(RenderStyle* style) const
         { return setCheckboxSize(style); }
 
-        virtual bool paintButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
 
-        virtual bool paintTextField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
 
-        virtual bool paintTextArea(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r)
+        virtual bool paintTextArea(RenderObject* o, const PaintInfo& i, const IntRect& r)
         { return paintTextField(o, i, r); }
 
         virtual void adjustMenuListStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const;
-        virtual bool paintMenuList(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMenuList(RenderObject*, const PaintInfo&, const IntRect&);
         virtual void adjustMenuListButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const;
 
-        virtual bool paintMenuListButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMenuListButton(RenderObject*, const PaintInfo&, const IntRect&);
 
-        virtual bool paintSliderTrack(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r);
-        virtual bool paintSliderThumb(RenderObject* o, const RenderObject::PaintInfo& i, const IntRect& r);
+        virtual bool paintSliderTrack(RenderObject* o, const PaintInfo& i, const IntRect& r);
+        virtual bool paintSliderThumb(RenderObject* o, const PaintInfo& i, const IntRect& r);
         virtual void adjustSliderThumbSize(RenderObject*) const;
 
         virtual bool popupOptionSupportsTextIndent() const { return true; }
@@ -99,19 +99,19 @@ namespace WebCore {
         virtual int buttonInternalPaddingBottom() const;
 
         virtual void adjustSearchFieldStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchField(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSearchField(RenderObject*, const PaintInfo&, const IntRect&);
 
         virtual void adjustSearchFieldCancelButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldCancelButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSearchFieldCancelButton(RenderObject*, const PaintInfo&, const IntRect&);
 
         virtual void adjustSearchFieldDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&) { return false; }
+        virtual bool paintSearchFieldDecoration(RenderObject*, const PaintInfo&, const IntRect&) { return false; }
 
         virtual void adjustSearchFieldResultsDecorationStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSearchFieldResultsDecoration(RenderObject*, const PaintInfo&, const IntRect&);
 
         virtual void adjustSearchFieldResultsButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
-        virtual bool paintSearchFieldResultsButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintSearchFieldResultsButton(RenderObject*, const PaintInfo&, const IntRect&);
 
         virtual void themeChanged();
 
@@ -124,13 +124,13 @@ namespace WebCore {
         virtual bool supportsFocusRing(const RenderStyle*) const;
 
     #if ENABLE(VIDEO)
-        virtual bool paintMediaFullscreenButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaPlayButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaMuteButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSeekBackButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSeekForwardButton(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSliderTrack(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
-        virtual bool paintMediaSliderThumb(RenderObject*, const RenderObject::PaintInfo&, const IntRect&);
+        virtual bool paintMediaFullscreenButton(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaPlayButton(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaMuteButton(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaSeekBackButton(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaSeekForwardButton(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaSliderTrack(RenderObject*, const PaintInfo&, const IntRect&);
+        virtual bool paintMediaSliderThumb(RenderObject*, const PaintInfo&, const IntRect&);
     #endif
 
     private:
diff --git a/WebCore/rendering/RenderWidget.cpp b/WebCore/rendering/RenderWidget.cpp
index 2556bbb..bba14e2 100644
--- a/WebCore/rendering/RenderWidget.cpp
+++ b/WebCore/rendering/RenderWidget.cpp
@@ -27,6 +27,7 @@
 #include "AnimationController.h"
 #include "GraphicsContext.h"
 #include "HitTestResult.h"
+#include "RenderCounter.h"
 #include "RenderLayer.h"
 #include "RenderView.h"
 #include "RenderWidgetProtector.h"
@@ -115,6 +116,9 @@ void RenderWidget::destroy()
     if (RenderView* v = view())
         v->removeWidget(this);
 
+    if (m_hasCounterNodeMap)
+        RenderCounter::destroyCounterNodes(this);
+    
     if (AXObjectCache::accessibilityEnabled()) {
         document()->axObjectCache()->childrenChanged(this->parent());
         document()->axObjectCache()->remove(this);
diff --git a/WebCore/rendering/RootInlineBox.cpp b/WebCore/rendering/RootInlineBox.cpp
index 3a8a4f5..bec288c 100644
--- a/WebCore/rendering/RootInlineBox.cpp
+++ b/WebCore/rendering/RootInlineBox.cpp
@@ -115,9 +115,9 @@ int RootInlineBox::placeEllipsisBox(bool ltr, int blockLeftEdge, int blockRightE
     return result;
 }
 
-void RootInlineBox::paintEllipsisBox(RenderObject::PaintInfo& paintInfo, int tx, int ty) const
+void RootInlineBox::paintEllipsisBox(PaintInfo& paintInfo, int tx, int ty) const
 {
-    if (hasEllipsisBox() && renderer()->shouldPaintWithinRoot(paintInfo) && renderer()->style()->visibility() == VISIBLE
+    if (hasEllipsisBox() && paintInfo.shouldPaintWithinRoot(renderer()) && renderer()->style()->visibility() == VISIBLE
             && paintInfo.phase == PaintPhaseForeground)
         ellipsisBox()->paint(paintInfo, tx, ty);
 }
@@ -140,9 +140,9 @@ void RootInlineBox::addHighlightOverflow()
     setVerticalOverflowPositions(topLayoutOverflow(), bottomLayoutOverflow(), min(topVisualOverflow(), inflatedRect.y()), max(bottomVisualOverflow(), inflatedRect.bottom()), height());
 }
 
-void RootInlineBox::paintCustomHighlight(RenderObject::PaintInfo& paintInfo, int tx, int ty, const AtomicString& highlightType)
+void RootInlineBox::paintCustomHighlight(PaintInfo& paintInfo, int tx, int ty, const AtomicString& highlightType)
 {
-    if (!renderer()->shouldPaintWithinRoot(paintInfo) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseForeground)
+    if (!paintInfo.shouldPaintWithinRoot(renderer()) || renderer()->style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseForeground)
         return;
 
     Frame* frame = renderer()->frame();
@@ -161,7 +161,7 @@ void RootInlineBox::paintCustomHighlight(RenderObject::PaintInfo& paintInfo, int
 
 #endif
 
-void RootInlineBox::paint(RenderObject::PaintInfo& paintInfo, int tx, int ty)
+void RootInlineBox::paint(PaintInfo& paintInfo, int tx, int ty)
 {
     InlineFlowBox::paint(paintInfo, tx, ty);
     paintEllipsisBox(paintInfo, tx, ty);
@@ -240,7 +240,7 @@ int RootInlineBox::verticallyAlignBoxes(int heightOfBlock, GlyphOverflowAndFallb
 }
 
 GapRects RootInlineBox::fillLineSelectionGap(int selTop, int selHeight, RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,
-                                             const RenderObject::PaintInfo* paintInfo)
+                                             const PaintInfo* paintInfo)
 {
     RenderObject::SelectionState lineState = selectionState();
 
diff --git a/WebCore/rendering/RootInlineBox.h b/WebCore/rendering/RootInlineBox.h
index fa2510a..86f633d 100644
--- a/WebCore/rendering/RootInlineBox.h
+++ b/WebCore/rendering/RootInlineBox.h
@@ -87,17 +87,17 @@ public:
 
     EllipsisBox* ellipsisBox() const;
 
-    void paintEllipsisBox(RenderObject::PaintInfo&, int tx, int ty) const;
+    void paintEllipsisBox(PaintInfo&, int tx, int ty) const;
     bool hitTestEllipsisBox(HitTestResult&, int x, int y, int tx, int ty, HitTestAction, bool);
 
     virtual void clearTruncation();
 
 #if PLATFORM(MAC)
     void addHighlightOverflow();
-    void paintCustomHighlight(RenderObject::PaintInfo&, int tx, int ty, const AtomicString& highlightType);
+    void paintCustomHighlight(PaintInfo&, int tx, int ty, const AtomicString& highlightType);
 #endif
 
-    virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int, int, int);
 
     bool hasSelectedChildren() const { return m_hasSelectedChildren; }
@@ -108,7 +108,7 @@ public:
     InlineBox* lastSelectedBox();
 
     GapRects fillLineSelectionGap(int selTop, int selHeight, RenderBlock* rootBlock, int blockX, int blockY,
-                                  int tx, int ty, const RenderObject::PaintInfo*);
+                                  int tx, int ty, const PaintInfo*);
 
     RenderBlock* block() const;
 
diff --git a/WebCore/rendering/SVGInlineFlowBox.cpp b/WebCore/rendering/SVGInlineFlowBox.cpp
index 1cd938a..4008938 100644
--- a/WebCore/rendering/SVGInlineFlowBox.cpp
+++ b/WebCore/rendering/SVGInlineFlowBox.cpp
@@ -30,7 +30,7 @@
 
 namespace WebCore {
 
-void SVGInlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int, int)
+void SVGInlineFlowBox::paint(PaintInfo& paintInfo, int, int)
 {
     ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
     ASSERT(!paintInfo.context->paintingDisabled());
@@ -38,18 +38,15 @@ void SVGInlineFlowBox::paint(RenderObject::PaintInfo& paintInfo, int, int)
     RenderObject* boxRenderer = renderer();
     ASSERT(boxRenderer);
 
-    RenderObject::PaintInfo childPaintInfo(paintInfo);
+    PaintInfo childPaintInfo(paintInfo);
     childPaintInfo.context->save();
 
-    RenderSVGResourceFilter* filter = 0;
-    FloatRect repaintRect = boxRenderer->repaintRectInLocalCoordinates();
-
-    if (SVGRenderBase::prepareToRenderSVGContent(boxRenderer, childPaintInfo, repaintRect, filter)) {
+    if (SVGRenderSupport::prepareToRenderSVGContent(boxRenderer, childPaintInfo)) {
         for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
             child->paint(childPaintInfo, 0, 0);
     }
 
-    SVGRenderBase::finishRenderSVGContent(boxRenderer, childPaintInfo, filter, paintInfo.context);
+    SVGRenderSupport::finishRenderSVGContent(boxRenderer, childPaintInfo, paintInfo.context);
     childPaintInfo.context->restore();
 }
 
diff --git a/WebCore/rendering/SVGInlineFlowBox.h b/WebCore/rendering/SVGInlineFlowBox.h
index ba4c5b2..ab26297 100644
--- a/WebCore/rendering/SVGInlineFlowBox.h
+++ b/WebCore/rendering/SVGInlineFlowBox.h
@@ -40,7 +40,7 @@ public:
     virtual int virtualHeight() const { return m_height; }
     void setHeight(int h) { m_height = h; }
 
-    virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty);
 
     virtual IntRect calculateBoundaries() const;
     void layoutFlowBox();
diff --git a/WebCore/rendering/SVGInlineTextBox.cpp b/WebCore/rendering/SVGInlineTextBox.cpp
index 68b4fd0..8e498ad 100644
--- a/WebCore/rendering/SVGInlineTextBox.cpp
+++ b/WebCore/rendering/SVGInlineTextBox.cpp
@@ -124,8 +124,9 @@ int SVGInlineTextBox::offsetForPosition(int xCoordinate, bool includePartialGlyp
     m_currentChunkPart = SVGTextChunkPart();
 
     // Eventually handle lengthAdjust="spacingAndGlyphs".
+    // FIXME: Need to revisit the whole offsetForPosition concept for vertical text selection.
     if (!m_chunkTransformation.isIdentity())
-        textRun.setGlyphScale(narrowPrecisionToFloat(isVerticalWritingMode(style->svgStyle()) ? m_chunkTransformation.d() : m_chunkTransformation.a()));
+        textRun.setHorizontalGlyphStretch(narrowPrecisionToFloat(m_chunkTransformation.a()));
 
     return hitPart.offset + style->font().offsetForPosition(textRun, x, includePartialGlyphs);
 }
@@ -189,9 +190,9 @@ IntRect SVGInlineTextBox::selectionRect(int, int, int startPos, int endPos)
     return enclosingIntRect(m_chunkTransformation.mapRect(selectionRect));
 }
 
-void SVGInlineTextBox::paint(RenderObject::PaintInfo& paintInfo, int, int)
+void SVGInlineTextBox::paint(PaintInfo& paintInfo, int, int)
 {
-    ASSERT(renderer()->shouldPaintWithinRoot(paintInfo));
+    ASSERT(paintInfo.shouldPaintWithinRoot(renderer()));
     ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
     ASSERT(truncation() == cNoTruncation);
 
@@ -562,6 +563,35 @@ void SVGInlineTextBox::paintSelection(GraphicsContext* context, const FloatPoint
     context->restore();
 }
 
+void SVGInlineTextBox::paintTextWithShadows(GraphicsContext* context, const FloatPoint& textOrigin, RenderStyle* style, TextRun& textRun, int startPos, int endPos)
+{
+    const Font& font = style->font();
+    const ShadowData* shadow = style->textShadow();
+
+    FloatRect shadowRect(FloatPoint(textOrigin.x(), textOrigin.y() - font.ascent()), FloatSize(m_currentChunkPart.width, m_currentChunkPart.height));
+    do {
+        if (!prepareGraphicsContextForTextPainting(context, textRun, style))
+            break;
+
+        FloatSize extraOffset;
+        if (shadow)
+            extraOffset = applyShadowToGraphicsContext(context, shadow, shadowRect, false /* stroked */, true /* opaque */);
+
+        font.drawText(context, textRun, textOrigin + extraOffset, startPos, endPos);
+        restoreGraphicsContextAfterTextPainting(context, textRun);
+
+        if (!shadow)
+            break;
+
+        if (shadow->next())
+            context->restore();
+        else
+            context->clearShadow();
+
+        shadow = shadow->next();
+    } while (shadow);
+}
+
 void SVGInlineTextBox::paintText(GraphicsContext* context, const FloatPoint& textOrigin, RenderStyle* style, RenderStyle* selectionStyle, bool hasSelection, bool paintSelectedTextOnly)
 {
     ASSERT(style);
@@ -572,41 +602,24 @@ void SVGInlineTextBox::paintText(GraphicsContext* context, const FloatPoint& tex
     int endPos = 0;
     selectionStartEnd(startPos, endPos);
 
-    const Font& font = style->font();
-    TextRun textRun(constructTextRun(style));
-
     // Fast path if there is no selection, just draw the whole chunk part using the regular style
+    TextRun textRun(constructTextRun(style));
     if (!hasSelection || startPos >= endPos) {
-        if (prepareGraphicsContextForTextPainting(context, textRun, style)) {
-            font.drawText(context, textRun, textOrigin, 0, m_currentChunkPart.length);
-            restoreGraphicsContextAfterTextPainting(context, textRun);
-        }
-
+        paintTextWithShadows(context, textOrigin, style, textRun, 0, m_currentChunkPart.length);
         return;
     }
 
     // Eventually draw text using regular style until the start position of the selection
-    if (startPos > 0 && !paintSelectedTextOnly) {
-        if (prepareGraphicsContextForTextPainting(context, textRun, style)) {
-            font.drawText(context, textRun, textOrigin, 0, startPos);
-            restoreGraphicsContextAfterTextPainting(context, textRun);
-        }
-    }
+    if (startPos > 0 && !paintSelectedTextOnly)
+        paintTextWithShadows(context, textOrigin, style, textRun, 0, startPos);
 
     // Draw text using selection style from the start to the end position of the selection
     TextRun selectionTextRun(constructTextRun(selectionStyle));
-    if (prepareGraphicsContextForTextPainting(context, selectionTextRun, selectionStyle)) {
-        selectionStyle->font().drawText(context, selectionTextRun, textOrigin, startPos, endPos);
-        restoreGraphicsContextAfterTextPainting(context, selectionTextRun);
-    }
+    paintTextWithShadows(context, textOrigin, selectionStyle, textRun, startPos, endPos);
 
     // Eventually draw text using regular style from the end position of the selection to the end of the current chunk part
-    if (endPos < m_currentChunkPart.length && !paintSelectedTextOnly) {
-        if (prepareGraphicsContextForTextPainting(context, textRun, style)) {
-            font.drawText(context, textRun, textOrigin, endPos, m_currentChunkPart.length);
-            restoreGraphicsContextAfterTextPainting(context, textRun);
-        }
-    }
+    if (endPos < m_currentChunkPart.length && !paintSelectedTextOnly)
+        paintTextWithShadows(context, textOrigin, style, textRun, endPos, m_currentChunkPart.length);
 }
 
 void SVGInlineTextBox::buildLayoutInformation(SVGCharacterLayoutInfo& info, SVGLastGlyphInfo& lastGlyph)
diff --git a/WebCore/rendering/SVGInlineTextBox.h b/WebCore/rendering/SVGInlineTextBox.h
index 704b1f5..602fff1 100644
--- a/WebCore/rendering/SVGInlineTextBox.h
+++ b/WebCore/rendering/SVGInlineTextBox.h
@@ -50,7 +50,7 @@ public:
     virtual int offsetForPosition(int x, bool includePartialGlyphs = true) const;
     virtual int positionForOffset(int offset) const;
 
-    virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty);
     virtual IntRect selectionRect(int absx, int absy, int startPos, int endPos);
 
     virtual void selectionStartEnd(int& startPos, int& endPos);
@@ -86,6 +86,7 @@ private:
     void paintDecorationWithStyle(GraphicsContext*, const FloatPoint& textOrigin, RenderStyle*, ETextDecoration);
     void paintSelection(GraphicsContext*, const FloatPoint& textOrigin, RenderStyle*);
     void paintText(GraphicsContext*, const FloatPoint& textOrigin, RenderStyle*, RenderStyle* selectionStyle, bool hasSelection, bool paintSelectedTextOnly);
+    void paintTextWithShadows(GraphicsContext*, const FloatPoint& textOrigin, RenderStyle*, TextRun&, int startPos, int endPos);
 
     FloatRect selectionRectForTextChunkPart(const SVGTextChunkPart&, int partStartPos, int partEndPos, RenderStyle*);
 
diff --git a/WebCore/rendering/SVGMarkerLayoutInfo.cpp b/WebCore/rendering/SVGMarkerLayoutInfo.cpp
index b771cf8..aed756a 100644
--- a/WebCore/rendering/SVGMarkerLayoutInfo.cpp
+++ b/WebCore/rendering/SVGMarkerLayoutInfo.cpp
@@ -98,7 +98,7 @@ FloatRect SVGMarkerLayoutInfo::calculateBoundaries(RenderSVGResourceMarker* star
     return bounds;
 }
 
-void SVGMarkerLayoutInfo::drawMarkers(RenderObject::PaintInfo& paintInfo)
+void SVGMarkerLayoutInfo::drawMarkers(PaintInfo& paintInfo)
 {
     if (m_layout.isEmpty())
         return;
diff --git a/WebCore/rendering/SVGMarkerLayoutInfo.h b/WebCore/rendering/SVGMarkerLayoutInfo.h
index 6011a2d..8f59703 100644
--- a/WebCore/rendering/SVGMarkerLayoutInfo.h
+++ b/WebCore/rendering/SVGMarkerLayoutInfo.h
@@ -48,7 +48,7 @@ public:
     ~SVGMarkerLayoutInfo();
 
     FloatRect calculateBoundaries(RenderSVGResourceMarker* startMarker, RenderSVGResourceMarker* midMarker, RenderSVGResourceMarker* endMarker, float strokeWidth, const Path&);
-    void drawMarkers(RenderObject::PaintInfo&);
+    void drawMarkers(PaintInfo&);
 
     // Used by static inline helper functions in SVGMarkerLayoutInfo.cpp
     SVGMarkerData& markerData() { return m_markerData; }
diff --git a/WebCore/rendering/SVGRenderSupport.cpp b/WebCore/rendering/SVGRenderSupport.cpp
index 7a426f2..a328031 100644
--- a/WebCore/rendering/SVGRenderSupport.cpp
+++ b/WebCore/rendering/SVGRenderSupport.cpp
@@ -28,31 +28,23 @@
 #if ENABLE(SVG)
 #include "SVGRenderSupport.h"
 
-#include "AffineTransform.h"
-#include "Document.h"
+#include "FrameView.h"
 #include "ImageBuffer.h"
 #include "NodeRenderStyle.h"
 #include "RenderLayer.h"
-#include "RenderObject.h"
 #include "RenderSVGContainer.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGResourceClipper.h"
 #include "RenderSVGResourceFilter.h"
 #include "RenderSVGResourceMarker.h"
 #include "RenderSVGResourceMasker.h"
-#include "RenderView.h"
 #include "SVGStyledElement.h"
-#include "SVGURIReference.h"
 #include "TransformState.h"
 #include <wtf/UnusedParam.h>
 
 namespace WebCore {
 
-SVGRenderBase::~SVGRenderBase()
-{
-}
-
-IntRect SVGRenderBase::clippedOverflowRectForRepaint(RenderObject* object, RenderBoxModelObject* repaintContainer)
+IntRect SVGRenderSupport::clippedOverflowRectForRepaint(RenderObject* object, RenderBoxModelObject* repaintContainer)
 {
     // Return early for any cases where we don't actually paint
     if (object->style()->visibility() != VISIBLE && !object->enclosingLayer()->hasVisibleContent())
@@ -65,7 +57,7 @@ IntRect SVGRenderBase::clippedOverflowRectForRepaint(RenderObject* object, Rende
     return repaintRect;
 }
 
-void SVGRenderBase::computeRectForRepaint(RenderObject* object, RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
+void SVGRenderSupport::computeRectForRepaint(RenderObject* object, RenderBoxModelObject* repaintContainer, IntRect& repaintRect, bool fixed)
 {
     object->style()->svgStyle()->inflateForShadow(repaintRect);
 
@@ -74,7 +66,7 @@ void SVGRenderBase::computeRectForRepaint(RenderObject* object, RenderBoxModelOb
     object->parent()->computeRectForRepaint(repaintContainer, repaintRect, fixed);
 }
 
-void SVGRenderBase::mapLocalToContainer(const RenderObject* object, RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState)
+void SVGRenderSupport::mapLocalToContainer(const RenderObject* object, RenderBoxModelObject* repaintContainer, bool fixed , bool useTransforms, TransformState& transformState)
 {
     ASSERT(!fixed); // We should have no fixed content in the SVG rendering tree.
     ASSERT(useTransforms); // Mapping a point through SVG w/o respecting transforms is useless.
@@ -82,12 +74,8 @@ void SVGRenderBase::mapLocalToContainer(const RenderObject* object, RenderBoxMod
     object->parent()->mapLocalToContainer(repaintContainer, fixed, useTransforms, transformState);
 }
 
-bool SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, const FloatRect& repaintRect, RenderSVGResourceFilter*& filter)
+bool SVGRenderSupport::prepareToRenderSVGContent(RenderObject* object, PaintInfo& paintInfo)
 {
-#if !ENABLE(FILTERS)
-    UNUSED_PARAM(filter);
-#endif
-
     ASSERT(object);
     SVGElement* svgElement = static_cast<SVGElement*>(object->node());
     ASSERT(svgElement && svgElement->document() && svgElement->isStyled());
@@ -99,17 +87,24 @@ bool SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject
     const SVGRenderStyle* svgStyle = style->svgStyle();
     ASSERT(svgStyle);
 
+    FloatRect repaintRect;
+
     // Setup transparency layers before setting up SVG resources!
-    float opacity = style->opacity(); 
-    if (opacity < 1.0f) {
+    float opacity = style->opacity();
+    if (opacity < 1) {
+        repaintRect = object->repaintRectInLocalCoordinates();
         paintInfo.context->clip(repaintRect);
         paintInfo.context->beginTransparencyLayer(opacity);
     }
 
     if (const ShadowData* shadow = svgStyle->shadow()) {
+        // Eventually compute repaint rect, if not done so far.
+        if (opacity >= 1)
+            repaintRect = object->repaintRectInLocalCoordinates();
+
         paintInfo.context->clip(repaintRect);
         paintInfo.context->setShadow(IntSize(shadow->x(), shadow->y()), shadow->blur(), shadow->color(), style->colorSpace());
-        paintInfo.context->beginTransparencyLayer(1.0f);
+        paintInfo.context->beginTransparencyLayer(1);
     }
 
     Document* document = object->document();
@@ -120,7 +115,7 @@ bool SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject
             if (!masker->applyResource(object, style, paintInfo.context, ApplyToDefaultMode))
                 return false;
         } else
-            svgElement->document()->accessSVGExtensions()->addPendingResource(maskerId, styledElement);
+            document->accessSVGExtensions()->addPendingResource(maskerId, styledElement);
     }
 
     if (svgStyle->hasClipper()) {
@@ -128,28 +123,26 @@ bool SVGRenderBase::prepareToRenderSVGContent(RenderObject* object, RenderObject
         if (RenderSVGResourceClipper* clipper = getRenderSVGResourceById<RenderSVGResourceClipper>(document, clipperId))
             clipper->applyResource(object, style, paintInfo.context, ApplyToDefaultMode);
         else
-            svgElement->document()->accessSVGExtensions()->addPendingResource(clipperId, styledElement);
+            document->accessSVGExtensions()->addPendingResource(clipperId, styledElement);
     }
 
 #if ENABLE(FILTERS)
     if (svgStyle->hasFilter()) {
         AtomicString filterId(svgStyle->filterResource());
-        filter = getRenderSVGResourceById<RenderSVGResourceFilter>(document, filterId);
-        if (filter) {
+        if (RenderSVGResourceFilter* filter = getRenderSVGResourceById<RenderSVGResourceFilter>(document, filterId)) { 
             if (!filter->applyResource(object, style, paintInfo.context, ApplyToDefaultMode))
                 return false;
         } else
-            svgElement->document()->accessSVGExtensions()->addPendingResource(filterId, styledElement);
+            document->accessSVGExtensions()->addPendingResource(filterId, styledElement);
     }
 #endif
 
     return true;
 }
 
-void SVGRenderBase::finishRenderSVGContent(RenderObject* object, RenderObject::PaintInfo& paintInfo, RenderSVGResourceFilter*& filter, GraphicsContext* savedContext)
+void SVGRenderSupport::finishRenderSVGContent(RenderObject* object, PaintInfo& paintInfo, GraphicsContext* savedContext)
 {
 #if !ENABLE(FILTERS)
-    UNUSED_PARAM(filter);
     UNUSED_PARAM(savedContext);
 #endif
 
@@ -158,24 +151,30 @@ void SVGRenderBase::finishRenderSVGContent(RenderObject* object, RenderObject::P
     const RenderStyle* style = object->style();
     ASSERT(style);
 
+    const SVGRenderStyle* svgStyle = style->svgStyle();
+    ASSERT(svgStyle);
+
 #if ENABLE(FILTERS)
-    if (filter) {
-        filter->postApplyResource(object, paintInfo.context, ApplyToDefaultMode);
-        paintInfo.context = savedContext;
+    if (svgStyle->hasFilter()) {
+        AtomicString filterId(svgStyle->filterResource());
+        if (RenderSVGResourceFilter* filter = getRenderSVGResourceById<RenderSVGResourceFilter>(object->document(), filterId)) { 
+            filter->postApplyResource(object, paintInfo.context, ApplyToDefaultMode);
+            paintInfo.context = savedContext;
+        }
     }
 #endif
 
     float opacity = style->opacity();    
-    if (opacity < 1.0f)
+    if (opacity < 1)
         paintInfo.context->endTransparencyLayer();
 
     // This needs to be done separately from opacity, because if both properties are set,
     // then the transparency layers are nested. 
-    if (style->svgStyle()->shadow())
+    if (svgStyle->shadow())
         paintInfo.context->endTransparencyLayer();
 }
 
-void renderSubtreeToImage(ImageBuffer* image, RenderObject* item)
+void SVGRenderSupport::renderSubtreeToImage(ImageBuffer* image, RenderObject* item)
 {
     ASSERT(item);
     ASSERT(image);
@@ -187,7 +186,7 @@ void renderSubtreeToImage(ImageBuffer* image, RenderObject* item)
     FrameView* frameView = item->document()->view();
     if (frameView)
         rect = IntRect(0, 0, frameView->visibleWidth(), frameView->visibleHeight());
-    RenderObject::PaintInfo info(image->context(), rect, PaintPhaseForeground, 0, 0, 0);
+    PaintInfo info(image->context(), rect, PaintPhaseForeground, 0, 0, 0);
 
     // FIXME: isSVGContainer returns true for RenderSVGViewportContainer, so if this is ever
     // called with one of those, we will read from the wrong offset in an object due to a bad cast.
@@ -206,36 +205,32 @@ void renderSubtreeToImage(ImageBuffer* image, RenderObject* item)
         svgContainer->setDrawsContents(false);
 }
 
-void clampImageBufferSizeToViewport(FrameView* frameView, IntSize& size)
-{
-    if (!frameView)
-        return;
-
-    int viewWidth = frameView->visibleWidth();
-    int viewHeight = frameView->visibleHeight();
-
-    if (size.width() > viewWidth)
-        size.setWidth(viewWidth);
-
-    if (size.height() > viewHeight)
-        size.setHeight(viewHeight);
-}
-
-FloatRect SVGRenderBase::computeContainerBoundingBox(const RenderObject* container, bool includeAllPaintedContent)
+FloatRect SVGRenderSupport::computeContainerBoundingBox(const RenderObject* container, ContainerBoundingBoxMode mode)
 {
     FloatRect boundingBox;
 
-    RenderObject* current = container->firstChild();
-    for (; current != 0; current = current->nextSibling()) {
-        FloatRect childBBox = includeAllPaintedContent ? current->repaintRectInLocalCoordinates() : current->objectBoundingBox();
-        FloatRect childBBoxInLocalCoords = current->localToParentTransform().mapRect(childBBox);
-        boundingBox.unite(childBBoxInLocalCoords);
+    for (RenderObject* current = container->firstChild(); current; current = current->nextSibling()) {
+        FloatRect childBoundingBox;
+
+        switch (mode) {
+        case ObjectBoundingBox:
+            childBoundingBox = current->objectBoundingBox();
+            break;
+        case StrokeBoundingBox:
+            childBoundingBox = current->strokeBoundingBox();
+            break;
+        case RepaintBoundingBox:
+            childBoundingBox = current->repaintRectInLocalCoordinates();
+            break;
+        }
+
+        boundingBox.unite(current->localToParentTransform().mapRect(childBoundingBox));
     }
 
     return boundingBox;
 }
 
-void SVGRenderBase::layoutChildren(RenderObject* start, bool selfNeedsLayout)
+void SVGRenderSupport::layoutChildren(RenderObject* start, bool selfNeedsLayout)
 {
     for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) {
         // Only force our kids to layout if we're being asked to relayout as a result of a parent changing
@@ -246,7 +241,7 @@ void SVGRenderBase::layoutChildren(RenderObject* start, bool selfNeedsLayout)
         if (!needsLayout) {
             if (SVGElement* element = child->node()->isSVGElement() ? static_cast<SVGElement*>(child->node()) : 0) {
                 if (element->isStyled())
-                    needsLayout = static_cast<SVGStyledElement*>(element)->hasRelativeValues();
+                    needsLayout = static_cast<SVGStyledElement*>(element)->hasRelativeLengths();
             }
         }
 
@@ -258,7 +253,7 @@ void SVGRenderBase::layoutChildren(RenderObject* start, bool selfNeedsLayout)
     }
 }
 
-bool SVGRenderBase::isOverflowHidden(const RenderObject* object)
+bool SVGRenderSupport::isOverflowHidden(const RenderObject* object)
 {
     // SVG doesn't support independent x/y overflow
     ASSERT(object->style()->overflowX() == object->style()->overflowY());
@@ -272,7 +267,7 @@ bool SVGRenderBase::isOverflowHidden(const RenderObject* object)
     return object->style()->overflowX() == OHIDDEN;
 }
 
-void SVGRenderBase::intersectRepaintRectWithResources(const RenderObject* object, FloatRect& repaintRect) const
+void SVGRenderSupport::intersectRepaintRectWithResources(const RenderObject* object, FloatRect& repaintRect)
 {
     ASSERT(object);
     ASSERT(object->style());
@@ -301,20 +296,7 @@ void SVGRenderBase::intersectRepaintRectWithResources(const RenderObject* object
     svgStyle->inflateForShadow(repaintRect);
 }
 
-static inline void invalidatePaintingResource(SVGPaint* paint, RenderObject* object)
-{
-    ASSERT(paint);
-
-    SVGPaint::SVGPaintType paintType = paint->paintType();
-    if (paintType != SVGPaint::SVG_PAINTTYPE_URI && paintType != SVGPaint::SVG_PAINTTYPE_URI_RGBCOLOR)
-        return;
-
-    AtomicString id(SVGURIReference::getTarget(paint->uri()));
-    if (RenderSVGResourceContainer* paintingResource = getRenderSVGResourceContainerById(object->document(), id))
-        paintingResource->invalidateClient(object);
-}
-
-bool pointInClippingArea(const RenderObject* object, const FloatPoint& point)
+bool SVGRenderSupport::pointInClippingArea(const RenderObject* object, const FloatPoint& point)
 {
     ASSERT(object);
     ASSERT(object->style());
@@ -335,76 +317,28 @@ bool pointInClippingArea(const RenderObject* object, const FloatPoint& point)
     return true;
 }
 
-void deregisterFromResources(RenderObject* object)
-{
-    ASSERT(object);
-    ASSERT(object->style());
-
-    Document* document = object->document();
-    ASSERT(document);
-
-    const SVGRenderStyle* svgStyle = object->style()->svgStyle();
-    ASSERT(svgStyle);
-
-    // Masker
-    if (RenderSVGResourceMasker* masker = getRenderSVGResourceById<RenderSVGResourceMasker>(document, svgStyle->maskerResource()))
-        masker->invalidateClient(object);
-
-    // Clipper
-    if (RenderSVGResourceClipper* clipper = getRenderSVGResourceById<RenderSVGResourceClipper>(document, svgStyle->clipperResource()))
-        clipper->invalidateClient(object);
-
-    // Filter
-#if ENABLE(FILTERS)
-    if (RenderSVGResourceFilter* filter = getRenderSVGResourceById<RenderSVGResourceFilter>(document, svgStyle->filterResource()))
-        filter->invalidateClient(object);
-#endif
-
-    // Markers
-    if (RenderSVGResourceMarker* startMarker = getRenderSVGResourceById<RenderSVGResourceMarker>(document, svgStyle->markerStartResource()))
-        startMarker->invalidateClient(object);
-    if (RenderSVGResourceMarker* midMarker = getRenderSVGResourceById<RenderSVGResourceMarker>(document, svgStyle->markerMidResource()))
-        midMarker->invalidateClient(object);
-    if (RenderSVGResourceMarker* endMarker = getRenderSVGResourceById<RenderSVGResourceMarker>(document, svgStyle->markerEndResource()))
-        endMarker->invalidateClient(object);
-
-    // Gradients/Patterns
-    if (svgStyle->hasFill())
-        invalidatePaintingResource(svgStyle->fillPaint(), object);
-    if (svgStyle->hasStroke())
-        invalidatePaintingResource(svgStyle->strokePaint(), object);
-}
-
-void applyTransformToPaintInfo(RenderObject::PaintInfo& paintInfo, const AffineTransform& localToAncestorTransform)
-{
-    if (localToAncestorTransform.isIdentity())
-        return;
-
-    paintInfo.context->concatCTM(localToAncestorTransform);
-    paintInfo.rect = localToAncestorTransform.inverse().mapRect(paintInfo.rect);
-}
-
-DashArray dashArrayFromRenderingStyle(const RenderStyle* style, RenderStyle* rootStyle)
+DashArray SVGRenderSupport::dashArrayFromRenderingStyle(const RenderStyle* style, RenderStyle* rootStyle)
 {
     DashArray array;
     
     CSSValueList* dashes = style->svgStyle()->strokeDashArray();
-    if (dashes) {
-        CSSPrimitiveValue* dash = 0;
-        unsigned long len = dashes->length();
-        for (unsigned long i = 0; i < len; i++) {
-            dash = static_cast<CSSPrimitiveValue*>(dashes->itemWithoutBoundsCheck(i));
-            if (!dash)
-                continue;
-
-            array.append((float) dash->computeLengthFloat(const_cast<RenderStyle*>(style), rootStyle));
-        }
+    if (!dashes)
+        return array;
+
+    CSSPrimitiveValue* dash = 0;
+    unsigned long len = dashes->length();
+    for (unsigned long i = 0; i < len; ++i) {
+        dash = static_cast<CSSPrimitiveValue*>(dashes->itemWithoutBoundsCheck(i));
+        if (!dash)
+            continue;
+
+        array.append(dash->computeLengthFloat(const_cast<RenderStyle*>(style), rootStyle));
     }
 
     return array;
 }
 
-void applyStrokeStyleToContext(GraphicsContext* context, const RenderStyle* style, const RenderObject* object)
+void SVGRenderSupport::applyStrokeStyleToContext(GraphicsContext* context, const RenderStyle* style, const RenderObject* object)
 {
     context->setStrokeThickness(SVGRenderStyle::cssPrimitiveToLength(object, style->svgStyle()->strokeWidth(), 1.0f));
     context->setLineCap(style->svgStyle()->capStyle());
@@ -420,7 +354,7 @@ void applyStrokeStyleToContext(GraphicsContext* context, const RenderStyle* styl
         context->setLineDash(dashes, dashOffset);
 }
 
-const RenderObject* findTextRootObject(const RenderObject* start)
+const RenderObject* SVGRenderSupport::findTextRootObject(const RenderObject* start)
 {
     while (start && !start->isSVGText())
         start = start->parent();
diff --git a/WebCore/rendering/SVGRenderSupport.h b/WebCore/rendering/SVGRenderSupport.h
index dce8b8f..8eb486e6 100644
--- a/WebCore/rendering/SVGRenderSupport.h
+++ b/WebCore/rendering/SVGRenderSupport.h
@@ -3,6 +3,7 @@
  *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  *           (C) 2007 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Google, Inc.  All rights reserved.
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -26,68 +27,69 @@
 
 #if ENABLE(SVG)
 #include "DashArray.h"
-#include "RenderObject.h"
-#include "SVGElement.h"
-#include "SVGStyledElement.h"
+#include "PaintInfo.h"
 
 namespace WebCore {
 
-class RenderSVGResourceFilter;
+class FloatPoint;
+class FloatRect;
 class ImageBuffer;
+class RenderBoxModelObject;
+class RenderObject;
+class RenderStyle;
+class TransformState;
 
-// SVGRendererBase is an abstract base class which all SVG renderers inherit
-// from in order to share SVG renderer code.
-// FIXME: This code can all move into RenderSVGModelObject once
-// all SVG renderers inherit from RenderSVGModelObject.
-class SVGRenderBase {
+// SVGRendererSupport is a helper class sharing code between all SVG renderers.
+class SVGRenderSupport {
 public:
-    virtual ~SVGRenderBase();
+    // Used by all SVG renderers who apply clip/filter/etc. resources to the renderer content
+    static bool prepareToRenderSVGContent(RenderObject*, PaintInfo&);
+    static void finishRenderSVGContent(RenderObject*, PaintInfo&, GraphicsContext* savedContext);
 
-    // FIXME: These are only public for SVGRootInlineBox.
-    // It's unclear if these should be exposed or not.  SVGRootInlineBox may
-    // pass the wrong RenderObject* and boundingBox to these functions.
-    static bool prepareToRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, const FloatRect& boundingBox, RenderSVGResourceFilter*&);
-    static void finishRenderSVGContent(RenderObject*, RenderObject::PaintInfo&, RenderSVGResourceFilter*&, GraphicsContext* savedContext);
-
-    // Layout all children of the passed render object
+    // Shares child layouting code between RenderSVGRoot/RenderSVG(Hidden)Container
     static void layoutChildren(RenderObject*, bool selfNeedsLayout);
 
     // Helper function determining wheter overflow is hidden
     static bool isOverflowHidden(const RenderObject*);
 
     // Calculates the repaintRect in combination with filter, clipper and masker in local coordinates.
-    void intersectRepaintRectWithResources(const RenderObject*, FloatRect&) const;
+    static void intersectRepaintRectWithResources(const RenderObject*, FloatRect&);
 
-protected:
-    static IntRect clippedOverflowRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer);
-    static void computeRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer, IntRect&, bool fixed);
+    // Determines whether the passed point lies in a clipping area
+    static bool pointInClippingArea(const RenderObject*, const FloatPoint&);
 
-    static void mapLocalToContainer(const RenderObject*, RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&);
+    enum ContainerBoundingBoxMode {
+        ObjectBoundingBox,
+        StrokeBoundingBox,
+        RepaintBoundingBox
+    };
 
     // Used to share the "walk all the children" logic between objectBoundingBox
     // and repaintRectInLocalCoordinates in RenderSVGRoot and RenderSVGContainer
-    static FloatRect computeContainerBoundingBox(const RenderObject* container, bool includeAllPaintedContent);
-};
-
-// FIXME: This should move to RenderObject or PaintInfo
-// Used for transforming the GraphicsContext and damage rect before passing PaintInfo to child renderers.
-void applyTransformToPaintInfo(RenderObject::PaintInfo&, const AffineTransform& localToChildTransform);
+    static FloatRect computeContainerBoundingBox(const RenderObject* container, ContainerBoundingBoxMode);
 
-// This offers a way to render parts of a WebKit rendering tree into a ImageBuffer.
-void renderSubtreeToImage(ImageBuffer*, RenderObject*);
+    // Important functions used by nearly all SVG renderers centralizing coordinate transformations / repaint rect calculations
+    static IntRect clippedOverflowRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer);
+    static void computeRectForRepaint(RenderObject*, RenderBoxModelObject* repaintContainer, IntRect&, bool fixed);
+    static void mapLocalToContainer(const RenderObject*, RenderBoxModelObject* repaintContainer, bool useTransforms, bool fixed, TransformState&);
 
-bool pointInClippingArea(const RenderObject*, const FloatPoint&);
+    // This offers a way to render parts of a WebKit rendering tree into a ImageBuffer.
+    static void renderSubtreeToImage(ImageBuffer*, RenderObject*);
 
-void deregisterFromResources(RenderObject*);
-void clampImageBufferSizeToViewport(FrameView*, IntSize& imageBufferSize);
+    // Shared between SVG renderers and resources.
+    static void applyStrokeStyleToContext(GraphicsContext*, const RenderStyle*, const RenderObject*);
 
-void applyStrokeStyleToContext(GraphicsContext*, const RenderStyle*, const RenderObject*);
-DashArray dashArrayFromRenderingStyle(const RenderStyle* style, RenderStyle* rootStyle);
+    // FIXME: These methods do not belong here.
+    static const RenderObject* findTextRootObject(const RenderObject* start);
+    static DashArray dashArrayFromRenderingStyle(const RenderStyle* style, RenderStyle* rootStyle);
 
-const RenderObject* findTextRootObject(const RenderObject* start);
+private:
+    // This class is not constructable.
+    SVGRenderSupport();
+    ~SVGRenderSupport();
+};
 
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
-
 #endif // SVGRenderSupport_h
diff --git a/WebCore/rendering/SVGRenderTreeAsText.cpp b/WebCore/rendering/SVGRenderTreeAsText.cpp
index e110ce6..bec78e7 100644
--- a/WebCore/rendering/SVGRenderTreeAsText.cpp
+++ b/WebCore/rendering/SVGRenderTreeAsText.cpp
@@ -372,7 +372,7 @@ static void writeStyle(TextStream& ts, const RenderObject& object)
             writeSVGPaintingResource(ts, strokePaintingResource);
 
             double dashOffset = SVGRenderStyle::cssPrimitiveToLength(&path, svgStyle->strokeDashOffset(), 0.0f);
-            const DashArray& dashArray = dashArrayFromRenderingStyle(style, object.document()->documentElement()->renderStyle());
+            const DashArray& dashArray = SVGRenderSupport::dashArrayFromRenderingStyle(style, object.document()->documentElement()->renderStyle());
             double strokeWidth = SVGRenderStyle::cssPrimitiveToLength(&path, svgStyle->strokeWidth(), 1.0f);
 
             writeIfNotDefault(ts, "opacity", svgStyle->strokeOpacity(), 1.0f);
diff --git a/WebCore/rendering/SVGRootInlineBox.cpp b/WebCore/rendering/SVGRootInlineBox.cpp
index 8fd71ea..6afdd99 100644
--- a/WebCore/rendering/SVGRootInlineBox.cpp
+++ b/WebCore/rendering/SVGRootInlineBox.cpp
@@ -27,7 +27,6 @@
 #if ENABLE(SVG)
 #include "GraphicsContext.h"
 #include "RenderBlock.h"
-#include "RenderSVGResourceFilter.h"
 #include "SVGInlineFlowBox.h"
 #include "SVGInlineTextBox.h"
 #include "SVGRenderSupport.h"
@@ -39,7 +38,7 @@
 
 namespace WebCore {
 
-void SVGRootInlineBox::paint(RenderObject::PaintInfo& paintInfo, int, int)
+void SVGRootInlineBox::paint(PaintInfo& paintInfo, int, int)
 {
     ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
     ASSERT(!paintInfo.context->paintingDisabled());
@@ -47,18 +46,15 @@ void SVGRootInlineBox::paint(RenderObject::PaintInfo& paintInfo, int, int)
     RenderObject* boxRenderer = renderer();
     ASSERT(boxRenderer);
 
-    RenderObject::PaintInfo childPaintInfo(paintInfo);
+    PaintInfo childPaintInfo(paintInfo);
     childPaintInfo.context->save();
 
-    FloatRect repaintRect = boxRenderer->repaintRectInLocalCoordinates();
-
-    RenderSVGResourceFilter* filter = 0;
-    if (SVGRenderBase::prepareToRenderSVGContent(boxRenderer, childPaintInfo, repaintRect, filter)) {
+    if (SVGRenderSupport::prepareToRenderSVGContent(boxRenderer, childPaintInfo)) {
         for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
             child->paint(childPaintInfo, 0, 0);
     }
 
-    SVGRenderBase::finishRenderSVGContent(boxRenderer, childPaintInfo, filter, paintInfo.context);
+    SVGRenderSupport::finishRenderSVGContent(boxRenderer, childPaintInfo, paintInfo.context);
     childPaintInfo.context->restore();
 }
 
diff --git a/WebCore/rendering/SVGRootInlineBox.h b/WebCore/rendering/SVGRootInlineBox.h
index 75e85fd..4e61190 100644
--- a/WebCore/rendering/SVGRootInlineBox.h
+++ b/WebCore/rendering/SVGRootInlineBox.h
@@ -35,8 +35,7 @@ namespace WebCore {
 
 class SVGInlineTextBox;
 
-class SVGRootInlineBox : public RootInlineBox
-                       , protected SVGRenderBase {
+class SVGRootInlineBox : public RootInlineBox {
 public:
     SVGRootInlineBox(RenderObject* obj)
         : RootInlineBox(obj)
@@ -49,7 +48,7 @@ public:
     virtual int virtualHeight() const { return m_height; }
     void setHeight(int height) { m_height = height; }
 
-    virtual void paint(RenderObject::PaintInfo&, int tx, int ty);
+    virtual void paint(PaintInfo&, int tx, int ty);
 
     void computePerCharacterLayoutInformation();
 
diff --git a/WebCore/rendering/ShadowElement.cpp b/WebCore/rendering/ShadowElement.cpp
index 62b37e1..55a4b5c 100644
--- a/WebCore/rendering/ShadowElement.cpp
+++ b/WebCore/rendering/ShadowElement.cpp
@@ -31,7 +31,7 @@ using namespace HTMLNames;
 
 PassRefPtr<ShadowBlockElement> ShadowBlockElement::create(Node* shadowParent)
 {
-    return new ShadowBlockElement(shadowParent);
+    return adoptRef(new ShadowBlockElement(shadowParent));
 }
 
 ShadowBlockElement::ShadowBlockElement(Node* shadowParent)
@@ -105,7 +105,7 @@ bool ShadowBlockElement::partShouldHaveStyle(const RenderObject* parentRenderer,
 
 PassRefPtr<ShadowInputElement> ShadowInputElement::create(Node* shadowParent)
 {
-    return new ShadowInputElement(shadowParent);
+    return adoptRef(new ShadowInputElement(shadowParent));
 }
 
 ShadowInputElement::ShadowInputElement(Node* shadowParent)
diff --git a/WebCore/rendering/TextControlInnerElements.cpp b/WebCore/rendering/TextControlInnerElements.cpp
index 61c85e7..36e30af 100644
--- a/WebCore/rendering/TextControlInnerElements.cpp
+++ b/WebCore/rendering/TextControlInnerElements.cpp
@@ -111,7 +111,7 @@ void TextControlInnerElement::attachInnerElement(Node* parent, PassRefPtr<Render
     
     // For elements without a shadow parent, add the node to the DOM normally.
     if (!m_shadowParent)
-        parent->addChild(this);
+        parent->legacyParserAddChild(this);
     
     // Add the renderer to the render tree
     if (renderer)
diff --git a/WebCore/rendering/style/RenderStyle.cpp b/WebCore/rendering/style/RenderStyle.cpp
index 40f7a27..a386fc6 100644
--- a/WebCore/rendering/style/RenderStyle.cpp
+++ b/WebCore/rendering/style/RenderStyle.cpp
@@ -299,11 +299,8 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     changedContextSensitiveProperties = ContextSensitivePropertyNone;
 
 #if ENABLE(SVG)
-    // This is horribly inefficient.  Eventually we'll have to integrate
-    // this more directly by calling: Diff svgDiff = svgStyle->diff(other)
-    // and then checking svgDiff and returning from the appropriate places below.
     if (m_svgStyle != other->m_svgStyle)
-        return StyleDifferenceLayout;
+        return m_svgStyle->diff(other->m_svgStyle.get());
 #endif
 
     if (m_box->width() != other->m_box->width() ||
@@ -739,14 +736,8 @@ void RenderStyle::setBoxShadow(ShadowData* shadowData, bool add)
     rareData->m_boxShadow.set(shadowData);
 }
 
-void RenderStyle::getBorderRadiiForRect(const IntRect& r, IntSize& topLeft, IntSize& topRight, IntSize& bottomLeft, IntSize& bottomRight) const
+static void constrainCornerRadiiForRect(const IntRect& r, IntSize& topLeft, IntSize& topRight, IntSize& bottomLeft, IntSize& bottomRight)
 {
-    topLeft = surround->border.topLeft();
-    topRight = surround->border.topRight();
-    
-    bottomLeft = surround->border.bottomLeft();
-    bottomRight = surround->border.bottomRight();
-
     // Constrain corner radii using CSS3 rules:
     // http://www.w3.org/TR/css3-background/#the-border-radius
     
@@ -791,6 +782,39 @@ void RenderStyle::getBorderRadiiForRect(const IntRect& r, IntSize& topLeft, IntS
     }
 }
 
+void RenderStyle::getBorderRadiiForRect(const IntRect& r, IntSize& topLeft, IntSize& topRight, IntSize& bottomLeft, IntSize& bottomRight) const
+{
+    topLeft = surround->border.topLeft();
+    topRight = surround->border.topRight();
+    
+    bottomLeft = surround->border.bottomLeft();
+    bottomRight = surround->border.bottomRight();
+
+    constrainCornerRadiiForRect(r, topLeft, topRight, bottomLeft, bottomRight);
+}
+
+void RenderStyle::getInnerBorderRadiiForRectWithBorderWidths(const IntRect& innerRect, unsigned short topWidth, unsigned short bottomWidth, unsigned short leftWidth, unsigned short rightWidth, IntSize& innerTopLeft, IntSize& innerTopRight, IntSize& innerBottomLeft, IntSize& innerBottomRight) const
+{
+    innerTopLeft = surround->border.topLeft();
+    innerTopRight = surround->border.topRight();
+    innerBottomLeft = surround->border.bottomLeft();
+    innerBottomRight = surround->border.bottomRight();
+
+    innerTopLeft.setWidth(max(0, innerTopLeft.width() - leftWidth));
+    innerTopLeft.setHeight(max(0, innerTopLeft.height() - topWidth));
+
+    innerTopRight.setWidth(max(0, innerTopRight.width() - rightWidth));
+    innerTopRight.setHeight(max(0, innerTopRight.height() - topWidth));
+
+    innerBottomLeft.setWidth(max(0, innerBottomLeft.width() - leftWidth));
+    innerBottomLeft.setHeight(max(0, innerBottomLeft.height() - bottomWidth));
+
+    innerBottomRight.setWidth(max(0, innerBottomRight.width() - rightWidth));
+    innerBottomRight.setHeight(max(0, innerBottomRight.height() - bottomWidth));
+
+    constrainCornerRadiiForRect(innerRect, innerTopLeft, innerTopRight, innerBottomLeft, innerBottomRight);
+}
+
 const CounterDirectiveMap* RenderStyle::counterDirectives() const
 {
     return rareNonInheritedData->m_counterDirectives.get();
diff --git a/WebCore/rendering/style/RenderStyle.h b/WebCore/rendering/style/RenderStyle.h
index 2914fcf..748842b 100644
--- a/WebCore/rendering/style/RenderStyle.h
+++ b/WebCore/rendering/style/RenderStyle.h
@@ -704,6 +704,7 @@ public:
     Length perspectiveOriginX() const { return rareNonInheritedData->m_perspectiveOriginX; }
     Length perspectiveOriginY() const { return rareNonInheritedData->m_perspectiveOriginY; }
     LengthSize pageSize() const { return rareNonInheritedData->m_pageSize; }
+    PageSizeType pageSizeType() const { return rareNonInheritedData->m_pageSizeType; }
     
 #if USE(ACCELERATED_COMPOSITING)
     // When set, this ensures that styles compare as different. Used during accelerated animations.
@@ -794,6 +795,10 @@ public:
     }
     
     void getBorderRadiiForRect(const IntRect&, IntSize& topLeft, IntSize& topRight, IntSize& bottomLeft, IntSize& bottomRight) const;
+    void getInnerBorderRadiiForRectWithBorderWidths(const IntRect&, unsigned short topWidth, 
+                            unsigned short bottomWidth, unsigned short leftWidth, unsigned short rightWidth, 
+                            IntSize& innerTopLeft, IntSize& innerTopRight, IntSize& innerBottomLeft, 
+                            IntSize& innerBottomRight) const;
 
     void setBorderLeftWidth(unsigned short v) { SET_VAR(surround, border.m_left.m_width, v) }
     void setBorderLeftStyle(EBorderStyle v) { SET_VAR(surround, border.m_left.m_style, v) }
@@ -1035,6 +1040,8 @@ public:
     void setPerspectiveOriginX(Length l) { SET_VAR(rareNonInheritedData, m_perspectiveOriginX, l); }
     void setPerspectiveOriginY(Length l) { SET_VAR(rareNonInheritedData, m_perspectiveOriginY, l); }
     void setPageSize(LengthSize s) { SET_VAR(rareNonInheritedData, m_pageSize, s); }
+    void setPageSizeType(PageSizeType t) { SET_VAR(rareNonInheritedData, m_pageSizeType, t); }
+    void resetPageSizeType() { SET_VAR(rareNonInheritedData, m_pageSizeType, PAGE_SIZE_AUTO); }
 
 #if USE(ACCELERATED_COMPOSITING)
     void setIsRunningAcceleratedAnimation(bool b = true) { SET_VAR(rareNonInheritedData, m_runningAcceleratedAnimation, b); }
diff --git a/WebCore/rendering/style/SVGRenderStyle.cpp b/WebCore/rendering/style/SVGRenderStyle.cpp
index f4e6cb5..93e50cc 100644
--- a/WebCore/rendering/style/SVGRenderStyle.cpp
+++ b/WebCore/rendering/style/SVGRenderStyle.cpp
@@ -126,6 +126,90 @@ void SVGRenderStyle::inheritFrom(const SVGRenderStyle* svgInheritParent)
     svg_inherited_flags = svgInheritParent->svg_inherited_flags;
 }
 
+StyleDifference SVGRenderStyle::diff(const SVGRenderStyle* other) const
+{
+    // NOTE: All comparisions that may return StyleDifferenceLayout have to go before those who return StyleDifferenceRepaint
+
+    // If kerning changes, we need a relayout, to force SVGCharacterData to be recalculated in the SVGRootInlineBox.
+    if (text != other->text)
+        return StyleDifferenceLayout;
+
+    // If resources change, we need a relayout, as the presence of resources influences the repaint rect.
+    if (resources != other->resources)
+        return StyleDifferenceLayout;
+
+    // If markers change, we need a relayout, as marker boundaries are cached in RenderPath.
+    if (inheritedResources != other->inheritedResources)
+        return StyleDifferenceLayout;
+
+    // All text related properties influence layout.
+    if (svg_inherited_flags._textAnchor != other->svg_inherited_flags._textAnchor
+        || svg_inherited_flags._writingMode != other->svg_inherited_flags._writingMode
+        || svg_inherited_flags._glyphOrientationHorizontal != other->svg_inherited_flags._glyphOrientationHorizontal
+        || svg_inherited_flags._glyphOrientationVertical != other->svg_inherited_flags._glyphOrientationVertical
+        || svg_noninherited_flags.f._alignmentBaseline != other->svg_noninherited_flags.f._alignmentBaseline
+        || svg_noninherited_flags.f._dominantBaseline != other->svg_noninherited_flags.f._dominantBaseline
+        || svg_noninherited_flags.f._baselineShift != other->svg_noninherited_flags.f._baselineShift)
+        return StyleDifferenceLayout;
+
+    // Text related properties influence layout.
+    bool miscNotEqual = misc != other->misc;
+    if (miscNotEqual && misc->baselineShiftValue != other->misc->baselineShiftValue)
+        return StyleDifferenceLayout;
+
+    // These properties affect the cached stroke bounding box rects.
+    if (svg_inherited_flags._capStyle != other->svg_inherited_flags._capStyle
+        || svg_inherited_flags._joinStyle != other->svg_inherited_flags._joinStyle)
+        return StyleDifferenceLayout;
+
+    // Some stroke properties, requires relayouts, as the cached stroke boundaries need to be recalculated.
+    if (stroke != other->stroke) {
+        if (stroke->width != other->stroke->width
+            || stroke->miterLimit != other->stroke->miterLimit
+            || stroke->dashArray != other->stroke->dashArray
+            || stroke->dashOffset != other->stroke->dashOffset)
+            return StyleDifferenceLayout;
+
+        // Only these two cases remain, where we only need a repaint.
+        ASSERT(stroke->paint != other->stroke->paint || stroke->opacity != other->stroke->opacity);
+        return StyleDifferenceRepaint;
+    }
+
+    // NOTE: All comparisions below may only return StyleDifferenceRepaint
+
+    // Painting related properties only need repaints. 
+    if (miscNotEqual) {
+        if (misc->floodColor != other->misc->floodColor
+            || misc->floodOpacity != other->misc->floodOpacity
+            || misc->lightingColor != other->misc->lightingColor)
+            return StyleDifferenceRepaint;
+    }
+
+    // If fill changes, we just need to repaint. Fill boundaries are not influenced by this, only by the Path, that RenderPath contains.
+    if (fill != other->fill)
+        return StyleDifferenceRepaint;
+
+    // If gradient stops change, we just need to repaint. Style updates are already handled through RenderSVGGradientSTop.
+    if (stops != other->stops)
+        return StyleDifferenceRepaint;
+
+    // Changes of these flags only cause repaints.
+    if (svg_inherited_flags._colorRendering != other->svg_inherited_flags._colorRendering
+        || svg_inherited_flags._imageRendering != other->svg_inherited_flags._imageRendering
+        || svg_inherited_flags._shapeRendering != other->svg_inherited_flags._shapeRendering
+        || svg_inherited_flags._clipRule != other->svg_inherited_flags._clipRule
+        || svg_inherited_flags._fillRule != other->svg_inherited_flags._fillRule
+        || svg_inherited_flags._colorInterpolation != other->svg_inherited_flags._colorInterpolation
+        || svg_inherited_flags._colorInterpolationFilters != other->svg_inherited_flags._colorInterpolationFilters)
+        return StyleDifferenceRepaint;
+
+    // FIXME: vector-effect is not taken into account in the layout-phase. Once this is fixed, we should relayout here.
+    if (svg_noninherited_flags.f._vectorEffect != other->svg_noninherited_flags.f._vectorEffect)
+        return StyleDifferenceRepaint;
+
+    return StyleDifferenceEqual;
+}
+
 float SVGRenderStyle::cssPrimitiveToLength(const RenderObject* item, CSSValue* value, float defaultValue)
 {
     CSSPrimitiveValue* primitive = static_cast<CSSPrimitiveValue*>(value);
diff --git a/WebCore/rendering/style/SVGRenderStyle.h b/WebCore/rendering/style/SVGRenderStyle.h
index b0bef61..c87dd2b 100644
--- a/WebCore/rendering/style/SVGRenderStyle.h
+++ b/WebCore/rendering/style/SVGRenderStyle.h
@@ -28,6 +28,7 @@
 #include "DataRef.h"
 #include "GraphicsTypes.h"
 #include "Path.h"
+#include "RenderStyleConstants.h"
 #include "SVGPaint.h"
 #include "SVGRenderStyleDefs.h"
 
@@ -36,7 +37,6 @@ namespace WebCore {
 class FloatRect;
 class IntRect;
 class RenderObject;
-class RenderStyle;
 
 class SVGRenderStyle : public RefCounted<SVGRenderStyle> {    
 public:
@@ -50,7 +50,9 @@ public:
     // FIXME: These functions should move to ShadowData.
     void inflateForShadow(IntRect&) const;
     void inflateForShadow(FloatRect&) const;
-    
+
+    StyleDifference diff(const SVGRenderStyle*) const;
+
     bool operator==(const SVGRenderStyle&) const;
     bool operator!=(const SVGRenderStyle& o) const { return !(*this == o); }
 
diff --git a/WebCore/rendering/style/StyleRareNonInheritedData.cpp b/WebCore/rendering/style/StyleRareNonInheritedData.cpp
index e3367d1..d5c9536 100644
--- a/WebCore/rendering/style/StyleRareNonInheritedData.cpp
+++ b/WebCore/rendering/style/StyleRareNonInheritedData.cpp
@@ -59,6 +59,8 @@ StyleRareNonInheritedData::StyleRareNonInheritedData()
 #if ENABLE(XBL)
     , bindingURI(0)
 #endif
+    , m_pageSize()
+    , m_pageSizeType(PAGE_SIZE_AUTO)
 {
 }
 
@@ -98,6 +100,8 @@ StyleRareNonInheritedData::StyleRareNonInheritedData(const StyleRareNonInherited
 #if ENABLE(XBL)
     , bindingURI(o.bindingURI ? o.bindingURI->copy() : 0)
 #endif
+    , m_pageSize(o.m_pageSize)
+    , m_pageSizeType(o.m_pageSizeType)
 {
 }
 
@@ -156,6 +160,8 @@ bool StyleRareNonInheritedData::operator==(const StyleRareNonInheritedData& o) c
         && (m_perspective == o.m_perspective)
         && (m_perspectiveOriginX == o.m_perspectiveOriginX)
         && (m_perspectiveOriginY == o.m_perspectiveOriginY)
+        && (m_pageSize == o.m_pageSize)
+        && (m_pageSizeType == o.m_pageSizeType)
         ;
 }
 
diff --git a/WebCore/rendering/style/StyleRareNonInheritedData.h b/WebCore/rendering/style/StyleRareNonInheritedData.h
index 74e736c..1025d81 100644
--- a/WebCore/rendering/style/StyleRareNonInheritedData.h
+++ b/WebCore/rendering/style/StyleRareNonInheritedData.h
@@ -40,7 +40,6 @@ namespace WebCore {
 
 class AnimationList;
 class CSSStyleSelector;
-class LengthSize;
 class ShadowData;
 class StyleFlexibleBoxData;
 class StyleMarqueeData;
@@ -49,6 +48,7 @@ class StyleReflection;
 class StyleTransformData;
 
 struct ContentData;
+struct LengthSize;
 
 #if ENABLE(DASHBOARD_SUPPORT)
 struct StyleDashboardRegion;
@@ -58,6 +58,16 @@ struct StyleDashboardRegion;
 class BindingURI;
 #endif
 
+// Page size type.
+// StyleRareNonInheritedData::m_pageSize is meaningful only when 
+// StyleRareNonInheritedData::m_pageSizeType is PAGE_SIZE_RESOLVED.
+enum PageSizeType {
+    PAGE_SIZE_AUTO, // size: auto
+    PAGE_SIZE_AUTO_LANDSCAPE, // size: landscape
+    PAGE_SIZE_AUTO_PORTRAIT, // size: portrait
+    PAGE_SIZE_RESOLVED // Size is fully resolved.
+};
+
 // This struct is for rarely used non-inherited CSS3, CSS2, and WebKit-specific properties.
 // By grouping them together, we save space, and only allocate this object when someone
 // actually uses one of these properties.
@@ -125,6 +135,7 @@ public:
     Length m_perspectiveOriginY;
 
     LengthSize m_pageSize;
+    PageSizeType m_pageSizeType;
 
 #if ENABLE(XBL)
     OwnPtr<BindingURI> bindingURI; // The XBL binding URI list.
diff --git a/WebCore/storage/AbstractDatabase.cpp b/WebCore/storage/AbstractDatabase.cpp
index dc3e8e2..ca9a1b5 100644
--- a/WebCore/storage/AbstractDatabase.cpp
+++ b/WebCore/storage/AbstractDatabase.cpp
@@ -30,9 +30,128 @@
 #include "AbstractDatabase.h"
 
 #if ENABLE(DATABASE)
+#include "DatabaseAuthorizer.h"
+#include "DatabaseTracker.h"
+#include "ExceptionCode.h"
+#include "Logging.h"
+#include "SQLiteStatement.h"
+#include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
+#include "StringHash.h"
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
+static bool retrieveTextResultFromDatabase(SQLiteDatabase& db, const String& query, String& resultString)
+{
+    SQLiteStatement statement(db, query);
+    int result = statement.prepare();
+
+    if (result != SQLResultOk) {
+        LOG_ERROR("Error (%i) preparing statement to read text result from database (%s)", result, query.ascii().data());
+        return false;
+    }
+
+    result = statement.step();
+    if (result == SQLResultRow) {
+        resultString = statement.getColumnText(0);
+        return true;
+    }
+    if (result == SQLResultDone) {
+        resultString = String();
+        return true;
+    }
+
+    LOG_ERROR("Error (%i) reading text result from database (%s)", result, query.ascii().data());
+    return false;
+}
+
+static bool setTextValueInDatabase(SQLiteDatabase& db, const String& query, const String& value)
+{
+    SQLiteStatement statement(db, query);
+    int result = statement.prepare();
+
+    if (result != SQLResultOk) {
+        LOG_ERROR("Failed to prepare statement to set value in database (%s)", query.ascii().data());
+        return false;
+    }
+
+    statement.bindText(1, value);
+
+    result = statement.step();
+    if (result != SQLResultDone) {
+        LOG_ERROR("Failed to step statement to set value in database (%s)", query.ascii().data());
+        return false;
+    }
+
+    return true;
+}
+
+// FIXME: move all guid-related functions to a DatabaseVersionTracker class.
+static Mutex& guidMutex()
+{
+    // Note: We don't have to use AtomicallyInitializedStatic here because
+    // this function is called once in the constructor on the main thread
+    // before any other threads that call this function are used.
+    DEFINE_STATIC_LOCAL(Mutex, mutex, ());
+    return mutex;
+}
+
+typedef HashMap<int, String> GuidVersionMap;
+static GuidVersionMap& guidToVersionMap()
+{
+    DEFINE_STATIC_LOCAL(GuidVersionMap, map, ());
+    return map;
+}
+
+// NOTE: Caller must lock guidMutex().
+static inline void updateGuidVersionMap(int guid, String newVersion)
+{
+    // Ensure the the mutex is locked.
+    ASSERT(!guidMutex().tryLock());
+
+    // Note: It is not safe to put an empty string into the guidToVersionMap() map.
+    // That's because the map is cross-thread, but empty strings are per-thread.
+    // The copy() function makes a version of the string you can use on the current
+    // thread, but we need a string we can keep in a cross-thread data structure.
+    // FIXME: This is a quite-awkward restriction to have to program with.
+
+    // Map null string to empty string (see comment above).
+    guidToVersionMap().set(guid, newVersion.isEmpty() ? String() : newVersion.threadsafeCopy());
+}
+
+typedef HashMap<int, HashSet<AbstractDatabase*>*> GuidDatabaseMap;
+static GuidDatabaseMap& guidToDatabaseMap()
+{
+    DEFINE_STATIC_LOCAL(GuidDatabaseMap, map, ());
+    return map;
+}
+
+static int guidForOriginAndName(const String& origin, const String& name)
+{
+    String stringID = origin + "/" + name;
+
+    // Note: We don't have to use AtomicallyInitializedStatic here because
+    // this function is called once in the constructor on the main thread
+    // before any other threads that call this function are used.
+    DEFINE_STATIC_LOCAL(Mutex, stringIdentifierMutex, ());
+    MutexLocker locker(stringIdentifierMutex);
+    typedef HashMap<String, int> IDGuidMap;
+    DEFINE_STATIC_LOCAL(IDGuidMap, stringIdentifierToGUIDMap, ());
+    int guid = stringIdentifierToGUIDMap.get(stringID);
+    if (!guid) {
+        static int currentNewGUID = 1;
+        guid = currentNewGUID++;
+        stringIdentifierToGUIDMap.set(stringID, guid);
+    }
+
+    return guid;
+}
+
 static bool isDatabaseAvailable = true;
 
 bool AbstractDatabase::isAvailable()
@@ -45,10 +164,304 @@ void AbstractDatabase::setIsAvailable(bool available)
     isDatabaseAvailable = available;
 }
 
+// static
+const String& AbstractDatabase::databaseInfoTableName()
+{
+    DEFINE_STATIC_LOCAL(String, name, ("__WebKitDatabaseInfoTable__"));
+    return name;
+}
+
+AbstractDatabase::AbstractDatabase(ScriptExecutionContext* context, const String& name, const String& expectedVersion,
+                                   const String& displayName, unsigned long estimatedSize)
+    : m_scriptExecutionContext(context)
+    , m_name(name.crossThreadString())
+    , m_expectedVersion(expectedVersion.crossThreadString())
+    , m_displayName(displayName.crossThreadString())
+    , m_estimatedSize(estimatedSize)
+    , m_guid(0)
+    , m_opened(false)
+    , m_new(false)
+{
+    ASSERT(context->isContextThread());
+    m_contextThreadSecurityOrigin = m_scriptExecutionContext->securityOrigin();
+
+    m_databaseAuthorizer = DatabaseAuthorizer::create(databaseInfoTableName());
+
+    if (m_name.isNull())
+        m_name = "";
+
+    m_guid = guidForOriginAndName(securityOrigin()->toString(), name);
+    {
+        MutexLocker locker(guidMutex());
+
+        HashSet<AbstractDatabase*>* hashSet = guidToDatabaseMap().get(m_guid);
+        if (!hashSet) {
+            hashSet = new HashSet<AbstractDatabase*>;
+            guidToDatabaseMap().set(m_guid, hashSet);
+        }
+
+        hashSet->add(this);
+    }
+
+    m_filename = DatabaseTracker::tracker().fullPathForDatabase(securityOrigin(), m_name);
+    DatabaseTracker::tracker().addOpenDatabase(this);
+}
+
 AbstractDatabase::~AbstractDatabase()
 {
 }
 
+void AbstractDatabase::closeDatabase()
+{
+    if (!m_opened)
+        return;
+
+    m_sqliteDatabase.close();
+    m_opened = false;
+    {
+        MutexLocker locker(guidMutex());
+
+        HashSet<AbstractDatabase*>* hashSet = guidToDatabaseMap().get(m_guid);
+        ASSERT(hashSet);
+        ASSERT(hashSet->contains(this));
+        hashSet->remove(this);
+        if (hashSet->isEmpty()) {
+            guidToDatabaseMap().remove(m_guid);
+            delete hashSet;
+            guidToVersionMap().remove(m_guid);
+        }
+    }
+}
+
+String AbstractDatabase::version() const
+{
+    MutexLocker locker(guidMutex());
+    return guidToVersionMap().get(m_guid).threadsafeCopy();
+}
+
+static const int maxSqliteBusyWaitTime = 30000;
+bool AbstractDatabase::performOpenAndVerify(bool shouldSetVersionInNewDatabase, ExceptionCode& ec)
+{
+    if (!m_sqliteDatabase.open(m_filename, true)) {
+        LOG_ERROR("Unable to open database at path %s", m_filename.ascii().data());
+        ec = INVALID_STATE_ERR;
+        return false;
+    }
+    if (!m_sqliteDatabase.turnOnIncrementalAutoVacuum())
+        LOG_ERROR("Unable to turn on incremental auto-vacuum for database %s", m_filename.ascii().data());
+
+    ASSERT(m_databaseAuthorizer);
+    m_sqliteDatabase.setAuthorizer(m_databaseAuthorizer);
+    m_sqliteDatabase.setBusyTimeout(maxSqliteBusyWaitTime);
+
+    String currentVersion;
+    {
+        MutexLocker locker(guidMutex());
+
+        GuidVersionMap::iterator entry = guidToVersionMap().find(m_guid);
+        if (entry != guidToVersionMap().end()) {
+            // Map null string to empty string (see updateGuidVersionMap()).
+            currentVersion = entry->second.isNull() ? String("") : entry->second;
+            LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
+        } else {
+            LOG(StorageAPI, "No cached version for guid %i", m_guid);
+
+            if (!m_sqliteDatabase.tableExists(databaseInfoTableName())) {
+                m_new = true;
+
+                if (!m_sqliteDatabase.executeCommand("CREATE TABLE " + databaseInfoTableName() + " (key TEXT NOT NULL ON CONFLICT FAIL UNIQUE ON CONFLICT REPLACE,value TEXT NOT NULL ON CONFLICT FAIL);")) {
+                    LOG_ERROR("Unable to create table %s in database %s", databaseInfoTableName().ascii().data(), databaseDebugName().ascii().data());
+                    ec = INVALID_STATE_ERR;
+                    // Close the handle to the database file.
+                    m_sqliteDatabase.close();
+                    return false;
+                }
+            }
+
+            if (!getVersionFromDatabase(currentVersion)) {
+                LOG_ERROR("Failed to get current version from database %s", databaseDebugName().ascii().data());
+                ec = INVALID_STATE_ERR;
+                // Close the handle to the database file.
+                m_sqliteDatabase.close();
+                return false;
+            }
+            if (currentVersion.length()) {
+                LOG(StorageAPI, "Retrieved current version %s from database %s", currentVersion.ascii().data(), databaseDebugName().ascii().data());
+            } else if (!m_new || shouldSetVersionInNewDatabase) {
+                LOG(StorageAPI, "Setting version %s in database %s that was just created", m_expectedVersion.ascii().data(), databaseDebugName().ascii().data());
+                if (!setVersionInDatabase(m_expectedVersion)) {
+                    LOG_ERROR("Failed to set version %s in database %s", m_expectedVersion.ascii().data(), databaseDebugName().ascii().data());
+                    ec = INVALID_STATE_ERR;
+                    // Close the handle to the database file.
+                    m_sqliteDatabase.close();
+                    return false;
+                }
+                currentVersion = m_expectedVersion;
+            }
+
+            updateGuidVersionMap(m_guid, currentVersion);
+        }
+    }
+
+    if (currentVersion.isNull()) {
+        LOG(StorageAPI, "Database %s does not have its version set", databaseDebugName().ascii().data());
+        currentVersion = "";
+    }
+
+    // If the expected version isn't the empty string, ensure that the current database version we have matches that version. Otherwise, set an exception.
+    // If the expected version is the empty string, then we always return with whatever version of the database we have.
+    if ((!m_new || shouldSetVersionInNewDatabase) && m_expectedVersion.length() && m_expectedVersion != currentVersion) {
+        LOG(StorageAPI, "page expects version %s from database %s, which actually has version name %s - openDatabase() call will fail", m_expectedVersion.ascii().data(),
+            databaseDebugName().ascii().data(), currentVersion.ascii().data());
+        ec = INVALID_STATE_ERR;
+        // Close the handle to the database file.
+        m_sqliteDatabase.close();
+        return false;
+    }
+
+    m_opened = true;
+
+    return true;
+}
+
+ScriptExecutionContext* AbstractDatabase::scriptExecutionContext() const
+{
+    return m_scriptExecutionContext.get();
+}
+
+SecurityOrigin* AbstractDatabase::securityOrigin() const
+{
+    return m_contextThreadSecurityOrigin.get();
+}
+
+String AbstractDatabase::stringIdentifier() const
+{
+    // Return a deep copy for ref counting thread safety
+    return m_name.threadsafeCopy();
+}
+
+String AbstractDatabase::displayName() const
+{
+    // Return a deep copy for ref counting thread safety
+    return m_displayName.threadsafeCopy();
+}
+
+unsigned long AbstractDatabase::estimatedSize() const
+{
+    return m_estimatedSize;
+}
+
+String AbstractDatabase::fileName() const
+{
+    // Return a deep copy for ref counting thread safety
+    return m_filename.threadsafeCopy();
+}
+
+// static
+const String& AbstractDatabase::databaseVersionKey()
+{
+    DEFINE_STATIC_LOCAL(String, key, ("WebKitDatabaseVersionKey"));
+    return key;
+}
+
+bool AbstractDatabase::getVersionFromDatabase(String& version)
+{
+    DEFINE_STATIC_LOCAL(String, getVersionQuery, ("SELECT value FROM " + databaseInfoTableName() + " WHERE key = '" + databaseVersionKey() + "';"));
+
+    m_databaseAuthorizer->disable();
+
+    bool result = retrieveTextResultFromDatabase(m_sqliteDatabase, getVersionQuery.threadsafeCopy(), version);
+    if (!result)
+        LOG_ERROR("Failed to retrieve version from database %s", databaseDebugName().ascii().data());
+
+    m_databaseAuthorizer->enable();
+
+    return result;
+}
+
+bool AbstractDatabase::setVersionInDatabase(const String& version)
+{
+    // The INSERT will replace an existing entry for the database with the new version number, due to the UNIQUE ON CONFLICT REPLACE
+    // clause in the CREATE statement (see Database::performOpenAndVerify()).
+    DEFINE_STATIC_LOCAL(String, setVersionQuery, ("INSERT INTO " + databaseInfoTableName() + " (key, value) VALUES ('" + databaseVersionKey() + "', ?);"));
+
+    m_databaseAuthorizer->disable();
+
+    bool result = setTextValueInDatabase(m_sqliteDatabase, setVersionQuery.threadsafeCopy(), version);
+    if (!result)
+        LOG_ERROR("Failed to set version %s in database (%s)", version.ascii().data(), setVersionQuery.ascii().data());
+
+    m_databaseAuthorizer->enable();
+
+    return result;
+}
+
+bool AbstractDatabase::versionMatchesExpected() const
+{
+    if (!m_expectedVersion.isEmpty()) {
+        MutexLocker locker(guidMutex());
+        return m_expectedVersion == guidToVersionMap().get(m_guid);
+    }
+
+    return true;
+}
+
+void AbstractDatabase::setExpectedVersion(const String& version)
+{
+    m_expectedVersion = version.threadsafeCopy();
+    // Update the in memory database version map.
+    MutexLocker locker(guidMutex());
+    updateGuidVersionMap(m_guid, version);
+}
+
+void AbstractDatabase::disableAuthorizer()
+{
+    ASSERT(m_databaseAuthorizer);
+    m_databaseAuthorizer->disable();
+}
+
+void AbstractDatabase::enableAuthorizer()
+{
+    ASSERT(m_databaseAuthorizer);
+    m_databaseAuthorizer->enable();
+}
+
+void AbstractDatabase::setAuthorizerReadOnly()
+{
+    ASSERT(m_databaseAuthorizer);
+    m_databaseAuthorizer->setReadOnly();
+}
+
+bool AbstractDatabase::lastActionChangedDatabase()
+{
+    ASSERT(m_databaseAuthorizer);
+    return m_databaseAuthorizer->lastActionChangedDatabase();
+}
+
+bool AbstractDatabase::lastActionWasInsert()
+{
+    ASSERT(m_databaseAuthorizer);
+    return m_databaseAuthorizer->lastActionWasInsert();
+}
+
+void AbstractDatabase::resetDeletes()
+{
+    ASSERT(m_databaseAuthorizer);
+    m_databaseAuthorizer->resetDeletes();
+}
+
+bool AbstractDatabase::hadDeletes()
+{
+    ASSERT(m_databaseAuthorizer);
+    return m_databaseAuthorizer->hadDeletes();
+}
+
+void AbstractDatabase::resetAuthorizer()
+{
+    if (m_databaseAuthorizer)
+        m_databaseAuthorizer->reset();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(DATABASE)
diff --git a/WebCore/storage/AbstractDatabase.h b/WebCore/storage/AbstractDatabase.h
index 5e4e0fa..d38a819 100644
--- a/WebCore/storage/AbstractDatabase.h
+++ b/WebCore/storage/AbstractDatabase.h
@@ -32,13 +32,21 @@
 #if ENABLE(DATABASE)
 
 #include "PlatformString.h"
+#include "SQLiteDatabase.h"
+#include <wtf/Forward.h>
 #include <wtf/ThreadSafeShared.h>
+#ifndef NDEBUG
+#include "SecurityOrigin.h"
+#endif
 
 namespace WebCore {
 
+class DatabaseAuthorizer;
 class ScriptExecutionContext;
 class SecurityOrigin;
 
+typedef int ExceptionCode;
+
 class AbstractDatabase : public ThreadSafeShared<AbstractDatabase> {
 public:
     static bool isAvailable();
@@ -46,15 +54,69 @@ public:
 
     virtual ~AbstractDatabase();
 
-    virtual ScriptExecutionContext* scriptExecutionContext() const = 0;
-    virtual SecurityOrigin* securityOrigin() const = 0;
-    virtual String stringIdentifier() const = 0;
-    virtual String displayName() const = 0;
-    virtual unsigned long estimatedSize() const = 0;
-    virtual String fileName() const = 0;
+    virtual String version() const;
+
+    bool opened() const { return m_opened; }
+    bool isNew() const { return m_new; }
+
+    virtual ScriptExecutionContext* scriptExecutionContext() const;
+    virtual SecurityOrigin* securityOrigin() const;
+    virtual String stringIdentifier() const;
+    virtual String displayName() const;
+    virtual unsigned long estimatedSize() const;
+    virtual String fileName() const;
+
+    // FIXME: move all version-related methods to a DatabaseVersionTracker class
+    bool versionMatchesExpected() const;
+    void setExpectedVersion(const String& version);
+    bool getVersionFromDatabase(String& version);
+    bool setVersionInDatabase(const String& version);
+
+    void disableAuthorizer();
+    void enableAuthorizer();
+    void setAuthorizerReadOnly();
+    bool lastActionChangedDatabase();
+    bool lastActionWasInsert();
+    void resetDeletes();
+    bool hadDeletes();
+    void resetAuthorizer();
 
     virtual void markAsDeletedAndClose() = 0;
     virtual void closeImmediately() = 0;
+
+protected:
+    AbstractDatabase(ScriptExecutionContext*, const String& name, const String& expectedVersion,
+                     const String& displayName, unsigned long estimatedSize);
+
+    void closeDatabase();
+
+    virtual bool performOpenAndVerify(bool shouldSetVersionInNewDatabase, ExceptionCode& ec);
+
+    static const String& databaseInfoTableName();
+
+    RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
+    RefPtr<SecurityOrigin> m_contextThreadSecurityOrigin;
+
+    String m_name;
+    String m_expectedVersion;
+    String m_displayName;
+    unsigned long m_estimatedSize;
+    String m_filename;
+
+    SQLiteDatabase m_sqliteDatabase;
+
+#ifndef NDEBUG
+    String databaseDebugName() const { return m_contextThreadSecurityOrigin->toString() + "::" + m_name; }
+#endif
+
+private:
+    static const String& databaseVersionKey();
+
+    int m_guid;
+    bool m_opened;
+    bool m_new;
+
+    RefPtr<DatabaseAuthorizer> m_databaseAuthorizer;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/Database.cpp b/WebCore/storage/Database.cpp
index ad6b92c..30087ee 100644
--- a/WebCore/storage/Database.cpp
+++ b/WebCore/storage/Database.cpp
@@ -31,7 +31,6 @@
 
 #if ENABLE(DATABASE)
 #include "ChangeVersionWrapper.h"
-#include "DatabaseAuthorizer.h"
 #include "DatabaseCallback.h"
 #include "DatabaseTask.h"
 #include "DatabaseThread.h"
@@ -50,7 +49,6 @@
 #include "ScriptController.h"
 #include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
-#include "StringHash.h"
 #include "VoidCallback.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
@@ -64,81 +62,27 @@
 
 namespace WebCore {
 
-// If we sleep for more the 30 seconds while blocked on SQLITE_BUSY, give up.
-static const int maxSqliteBusyWaitTime = 30000;
-
-const String& Database::databaseInfoTableName()
-{
-    DEFINE_STATIC_LOCAL(String, name, ("__WebKitDatabaseInfoTable__"));
-    return name;
-}
-
-static Mutex& guidMutex()
-{
-    // Note: We don't have to use AtomicallyInitializedStatic here because
-    // this function is called once in the constructor on the main thread
-    // before any other threads that call this function are used.
-    DEFINE_STATIC_LOCAL(Mutex, mutex, ());
-    return mutex;
-}
-
-typedef HashMap<int, String> GuidVersionMap;
-static GuidVersionMap& guidToVersionMap()
-{
-    DEFINE_STATIC_LOCAL(GuidVersionMap, map, ());
-    return map;
-}
-
-// NOTE: Caller must lock guidMutex().
-static inline void updateGuidVersionMap(int guid, String newVersion)
-{
-    // Ensure the the mutex is locked.
-    ASSERT(!guidMutex().tryLock());
-
-    // Note: It is not safe to put an empty string into the guidToVersionMap() map.
-    // That's because the map is cross-thread, but empty strings are per-thread.
-    // The copy() function makes a version of the string you can use on the current
-    // thread, but we need a string we can keep in a cross-thread data structure.
-    // FIXME: This is a quite-awkward restriction to have to program with.
-
-    // Map null string to empty string (see comment above).
-    guidToVersionMap().set(guid, newVersion.isEmpty() ? String() : newVersion.threadsafeCopy());
-}
-
-typedef HashMap<int, HashSet<Database*>*> GuidDatabaseMap;
-static GuidDatabaseMap& guidToDatabaseMap()
-{
-    DEFINE_STATIC_LOCAL(GuidDatabaseMap, map, ());
-    return map;
-}
-
-static const String& databaseVersionKey()
-{
-    DEFINE_STATIC_LOCAL(String, key, ("WebKitDatabaseVersionKey"));
-    return key;
-}
-
-static int guidForOriginAndName(const String& origin, const String& name);
-
 class DatabaseCreationCallbackTask : public ScriptExecutionContext::Task {
 public:
-    static PassOwnPtr<DatabaseCreationCallbackTask> create(PassRefPtr<Database> database)
+    static PassOwnPtr<DatabaseCreationCallbackTask> create(PassRefPtr<Database> database, PassRefPtr<DatabaseCallback> creationCallback)
     {
-        return new DatabaseCreationCallbackTask(database);
+        return new DatabaseCreationCallbackTask(database, creationCallback);
     }
 
-    virtual void performTask(ScriptExecutionContext*)
+    virtual void performTask(ScriptExecutionContext* context)
     {
-        m_database->performCreationCallback();
+        m_creationCallback->handleEvent(context, m_database.get());
     }
 
 private:
-    DatabaseCreationCallbackTask(PassRefPtr<Database> database)
+    DatabaseCreationCallbackTask(PassRefPtr<Database> database, PassRefPtr<DatabaseCallback> callback)
         : m_database(database)
+        , m_creationCallback(callback)
     {
     }
 
     RefPtr<Database> m_database;
+    RefPtr<DatabaseCallback> m_creationCallback;
 };
 
 PassRefPtr<Database> Database::openDatabase(ScriptExecutionContext* context, const String& name,
@@ -147,16 +91,14 @@ PassRefPtr<Database> Database::openDatabase(ScriptExecutionContext* context, con
                                             ExceptionCode& e)
 {
     if (!DatabaseTracker::tracker().canEstablishDatabase(context, name, displayName, estimatedSize)) {
-        // FIXME: There should be an exception raised here in addition to returning a null Database object.  The question has been raised with the WHATWG.
         LOG(StorageAPI, "Database %s for origin %s not allowed to be established", name.ascii().data(), context->securityOrigin()->toString().ascii().data());
         return 0;
     }
 
-    RefPtr<Database> database = adoptRef(new Database(context, name, expectedVersion, displayName, estimatedSize, creationCallback));
+    RefPtr<Database> database = adoptRef(new Database(context, name, expectedVersion, displayName, estimatedSize));
 
-    if (!database->openAndVerifyVersion(e)) {
+    if (!database->openAndVerifyVersion(!creationCallback, e)) {
         LOG(StorageAPI, "Failed to open and verify version (expected %s) of database %s", expectedVersion.ascii().data(), database->databaseDebugName().ascii().data());
-        context->removeOpenDatabase(database.get());
         DatabaseTracker::tracker().removeOpenDatabase(database.get());
         return 0;
     }
@@ -176,57 +118,25 @@ PassRefPtr<Database> Database::openDatabase(ScriptExecutionContext* context, con
     // version to "" and schedule the creation callback. Because of some subtle String
     // implementation issues, we have to reset m_expectedVersion here instead of doing
     // it inside performOpenAndVerify() which is run on the DB thread.
-    if (database->isNew() && database->m_creationCallback.get()) {
+    if (database->isNew() && creationCallback.get()) {
         database->m_expectedVersion = "";
         LOG(StorageAPI, "Scheduling DatabaseCreationCallbackTask for database %p\n", database.get());
-        database->m_scriptExecutionContext->postTask(DatabaseCreationCallbackTask::create(database));
+        database->m_scriptExecutionContext->postTask(DatabaseCreationCallbackTask::create(database, creationCallback));
     }
 
     return database;
 }
 
-Database::Database(ScriptExecutionContext* context, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback)
-    : m_transactionInProgress(false)
+Database::Database(ScriptExecutionContext* context, const String& name, const String& expectedVersion, const String& displayName, unsigned long estimatedSize)
+    : AbstractDatabase(context, name, expectedVersion, displayName, estimatedSize)
+    , m_transactionInProgress(false)
     , m_isTransactionQueueEnabled(true)
-    , m_scriptExecutionContext(context)
-    , m_name(name.crossThreadString())
-    , m_guid(0)
-    , m_expectedVersion(expectedVersion.crossThreadString())
-    , m_displayName(displayName.crossThreadString())
-    , m_estimatedSize(estimatedSize)
     , m_deleted(false)
-    , m_stopped(false)
-    , m_opened(false)
-    , m_new(false)
-    , m_creationCallback(creationCallback)
 {
-    ASSERT(m_scriptExecutionContext.get());
-    m_contextThreadSecurityOrigin = m_scriptExecutionContext->securityOrigin();
     m_databaseThreadSecurityOrigin = m_contextThreadSecurityOrigin->threadsafeCopy();
-    if (m_name.isNull())
-        m_name = "";
 
     ScriptController::initializeThreading();
-
-    m_guid = guidForOriginAndName(securityOrigin()->toString(), name);
-
-    {
-        MutexLocker locker(guidMutex());
-
-        HashSet<Database*>* hashSet = guidToDatabaseMap().get(m_guid);
-        if (!hashSet) {
-            hashSet = new HashSet<Database*>;
-            guidToDatabaseMap().set(m_guid, hashSet);
-        }
-
-        hashSet->add(this);
-    }
-
     ASSERT(m_scriptExecutionContext->databaseThread());
-    m_filename = DatabaseTracker::tracker().fullPathForDatabase(securityOrigin(), m_name);
-
-    DatabaseTracker::tracker().addOpenDatabase(this);
-    context->addOpenDatabase(this);
 }
 
 class DerefContextTask : public ScriptExecutionContext::Task {
@@ -253,15 +163,21 @@ Database::~Database()
     }
 }
 
-bool Database::openAndVerifyVersion(ExceptionCode& e)
+String Database::version() const
+{
+    if (m_deleted)
+        return String();
+    return AbstractDatabase::version();
+}
+
+bool Database::openAndVerifyVersion(bool setVersionInNewDatabase, ExceptionCode& e)
 {
     if (!m_scriptExecutionContext->databaseThread())
         return false;
-    m_databaseAuthorizer = DatabaseAuthorizer::create();
 
     bool success = false;
     DatabaseTaskSynchronizer synchronizer;
-    OwnPtr<DatabaseOpenTask> task = DatabaseOpenTask::create(this, &synchronizer, e, success);
+    OwnPtr<DatabaseOpenTask> task = DatabaseOpenTask::create(this, setVersionInNewDatabase, &synchronizer, e, success);
 
     m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
     synchronizer.waitForTaskCompletion();
@@ -269,93 +185,6 @@ bool Database::openAndVerifyVersion(ExceptionCode& e)
     return success;
 }
 
-
-static bool retrieveTextResultFromDatabase(SQLiteDatabase& db, const String& query, String& resultString)
-{
-    SQLiteStatement statement(db, query);
-    int result = statement.prepare();
-
-    if (result != SQLResultOk) {
-        LOG_ERROR("Error (%i) preparing statement to read text result from database (%s)", result, query.ascii().data());
-        return false;
-    }
-
-    result = statement.step();
-    if (result == SQLResultRow) {
-        resultString = statement.getColumnText(0);
-        return true;
-    } else if (result == SQLResultDone) {
-        resultString = String();
-        return true;
-    } else {
-        LOG_ERROR("Error (%i) reading text result from database (%s)", result, query.ascii().data());
-        return false;
-    }
-}
-
-bool Database::getVersionFromDatabase(String& version)
-{
-    DEFINE_STATIC_LOCAL(String, getVersionQuery, ("SELECT value FROM " + databaseInfoTableName() + " WHERE key = '" + databaseVersionKey() + "';"));
-
-    m_databaseAuthorizer->disable();
-
-    bool result = retrieveTextResultFromDatabase(m_sqliteDatabase, getVersionQuery.threadsafeCopy(), version);
-    if (!result)
-        LOG_ERROR("Failed to retrieve version from database %s", databaseDebugName().ascii().data());
-
-    m_databaseAuthorizer->enable();
-
-    return result;
-}
-
-static bool setTextValueInDatabase(SQLiteDatabase& db, const String& query, const String& value)
-{
-    SQLiteStatement statement(db, query);
-    int result = statement.prepare();
-
-    if (result != SQLResultOk) {
-        LOG_ERROR("Failed to prepare statement to set value in database (%s)", query.ascii().data());
-        return false;
-    }
-
-    statement.bindText(1, value);
-
-    result = statement.step();
-    if (result != SQLResultDone) {
-        LOG_ERROR("Failed to step statement to set value in database (%s)", query.ascii().data());
-        return false;
-    }
-
-    return true;
-}
-
-bool Database::setVersionInDatabase(const String& version)
-{
-    // The INSERT will replace an existing entry for the database with the new version number, due to the UNIQUE ON CONFLICT REPLACE
-    // clause in the CREATE statement (see Database::performOpenAndVerify()).
-    DEFINE_STATIC_LOCAL(String, setVersionQuery, ("INSERT INTO " + databaseInfoTableName() + " (key, value) VALUES ('" + databaseVersionKey() + "', ?);"));
-
-    m_databaseAuthorizer->disable();
-
-    bool result = setTextValueInDatabase(m_sqliteDatabase, setVersionQuery.threadsafeCopy(), version);
-    if (!result)
-        LOG_ERROR("Failed to set version %s in database (%s)", version.ascii().data(), setVersionQuery.ascii().data());
-
-    m_databaseAuthorizer->enable();
-
-    return result;
-}
-
-bool Database::versionMatchesExpected() const
-{
-    if (!m_expectedVersion.isEmpty()) {
-        MutexLocker locker(guidMutex());
-        return m_expectedVersion == guidToVersionMap().get(m_guid);
-    }
-
-    return true;
-}
-
 void Database::markAsDeletedAndClose()
 {
     if (m_deleted || !m_scriptExecutionContext->databaseThread())
@@ -369,100 +198,38 @@ void Database::markAsDeletedAndClose()
         return;
     }
 
-    m_scriptExecutionContext->databaseThread()->unscheduleDatabaseTasks(this);
-
     DatabaseTaskSynchronizer synchronizer;
-    OwnPtr<DatabaseCloseTask> task = DatabaseCloseTask::create(this, DoNotRemoveDatabaseFromContext, &synchronizer);
+    OwnPtr<DatabaseCloseTask> task = DatabaseCloseTask::create(this, &synchronizer);
 
     m_scriptExecutionContext->databaseThread()->scheduleImmediateTask(task.release());
     synchronizer.waitForTaskCompletion();
-
-    // DatabaseCloseTask tells Database::close not to do these two removals so that we can do them here synchronously.
-    m_scriptExecutionContext->removeOpenDatabase(this);
-    DatabaseTracker::tracker().removeOpenDatabase(this);
 }
 
-class ContextRemoveOpenDatabaseTask : public ScriptExecutionContext::Task {
-public:
-    static PassOwnPtr<ContextRemoveOpenDatabaseTask> create(PassRefPtr<Database> database)
-    {
-        return new ContextRemoveOpenDatabaseTask(database);
-    }
-
-    virtual void performTask(ScriptExecutionContext* context)
-    {
-        context->removeOpenDatabase(m_database.get());
-        DatabaseTracker::tracker().removeOpenDatabase(m_database.get());
-    }
-
-    virtual bool isCleanupTask() const { return true; }
-
-private:
-    ContextRemoveOpenDatabaseTask(PassRefPtr<Database> database)
-        : m_database(database)
-    {
-    }
-
-    RefPtr<Database> m_database;
-};
-
-void Database::close(ClosePolicy policy)
+void Database::close()
 {
-    RefPtr<Database> protect = this;
-
-    if (!m_opened)
-        return;
-
     ASSERT(m_scriptExecutionContext->databaseThread());
     ASSERT(currentThread() == m_scriptExecutionContext->databaseThread()->getThreadID());
-    m_sqliteDatabase.close();
-    // Must ref() before calling databaseThread()->recordDatabaseClosed().
-    m_scriptExecutionContext->databaseThread()->recordDatabaseClosed(this);
-    m_opened = false;
 
     {
-        MutexLocker locker(guidMutex());
-
-        HashSet<Database*>* hashSet = guidToDatabaseMap().get(m_guid);
-        ASSERT(hashSet);
-        ASSERT(hashSet->contains(this));
-        hashSet->remove(this);
-        if (hashSet->isEmpty()) {
-            guidToDatabaseMap().remove(m_guid);
-            delete hashSet;
-            guidToVersionMap().remove(m_guid);
-        }
+        MutexLocker locker(m_transactionInProgressMutex);
+        m_isTransactionQueueEnabled = false;
+        m_transactionInProgress = false;
     }
 
+    closeDatabase();
+
+    // Must ref() before calling databaseThread()->recordDatabaseClosed().
+    RefPtr<Database> protect = this;
+    m_scriptExecutionContext->databaseThread()->recordDatabaseClosed(this);
     m_scriptExecutionContext->databaseThread()->unscheduleDatabaseTasks(this);
-    if (policy == RemoveDatabaseFromContext)
-        m_scriptExecutionContext->postTask(ContextRemoveOpenDatabaseTask::create(this));
+    DatabaseTracker::tracker().removeOpenDatabase(this);
 }
 
 void Database::closeImmediately()
 {
     DatabaseThread* databaseThread = scriptExecutionContext()->databaseThread();
-    if (databaseThread && !databaseThread->terminationRequested()) {
-        stop();
-        databaseThread->scheduleTask(DatabaseCloseTask::create(this, Database::RemoveDatabaseFromContext, 0));
-    }
-}
-
-void Database::stop()
-{
-    // FIXME: The net effect of the following code is to remove all pending transactions and statements, but allow the current statement
-    // to run to completion.  In the future we can use the sqlite3_progress_handler or sqlite3_interrupt interfaces to cancel the current
-    // statement in response to close(), as well.
-
-    // This method is meant to be used as an analog to cancelling a loader, and is used when a document is shut down as the result of
-    // a page load or closing the page
-    m_stopped = true;
-
-    {
-        MutexLocker locker(m_transactionInProgressMutex);
-        m_isTransactionQueueEnabled = false;
-        m_transactionInProgress = false;
-    }
+    if (databaseThread && !databaseThread->terminationRequested() && opened())
+        databaseThread->scheduleImmediateTask(DatabaseCloseTask::create(this, 0));
 }
 
 unsigned long long Database::maximumSize() const
@@ -470,179 +237,16 @@ unsigned long long Database::maximumSize() const
     return DatabaseTracker::tracker().getMaxSizeForDatabase(this);
 }
 
-void Database::disableAuthorizer()
-{
-    ASSERT(m_databaseAuthorizer);
-    m_databaseAuthorizer->disable();
-}
-
-void Database::enableAuthorizer()
-{
-    ASSERT(m_databaseAuthorizer);
-    m_databaseAuthorizer->enable();
-}
-
-void Database::setAuthorizerReadOnly()
-{
-    ASSERT(m_databaseAuthorizer);
-    m_databaseAuthorizer->setReadOnly();
-}
-
-bool Database::lastActionChangedDatabase()
-{
-    ASSERT(m_databaseAuthorizer);
-    return m_databaseAuthorizer->lastActionChangedDatabase();
-}
-
-bool Database::lastActionWasInsert()
-{
-    ASSERT(m_databaseAuthorizer);
-    return m_databaseAuthorizer->lastActionWasInsert();
-}
-
-void Database::resetDeletes()
-{
-    ASSERT(m_databaseAuthorizer);
-    m_databaseAuthorizer->resetDeletes();
-}
-
-bool Database::hadDeletes()
-{
-    ASSERT(m_databaseAuthorizer);
-    return m_databaseAuthorizer->hadDeletes();
-}
-
-static int guidForOriginAndName(const String& origin, const String& name)
-{
-    String stringID;
-    if (origin.endsWith("/"))
-        stringID = origin + name;
-    else
-        stringID = origin + "/" + name;
-
-    // Note: We don't have to use AtomicallyInitializedStatic here because
-    // this function is called once in the constructor on the main thread
-    // before any other threads that call this function are used.
-    DEFINE_STATIC_LOCAL(Mutex, stringIdentifierMutex, ());
-    MutexLocker locker(stringIdentifierMutex);
-    typedef HashMap<String, int> IDGuidMap;
-    DEFINE_STATIC_LOCAL(IDGuidMap, stringIdentifierToGUIDMap, ());
-    int guid = stringIdentifierToGUIDMap.get(stringID);
-    if (!guid) {
-        static int currentNewGUID = 1;
-        guid = currentNewGUID++;
-        stringIdentifierToGUIDMap.set(stringID, guid);
-    }
-
-    return guid;
-}
-
-void Database::resetAuthorizer()
+bool Database::performOpenAndVerify(bool setVersionInNewDatabase, ExceptionCode& e)
 {
-    if (m_databaseAuthorizer)
-        m_databaseAuthorizer->reset();
-}
-
-void Database::performPolicyChecks()
-{
-    // FIXME: Code similar to the following will need to be run to enforce the per-origin size limit the spec mandates.
-    // Additionally, we might need a way to pause the database thread while the UA prompts the user for permission to
-    // increase the size limit
-
-    /*
-    if (m_databaseAuthorizer->lastActionIncreasedSize())
-        DatabaseTracker::scheduleFileSizeCheckOnMainThread(this);
-    */
-
-    notImplemented();
-}
+    if (AbstractDatabase::performOpenAndVerify(setVersionInNewDatabase, e)) {
+        if (m_scriptExecutionContext->databaseThread())
+            m_scriptExecutionContext->databaseThread()->recordDatabaseOpen(this);
 
-bool Database::performOpenAndVerify(ExceptionCode& e)
-{
-    if (!m_sqliteDatabase.open(m_filename, true)) {
-        LOG_ERROR("Unable to open database at path %s", m_filename.ascii().data());
-        e = INVALID_STATE_ERR;
-        return false;
-    }
-    if (!m_sqliteDatabase.turnOnIncrementalAutoVacuum())
-        LOG_ERROR("Unable to turn on incremental auto-vacuum for database %s", m_filename.ascii().data());
-
-    ASSERT(m_databaseAuthorizer);
-    m_sqliteDatabase.setAuthorizer(m_databaseAuthorizer);
-    m_sqliteDatabase.setBusyTimeout(maxSqliteBusyWaitTime);
-
-    String currentVersion;
-    {
-        MutexLocker locker(guidMutex());
-
-        GuidVersionMap::iterator entry = guidToVersionMap().find(m_guid);
-        if (entry != guidToVersionMap().end()) {
-            // Map null string to empty string (see updateGuidVersionMap()).
-            currentVersion = entry->second.isNull() ? String("") : entry->second;
-            LOG(StorageAPI, "Current cached version for guid %i is %s", m_guid, currentVersion.ascii().data());
-        } else {
-            LOG(StorageAPI, "No cached version for guid %i", m_guid);
-
-            if (!m_sqliteDatabase.tableExists(databaseInfoTableName())) {
-                m_new = true;
-
-                if (!m_sqliteDatabase.executeCommand("CREATE TABLE " + databaseInfoTableName() + " (key TEXT NOT NULL ON CONFLICT FAIL UNIQUE ON CONFLICT REPLACE,value TEXT NOT NULL ON CONFLICT FAIL);")) {
-                    LOG_ERROR("Unable to create table %s in database %s", databaseInfoTableName().ascii().data(), databaseDebugName().ascii().data());
-                    e = INVALID_STATE_ERR;
-                    // Close the handle to the database file.
-                    m_sqliteDatabase.close();
-                    return false;
-                }
-            }
-
-            if (!getVersionFromDatabase(currentVersion)) {
-                LOG_ERROR("Failed to get current version from database %s", databaseDebugName().ascii().data());
-                e = INVALID_STATE_ERR;
-                // Close the handle to the database file.
-                m_sqliteDatabase.close();
-                return false;
-            }
-            if (currentVersion.length()) {
-                LOG(StorageAPI, "Retrieved current version %s from database %s", currentVersion.ascii().data(), databaseDebugName().ascii().data());
-            } else if (!m_new || !m_creationCallback) {
-                LOG(StorageAPI, "Setting version %s in database %s that was just created", m_expectedVersion.ascii().data(), databaseDebugName().ascii().data());
-                if (!setVersionInDatabase(m_expectedVersion)) {
-                    LOG_ERROR("Failed to set version %s in database %s", m_expectedVersion.ascii().data(), databaseDebugName().ascii().data());
-                    e = INVALID_STATE_ERR;
-                    // Close the handle to the database file.
-                    m_sqliteDatabase.close();
-                    return false;
-                }
-                currentVersion = m_expectedVersion;
-            }
-
-            updateGuidVersionMap(m_guid, currentVersion);
-        }
-    }
-
-    if (currentVersion.isNull()) {
-        LOG(StorageAPI, "Database %s does not have its version set", databaseDebugName().ascii().data());
-        currentVersion = "";
-    }
-
-    // If the expected version isn't the empty string, ensure that the current database version we have matches that version. Otherwise, set an exception.
-    // If the expected version is the empty string, then we always return with whatever version of the database we have.
-    if ((!m_new || !m_creationCallback) && m_expectedVersion.length() && m_expectedVersion != currentVersion) {
-        LOG(StorageAPI, "page expects version %s from database %s, which actually has version name %s - openDatabase() call will fail", m_expectedVersion.ascii().data(),
-            databaseDebugName().ascii().data(), currentVersion.ascii().data());
-        e = INVALID_STATE_ERR;
-        // Close the handle to the database file.
-        m_sqliteDatabase.close();
-        return false;
+        return true;
     }
 
-    // All checks passed and we still have a handle to this database file.
-    // Make sure DatabaseThread closes it when DatabaseThread goes away.
-    m_opened = true;
-    if (m_scriptExecutionContext->databaseThread())
-        m_scriptExecutionContext->databaseThread()->recordDatabaseOpen(this);
-
-    return true;
+    return false;
 }
 
 void Database::changeVersion(const String& oldVersion, const String& newVersion,
@@ -757,11 +361,6 @@ Vector<String> Database::performGetTableNames()
     return tableNames;
 }
 
-void Database::performCreationCallback()
-{
-    m_creationCallback->handleEvent(m_scriptExecutionContext.get(), this);
-}
-
 SQLTransactionClient* Database::transactionClient() const
 {
     return m_scriptExecutionContext->databaseThread()->transactionClient();
@@ -772,14 +371,6 @@ SQLTransactionCoordinator* Database::transactionCoordinator() const
     return m_scriptExecutionContext->databaseThread()->transactionCoordinator();
 }
 
-String Database::version() const
-{
-    if (m_deleted)
-        return String();
-    MutexLocker locker(guidMutex());
-    return guidToVersionMap().get(m_guid).threadsafeCopy();
-}
-
 Vector<String> Database::tableNames()
 {
     // FIXME: Not using threadsafeCopy on these strings looks ok since threads take strict turns
@@ -797,14 +388,6 @@ Vector<String> Database::tableNames()
     return result;
 }
 
-void Database::setExpectedVersion(const String& version)
-{
-    m_expectedVersion = version.threadsafeCopy();
-    // Update the in memory database version map.
-    MutexLocker locker(guidMutex());
-    updateGuidVersionMap(m_guid, version);
-}
-
 SecurityOrigin* Database::securityOrigin() const
 {
     if (m_scriptExecutionContext->isContextThread())
@@ -814,29 +397,6 @@ SecurityOrigin* Database::securityOrigin() const
     return 0;
 }
 
-String Database::stringIdentifier() const
-{
-    // Return a deep copy for ref counting thread safety
-    return m_name.threadsafeCopy();
-}
-
-String Database::displayName() const
-{
-    // Return a deep copy for ref counting thread safety
-    return m_displayName.threadsafeCopy();
-}
-
-unsigned long Database::estimatedSize() const
-{
-    return m_estimatedSize;
-}
-
-String Database::fileName() const
-{
-    // Return a deep copy for ref counting thread safety
-    return m_filename.threadsafeCopy();
-}
-
 void Database::incrementalVacuumIfNeeded()
 {
     int64_t freeSpaceSize = m_sqliteDatabase.freeSpaceSize();
diff --git a/WebCore/storage/Database.h b/WebCore/storage/Database.h
index 495f98f..22ef55e 100644
--- a/WebCore/storage/Database.h
+++ b/WebCore/storage/Database.h
@@ -33,18 +33,13 @@
 #include "AbstractDatabase.h"
 #include "PlatformString.h"
 #include "SQLiteDatabase.h"
-#ifndef NDEBUG
-#include "SecurityOrigin.h"
-#endif
 
 #include <wtf/Deque.h>
 #include <wtf/Forward.h>
 
 namespace WebCore {
 
-class DatabaseAuthorizer;
 class DatabaseCallback;
-class DatabaseThread;
 class ScriptExecutionContext;
 class SecurityOrigin;
 class SQLTransaction;
@@ -54,8 +49,6 @@ class SQLTransactionCoordinator;
 class SQLTransactionErrorCallback;
 class VoidCallback;
 
-typedef int ExceptionCode;
-
 class Database : public AbstractDatabase {
 public:
     virtual ~Database();
@@ -63,113 +56,62 @@ public:
     // Direct support for the DOM API
     static PassRefPtr<Database> openDatabase(ScriptExecutionContext*, const String& name, const String& expectedVersion, const String& displayName,
                                              unsigned long estimatedSize, PassRefPtr<DatabaseCallback>, ExceptionCode&);
-    String version() const;
+    virtual String version() const;
     void changeVersion(const String& oldVersion, const String& newVersion, PassRefPtr<SQLTransactionCallback>,
                        PassRefPtr<SQLTransactionErrorCallback>, PassRefPtr<VoidCallback> successCallback);
     void transaction(PassRefPtr<SQLTransactionCallback>, PassRefPtr<SQLTransactionErrorCallback>,
                      PassRefPtr<VoidCallback> successCallback, bool readOnly);
 
     // Internal engine support
-    static const String& databaseInfoTableName();
-
-    void disableAuthorizer();
-    void enableAuthorizer();
-    void setAuthorizerReadOnly();
-    bool lastActionChangedDatabase();
-    bool lastActionWasInsert();
-    void resetDeletes();
-    bool hadDeletes();
-
     Vector<String> tableNames();
 
-    virtual ScriptExecutionContext* scriptExecutionContext() const { return m_scriptExecutionContext.get(); }
     virtual SecurityOrigin* securityOrigin() const;
     SQLiteDatabase& sqliteDatabase() { return m_sqliteDatabase; }
-    virtual String stringIdentifier() const;
-    virtual String displayName() const;
-    virtual unsigned long estimatedSize() const;
-    virtual String fileName() const;
-
-    bool getVersionFromDatabase(String&);
-    bool setVersionInDatabase(const String&);
-    void setExpectedVersion(const String&);
-    bool versionMatchesExpected() const;
 
     virtual void markAsDeletedAndClose();
     bool deleted() const { return m_deleted; }
 
-    enum ClosePolicy { DoNotRemoveDatabaseFromContext, RemoveDatabaseFromContext };
-    void close(ClosePolicy);
+    void close();
     virtual void closeImmediately();
-    bool opened() const { return m_opened; }
-
-    void stop();
-    bool stopped() const { return m_stopped; }
-
-    bool isNew() const { return m_new; }
 
     unsigned long long databaseSize() const;
     unsigned long long maximumSize() const;
 
-    // Called from DatabaseThread, must be prepared to work on the background thread
-    void resetAuthorizer();
-    void performPolicyChecks();
-
-    bool performOpenAndVerify(ExceptionCode&);
-
-    void inProgressTransactionCompleted();
     void scheduleTransactionCallback(SQLTransaction*);
     void scheduleTransactionStep(SQLTransaction*, bool immediately = false);
 
-    Vector<String> performGetTableNames();
-    void performCreationCallback();
-
     SQLTransactionClient* transactionClient() const;
     SQLTransactionCoordinator* transactionCoordinator() const;
 
     void incrementalVacuumIfNeeded();
 
 private:
+    class DatabaseOpenTask;
+    class DatabaseCloseTask;
+    class DatabaseTransactionTask;
+    class DatabaseTableNamesTask;
+
     Database(ScriptExecutionContext*, const String& name, const String& expectedVersion,
-             const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback>);
+             const String& displayName, unsigned long estimatedSize);
 
-    bool openAndVerifyVersion(ExceptionCode&);
+    bool openAndVerifyVersion(bool setVersionInNewDatabase, ExceptionCode&);
+    virtual bool performOpenAndVerify(bool setVersionInNewDatabase, ExceptionCode&);
 
+    void inProgressTransactionCompleted();
     void scheduleTransaction();
 
+    Vector<String> performGetTableNames();
+
+    static void deliverPendingCallback(void*);
+
     Deque<RefPtr<SQLTransaction> > m_transactionQueue;
     Mutex m_transactionInProgressMutex;
     bool m_transactionInProgress;
     bool m_isTransactionQueueEnabled;
 
-    static void deliverPendingCallback(void*);
-
-    RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
-    RefPtr<SecurityOrigin> m_contextThreadSecurityOrigin;
     RefPtr<SecurityOrigin> m_databaseThreadSecurityOrigin;
-    String m_name;
-    int m_guid;
-    String m_expectedVersion;
-    String m_displayName;
-    unsigned long m_estimatedSize;
-    String m_filename;
 
     bool m_deleted;
-
-    bool m_stopped;
-
-    bool m_opened;
-
-    bool m_new;
-
-    SQLiteDatabase m_sqliteDatabase;
-    RefPtr<DatabaseAuthorizer> m_databaseAuthorizer;
-
-    RefPtr<DatabaseCallback> m_creationCallback;
-
-#ifndef NDEBUG
-    String databaseDebugName() const { return m_contextThreadSecurityOrigin->toString() + "::" + m_name; }
-#endif
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/DatabaseAuthorizer.cpp b/WebCore/storage/DatabaseAuthorizer.cpp
index 1ea99d9..d155d6c 100644
--- a/WebCore/storage/DatabaseAuthorizer.cpp
+++ b/WebCore/storage/DatabaseAuthorizer.cpp
@@ -30,13 +30,19 @@
 #include "DatabaseAuthorizer.h"
 
 #if ENABLE(DATABASE)
-#include "Database.h"
 #include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
 
 namespace WebCore {
 
-DatabaseAuthorizer::DatabaseAuthorizer()
+PassRefPtr<DatabaseAuthorizer> DatabaseAuthorizer::create(const String& databaseInfoTableName)
+{
+    return adoptRef(new DatabaseAuthorizer(databaseInfoTableName));
+}
+
+DatabaseAuthorizer::DatabaseAuthorizer(const String& databaseInfoTableName)
     : m_securityEnabled(false)
+    , m_databaseInfoTableName(databaseInfoTableName)
 {
     reset();
     addWhitelistedFunctions();
@@ -388,7 +394,7 @@ void DatabaseAuthorizer::setReadOnly()
     m_readOnly = true;
 }
 
-int DatabaseAuthorizer::denyBasedOnTableName(const String& tableName)
+int DatabaseAuthorizer::denyBasedOnTableName(const String& tableName) const
 {
     if (!m_securityEnabled)
         return SQLAuthAllow;
@@ -399,7 +405,7 @@ int DatabaseAuthorizer::denyBasedOnTableName(const String& tableName)
     //    equalIgnoringCase(tableName, "sqlite_sequence") || equalIgnoringCase(tableName, Database::databaseInfoTableName()))
     //        return SQLAuthDeny;
 
-    if (equalIgnoringCase(tableName, Database::databaseInfoTableName()))
+    if (equalIgnoringCase(tableName, m_databaseInfoTableName))
         return SQLAuthDeny;
 
     return SQLAuthAllow;
diff --git a/WebCore/storage/DatabaseAuthorizer.h b/WebCore/storage/DatabaseAuthorizer.h
index 7da0143..af6e016 100644
--- a/WebCore/storage/DatabaseAuthorizer.h
+++ b/WebCore/storage/DatabaseAuthorizer.h
@@ -28,10 +28,11 @@
 #ifndef DatabaseAuthorizer_h
 #define DatabaseAuthorizer_h
 
+#include "PlatformString.h"
 #include "StringHash.h"
+#include <wtf/Forward.h>
 #include <wtf/HashSet.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/Threading.h>
+#include <wtf/ThreadSafeShared.h>
 
 namespace WebCore {
 
@@ -43,7 +44,7 @@ extern const int SQLAuthDeny;
 
 class DatabaseAuthorizer : public ThreadSafeShared<DatabaseAuthorizer> {
 public:
-    static PassRefPtr<DatabaseAuthorizer> create() { return adoptRef(new DatabaseAuthorizer); }
+    static PassRefPtr<DatabaseAuthorizer> create(const String& databaseInfoTableName);
 
     int createTable(const String& tableName);
     int createTempTable(const String& tableName);
@@ -97,9 +98,9 @@ public:
     bool hadDeletes() const { return m_hadDeletes; }
 
 private:
-    DatabaseAuthorizer();
+    DatabaseAuthorizer(const String& databaseInfoTableName);
     void addWhitelistedFunctions();
-    int denyBasedOnTableName(const String&);
+    int denyBasedOnTableName(const String&) const;
     int updateDeletesBasedOnTableName(const String&);
 
     bool m_securityEnabled : 1;
@@ -108,6 +109,8 @@ private:
     bool m_readOnly : 1;
     bool m_hadDeletes : 1;
 
+    const String m_databaseInfoTableName;
+
     HashSet<String, CaseFoldingHash> m_whitelistedFunctions;
 };
 
diff --git a/WebCore/storage/DatabaseSync.cpp b/WebCore/storage/DatabaseSync.cpp
index 0d3bed5..8de9680 100644
--- a/WebCore/storage/DatabaseSync.cpp
+++ b/WebCore/storage/DatabaseSync.cpp
@@ -31,52 +31,60 @@
 
 #if ENABLE(DATABASE)
 #include "DatabaseCallback.h"
+#include "DatabaseTracker.h"
 #include "ExceptionCode.h"
+#include "Logging.h"
 #include "SQLTransactionSyncCallback.h"
 #include "ScriptExecutionContext.h"
+#include "SecurityOrigin.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
-#include <wtf/StdLibExtras.h>
 
 namespace WebCore {
 
-const String& DatabaseSync::databaseInfoTableName()
+PassRefPtr<DatabaseSync> DatabaseSync::openDatabaseSync(ScriptExecutionContext* context, const String& name, const String& expectedVersion, const String& displayName,
+                                                        unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback, ExceptionCode& ec)
 {
-    DEFINE_STATIC_LOCAL(String, name, ("__WebKitDatabaseInfoTable__"));
-    return name;
-}
+    ASSERT(context->isContextThread());
 
-PassRefPtr<DatabaseSync> DatabaseSync::openDatabaseSync(ScriptExecutionContext*, const String&, const String&, const String&,
-                                                        unsigned long, PassRefPtr<DatabaseCallback>, ExceptionCode& ec)
-{
-    // FIXME: uncomment the assert once we use the ScriptExecutionContext* parameter
-    //ASSERT(context->isContextThread());
+    if (!DatabaseTracker::tracker().canEstablishDatabase(context, name, displayName, estimatedSize)) {
+        LOG(StorageAPI, "Database %s for origin %s not allowed to be established", name.ascii().data(), context->securityOrigin()->toString().ascii().data());
+        return 0;
+    }
+
+    RefPtr<DatabaseSync> database = adoptRef(new DatabaseSync(context, name, expectedVersion, displayName, estimatedSize));
+
+    if (!database->performOpenAndVerify(!creationCallback, ec)) {
+        LOG(StorageAPI, "Failed to open and verify version (expected %s) of database %s", expectedVersion.ascii().data(), database->databaseDebugName().ascii().data());
+        DatabaseTracker::tracker().removeOpenDatabase(database.get());
+        return 0;
+    }
+
+    DatabaseTracker::tracker().setDatabaseDetails(context->securityOrigin(), name, displayName, estimatedSize);
 
-    ec = SECURITY_ERR;
-    return 0;
+    if (database->isNew() && creationCallback.get()) {
+        database->m_expectedVersion = "";
+        LOG(StorageAPI, "Invoking the creation callback for database %p\n", database.get());
+        creationCallback->handleEvent(context, database.get());
+    }
+
+    return database;
 }
 
 DatabaseSync::DatabaseSync(ScriptExecutionContext* context, const String& name, const String& expectedVersion,
-                           const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback> creationCallback)
-    : m_scriptExecutionContext(context)
-    , m_name(name.crossThreadString())
-    , m_expectedVersion(expectedVersion.crossThreadString())
-    , m_displayName(displayName.crossThreadString())
-    , m_estimatedSize(estimatedSize)
-    , m_creationCallback(creationCallback)
+                           const String& displayName, unsigned long estimatedSize)
+    : AbstractDatabase(context, name, expectedVersion, displayName, estimatedSize)
 {
-    ASSERT(context->isContextThread());
 }
 
 DatabaseSync::~DatabaseSync()
 {
     ASSERT(m_scriptExecutionContext->isContextThread());
-}
 
-String DatabaseSync::version() const
-{
-    ASSERT(m_scriptExecutionContext->isContextThread());
-    return String();
+    if (opened()) {
+        DatabaseTracker::tracker().removeOpenDatabase(this);
+        closeDatabase();
+    }
 }
 
 void DatabaseSync::changeVersion(const String&, const String&, PassRefPtr<SQLTransactionSyncCallback>, ExceptionCode&)
@@ -89,10 +97,45 @@ void DatabaseSync::transaction(PassRefPtr<SQLTransactionSyncCallback>, bool, Exc
     ASSERT(m_scriptExecutionContext->isContextThread());
 }
 
-ScriptExecutionContext* DatabaseSync::scriptExecutionContext() const
+void DatabaseSync::markAsDeletedAndClose()
 {
-    ASSERT(m_scriptExecutionContext->isContextThread());
-    return m_scriptExecutionContext.get();
+    // FIXME: need to do something similar to closeImmediately(), but in a sync way
+}
+
+class CloseSyncDatabaseOnContextThreadTask : public ScriptExecutionContext::Task {
+public:
+    static PassOwnPtr<CloseSyncDatabaseOnContextThreadTask> create(PassRefPtr<DatabaseSync> database)
+    {
+        return new CloseSyncDatabaseOnContextThreadTask(database);
+    }
+
+    virtual void performTask(ScriptExecutionContext*)
+    {
+        m_database->closeImmediately();
+    }
+
+private:
+    CloseSyncDatabaseOnContextThreadTask(PassRefPtr<DatabaseSync> database)
+        : m_database(database)
+    {
+    }
+
+    RefPtr<DatabaseSync> m_database;
+};
+
+void DatabaseSync::closeImmediately()
+{
+    if (!m_scriptExecutionContext->isContextThread()) {
+        m_scriptExecutionContext->postTask(CloseSyncDatabaseOnContextThreadTask::create(this));
+        return;
+    }
+
+    if (!opened())
+        return;
+
+    DatabaseTracker::tracker().removeOpenDatabase(this);
+
+    closeDatabase();
 }
 
 } // namespace WebCore
diff --git a/WebCore/storage/DatabaseSync.h b/WebCore/storage/DatabaseSync.h
index 321b620..96b4f7d 100644
--- a/WebCore/storage/DatabaseSync.h
+++ b/WebCore/storage/DatabaseSync.h
@@ -30,48 +30,36 @@
 #define DatabaseSync_h
 
 #if ENABLE(DATABASE)
+#include "AbstractDatabase.h"
 #include "PlatformString.h"
 #include <wtf/Forward.h>
+#ifndef NDEBUG
+#include "SecurityOrigin.h"
+#endif
 
 namespace WebCore {
 
 class DatabaseCallback;
 class SQLTransactionSyncCallback;
 class ScriptExecutionContext;
-
-typedef int ExceptionCode;
+class SecurityOrigin;
 
 // Instances of this class should be created and used only on the worker's context thread.
-class DatabaseSync : public RefCounted<DatabaseSync> {
+class DatabaseSync : public AbstractDatabase {
 public:
-    ~DatabaseSync();
+    virtual ~DatabaseSync();
 
-    // Direct support for the DOM API
     static PassRefPtr<DatabaseSync> openDatabaseSync(ScriptExecutionContext*, const String& name, const String& expectedVersion,
                                                      const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback>, ExceptionCode&);
-    String version() const;
     void changeVersion(const String& oldVersion, const String& newVersion, PassRefPtr<SQLTransactionSyncCallback>, ExceptionCode&);
     void transaction(PassRefPtr<SQLTransactionSyncCallback>, bool readOnly, ExceptionCode&);
 
-    // Internal engine support
-    ScriptExecutionContext* scriptExecutionContext() const;
-
-    static const String& databaseInfoTableName();
+    virtual void markAsDeletedAndClose();
+    virtual void closeImmediately();
 
 private:
     DatabaseSync(ScriptExecutionContext*, const String& name, const String& expectedVersion,
-                 const String& displayName, unsigned long estimatedSize, PassRefPtr<DatabaseCallback>);
-
-    RefPtr<ScriptExecutionContext> m_scriptExecutionContext;
-    String m_name;
-    String m_expectedVersion;
-    String m_displayName;
-    unsigned long m_estimatedSize;
-    RefPtr<DatabaseCallback> m_creationCallback;
-
-#ifndef NDEBUG
-    String databaseDebugName() const { return String(); }
-#endif
+                 const String& displayName, unsigned long estimatedSize);
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/DatabaseTask.cpp b/WebCore/storage/DatabaseTask.cpp
index 8d5f0a8..3526d9d 100644
--- a/WebCore/storage/DatabaseTask.cpp
+++ b/WebCore/storage/DatabaseTask.cpp
@@ -78,7 +78,6 @@ void DatabaseTask::performTask()
 
     m_database->resetAuthorizer();
     doPerformTask();
-    m_database->performPolicyChecks();
 
     if (m_synchronizer)
         m_synchronizer->taskCompleted();
@@ -87,21 +86,22 @@ void DatabaseTask::performTask()
 // *** DatabaseOpenTask ***
 // Opens the database file and verifies the version matches the expected version.
 
-DatabaseOpenTask::DatabaseOpenTask(Database* database, DatabaseTaskSynchronizer* synchronizer, ExceptionCode& code, bool& success)
+Database::DatabaseOpenTask::DatabaseOpenTask(Database* database, bool setVersionInNewDatabase, DatabaseTaskSynchronizer* synchronizer, ExceptionCode& code, bool& success)
     : DatabaseTask(database, synchronizer)
+    , m_setVersionInNewDatabase(setVersionInNewDatabase)
     , m_code(code)
     , m_success(success)
 {
     ASSERT(synchronizer); // A task with output parameters is supposed to be synchronous.
 }
 
-void DatabaseOpenTask::doPerformTask()
+void Database::DatabaseOpenTask::doPerformTask()
 {
-    m_success = database()->performOpenAndVerify(m_code);
+    m_success = database()->performOpenAndVerify(m_setVersionInNewDatabase, m_code);
 }
 
 #ifndef NDEBUG
-const char* DatabaseOpenTask::debugTaskName() const
+const char* Database::DatabaseOpenTask::debugTaskName() const
 {
     return "DatabaseOpenTask";
 }
@@ -110,19 +110,18 @@ const char* DatabaseOpenTask::debugTaskName() const
 // *** DatabaseCloseTask ***
 // Closes the database.
 
-DatabaseCloseTask::DatabaseCloseTask(Database* database, Database::ClosePolicy closePolicy, DatabaseTaskSynchronizer* synchronizer)
+Database::DatabaseCloseTask::DatabaseCloseTask(Database* database, DatabaseTaskSynchronizer* synchronizer)
     : DatabaseTask(database, synchronizer)
-    , m_closePolicy(closePolicy)
 {
 }
 
-void DatabaseCloseTask::doPerformTask()
+void Database::DatabaseCloseTask::doPerformTask()
 {
-    database()->close(m_closePolicy);
+    database()->close();
 }
 
 #ifndef NDEBUG
-const char* DatabaseCloseTask::debugTaskName() const
+const char* Database::DatabaseCloseTask::debugTaskName() const
 {
     return "DatabaseCloseTask";
 }
@@ -131,24 +130,20 @@ const char* DatabaseCloseTask::debugTaskName() const
 // *** DatabaseTransactionTask ***
 // Starts a transaction that will report its results via a callback.
 
-DatabaseTransactionTask::DatabaseTransactionTask(PassRefPtr<SQLTransaction> transaction)
+Database::DatabaseTransactionTask::DatabaseTransactionTask(PassRefPtr<SQLTransaction> transaction)
     : DatabaseTask(transaction->database(), 0)
     , m_transaction(transaction)
 {
 }
 
-DatabaseTransactionTask::~DatabaseTransactionTask()
-{
-}
-
-void DatabaseTransactionTask::doPerformTask()
+void Database::DatabaseTransactionTask::doPerformTask()
 {
     if (m_transaction->performNextStep())
         m_transaction->database()->inProgressTransactionCompleted();
 }
 
 #ifndef NDEBUG
-const char* DatabaseTransactionTask::debugTaskName() const
+const char* Database::DatabaseTransactionTask::debugTaskName() const
 {
     return "DatabaseTransactionTask";
 }
@@ -157,20 +152,20 @@ const char* DatabaseTransactionTask::debugTaskName() const
 // *** DatabaseTableNamesTask ***
 // Retrieves a list of all tables in the database - for WebInspector support.
 
-DatabaseTableNamesTask::DatabaseTableNamesTask(Database* database, DatabaseTaskSynchronizer* synchronizer, Vector<String>& names)
+Database::DatabaseTableNamesTask::DatabaseTableNamesTask(Database* database, DatabaseTaskSynchronizer* synchronizer, Vector<String>& names)
     : DatabaseTask(database, synchronizer)
     , m_tableNames(names)
 {
     ASSERT(synchronizer); // A task with output parameters is supposed to be synchronous.
 }
 
-void DatabaseTableNamesTask::doPerformTask()
+void Database::DatabaseTableNamesTask::doPerformTask()
 {
     m_tableNames = database()->performGetTableNames();
 }
 
 #ifndef NDEBUG
-const char* DatabaseTableNamesTask::debugTaskName() const
+const char* Database::DatabaseTableNamesTask::debugTaskName() const
 {
     return "DatabaseTableNamesTask";
 }
diff --git a/WebCore/storage/DatabaseTask.h b/WebCore/storage/DatabaseTask.h
index 1a820a5..9673a26 100644
--- a/WebCore/storage/DatabaseTask.h
+++ b/WebCore/storage/DatabaseTask.h
@@ -60,7 +60,6 @@ private:
 };
 
 class DatabaseTask : public Noncopyable {
-    friend class Database;
 public:
     virtual ~DatabaseTask();
 
@@ -83,44 +82,43 @@ private:
 #endif
 };
 
-class DatabaseOpenTask : public DatabaseTask {
+class Database::DatabaseOpenTask : public DatabaseTask {
 public:
-    static PassOwnPtr<DatabaseOpenTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer, ExceptionCode& code, bool& success)
+    static PassOwnPtr<DatabaseOpenTask> create(Database* db, bool setVersionInNewDatabase, DatabaseTaskSynchronizer* synchronizer, ExceptionCode& code, bool& success)
     {
-        return new DatabaseOpenTask(db, synchronizer, code, success);
+        return new DatabaseOpenTask(db, setVersionInNewDatabase, synchronizer, code, success);
     }
 
 private:
-    DatabaseOpenTask(Database*, DatabaseTaskSynchronizer*, ExceptionCode&, bool& success);
+    DatabaseOpenTask(Database*, bool setVersionInNewDatabase, DatabaseTaskSynchronizer*, ExceptionCode&, bool& success);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
     virtual const char* debugTaskName() const;
 #endif
 
+    bool m_setVersionInNewDatabase;
     ExceptionCode& m_code;
     bool& m_success;
 };
 
-class DatabaseCloseTask : public DatabaseTask {
+class Database::DatabaseCloseTask : public DatabaseTask {
 public:
-    static PassOwnPtr<DatabaseCloseTask> create(Database* db, Database::ClosePolicy closePolicy, DatabaseTaskSynchronizer* synchronizer)
-    { 
-        return new DatabaseCloseTask(db, closePolicy, synchronizer);
+    static PassOwnPtr<DatabaseCloseTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer)
+    {
+        return new DatabaseCloseTask(db, synchronizer);
     }
 
 private:
-    DatabaseCloseTask(Database*, Database::ClosePolicy, DatabaseTaskSynchronizer*);
+    DatabaseCloseTask(Database*, DatabaseTaskSynchronizer*);
 
     virtual void doPerformTask();
 #ifndef NDEBUG
     virtual const char* debugTaskName() const;
 #endif
-
-    Database::ClosePolicy m_closePolicy;
 };
 
-class DatabaseTransactionTask : public DatabaseTask {
+class Database::DatabaseTransactionTask : public DatabaseTask {
 public:
     // Transaction task is never synchronous, so no 'synchronizer' parameter.
     static PassOwnPtr<DatabaseTransactionTask> create(PassRefPtr<SQLTransaction> transaction)
@@ -130,7 +128,6 @@ public:
 
     SQLTransaction* transaction() const { return m_transaction.get(); }
 
-    virtual ~DatabaseTransactionTask();
 private:
     DatabaseTransactionTask(PassRefPtr<SQLTransaction>);
 
@@ -142,7 +139,7 @@ private:
     RefPtr<SQLTransaction> m_transaction;
 };
 
-class DatabaseTableNamesTask : public DatabaseTask {
+class Database::DatabaseTableNamesTask : public DatabaseTask {
 public:
     static PassOwnPtr<DatabaseTableNamesTask> create(Database* db, DatabaseTaskSynchronizer* synchronizer, Vector<String>& names)
     {
diff --git a/WebCore/storage/DatabaseThread.cpp b/WebCore/storage/DatabaseThread.cpp
index ec6241c..ae2a6c0 100644
--- a/WebCore/storage/DatabaseThread.cpp
+++ b/WebCore/storage/DatabaseThread.cpp
@@ -113,14 +113,14 @@ void* DatabaseThread::databaseThread()
         openSetCopy.swap(m_openDatabaseSet);
         DatabaseSet::iterator end = openSetCopy.end();
         for (DatabaseSet::iterator it = openSetCopy.begin(); it != end; ++it)
-           (*it)->close(Database::RemoveDatabaseFromContext);
+            (*it)->close();
     }
 
     // Detach the thread so its resources are no longer of any concern to anyone else
     detachThread(m_threadID);
 
     DatabaseTaskSynchronizer* cleanupSync = m_cleanupSync;
-    
+
     // Clear the self refptr, possibly resulting in deletion
     m_selfRef = 0;
 
diff --git a/WebCore/storage/DatabaseTracker.cpp b/WebCore/storage/DatabaseTracker.cpp
index cf56ff6..8d23a4f 100644
--- a/WebCore/storage/DatabaseTracker.cpp
+++ b/WebCore/storage/DatabaseTracker.cpp
@@ -506,6 +506,12 @@ void DatabaseTracker::addOpenDatabase(AbstractDatabase* database)
         databaseSet->add(database);
 
         LOG(StorageAPI, "Added open Database %s (%p)\n", database->stringIdentifier().ascii().data(), database);
+
+        Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
+        if (!originQuotaManager().tracksOrigin(database->securityOrigin())) {
+            originQuotaManager().trackOrigin(database->securityOrigin());
+            originQuotaManager().addDatabase(database->securityOrigin(), database->stringIdentifier(), database->fileName());
+        }
     }
 
     MutexLocker lockDatabase(m_databaseGuard);
@@ -553,10 +559,10 @@ void DatabaseTracker::removeOpenDatabase(AbstractDatabase* database)
 
         m_openDatabaseMap->remove(database->securityOrigin());
         delete nameMap;
-    }
 
-    Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
-    originQuotaManager().removeOrigin(database->securityOrigin());
+        Locker<OriginQuotaManager> quotaManagerLocker(originQuotaManager());
+        originQuotaManager().removeOrigin(database->securityOrigin());
+    }
 }
 
 void DatabaseTracker::getOpenDatabases(SecurityOrigin* origin, const String& name, HashSet<RefPtr<AbstractDatabase> >* databases)
diff --git a/WebCore/storage/DatabaseTracker.h b/WebCore/storage/DatabaseTracker.h
index b1267bc..094ee66 100644
--- a/WebCore/storage/DatabaseTracker.h
+++ b/WebCore/storage/DatabaseTracker.h
@@ -63,7 +63,8 @@ public:
     // This singleton will potentially be used from multiple worker threads and the page's context thread simultaneously.  To keep this safe, it's
     // currently using 4 locks.  In order to avoid deadlock when taking multiple locks, you must take them in the correct order:
     // m_databaseGuard before quotaManager if both locks are needed.
-    // no other lock is taken in the code locked on m_openDatabaseMapGuard.
+    // m_openDatabaseMapGuard before quotaManager if both locks are needed.
+    // m_databaseGuard and m_openDatabaseMapGuard currently don't overlap.
     // notificationMutex() is currently independent of the other locks.
 
     bool canEstablishDatabase(ScriptExecutionContext*, const String& name, const String& displayName, unsigned long estimatedSize);
diff --git a/WebCore/storage/IDBCallbacks.h b/WebCore/storage/IDBCallbacks.h
index c90acc5..37fdc46 100644
--- a/WebCore/storage/IDBCallbacks.h
+++ b/WebCore/storage/IDBCallbacks.h
@@ -32,6 +32,7 @@
 #include "IDBDatabase.h"
 #include "IDBDatabaseError.h"
 #include "IDBIndex.h"
+#include "IDBKey.h"
 #include "IDBObjectStore.h"
 #include "SerializedScriptValue.h"
 #include <wtf/RefCounted.h>
@@ -48,6 +49,7 @@ public:
     virtual void onSuccess() = 0; // For "null".
     virtual void onSuccess(PassRefPtr<IDBDatabase>) = 0;
     virtual void onSuccess(PassRefPtr<IDBIndex>) = 0;
+    virtual void onSuccess(PassRefPtr<IDBKey>) = 0;
     virtual void onSuccess(PassRefPtr<IDBObjectStore>) = 0;
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>) = 0;
 };
diff --git a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp b/WebCore/storage/IDBKey.cpp
index 60ea45e..36a83a6 100644
--- a/WebCore/bindings/js/JSHTMLIFrameElementCustom.cpp
+++ b/WebCore/storage/IDBKey.cpp
@@ -1,18 +1,15 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
+ *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
+ *     documentation and/or other materials provided with the distribution.
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -27,33 +24,39 @@
  */
 
 #include "config.h"
-#include "JSHTMLIFrameElement.h"
+#include "IDBKey.h"
 
-#include "CSSHelper.h"
-#include "Document.h"
-#include "HTMLIFrameElement.h"
-#include "HTMLNames.h"
-#include "JSDOMBinding.h"
+#include "SerializedScriptValue.h"
 
-using namespace JSC;
+#if ENABLE(INDEXED_DATABASE)
 
 namespace WebCore {
 
-using namespace HTMLNames;
+IDBKey::IDBKey()
+    : m_type(NullType)
+{
+}
 
-void JSHTMLIFrameElement::setSrc(ExecState* exec, JSValue value)
+IDBKey::~IDBKey()
 {
-    HTMLIFrameElement* imp = static_cast<HTMLIFrameElement*>(impl());
+}
 
-    String srcValue = valueToStringWithNullCheck(exec, value);
+IDBKey::IDBKey(int32_t number)
+    : m_type(NumberType)
+    , m_number(number)
+{
+}
 
-    if (protocolIsJavaScript(deprecatedParseURL(srcValue))) {
-        Document* contentDocument = imp->contentDocument();
-        if (contentDocument && !checkNodeSecurity(exec, contentDocument))
-            return;
-    }
+IDBKey::IDBKey(const String& string)
+    : m_type(StringType)
+    , m_string(string)
+{
+}
 
-    imp->setAttribute(srcAttr, srcValue);
+IDBKey::~IDBKey()
+{
 }
 
 } // namespace WebCore
+
+#endif
diff --git a/WebCore/storage/IDBKey.h b/WebCore/storage/IDBKey.h
new file mode 100644
index 0000000..0cd205b
--- /dev/null
+++ b/WebCore/storage/IDBKey.h
@@ -0,0 +1,90 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBKey_h
+#define IDBKey_h
+
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+// FIXME: Add dates.
+class IDBKey : public RefCounted<IDBKey> {
+public:
+    static PassRefPtr<IDBKey> create()
+    {
+        return adoptRef(new IDBKey());
+    }
+    static PassRefPtr<IDBKey> create(int32_t number)
+    {
+        return adoptRef(new IDBKey(number));
+    }
+    static PassRefPtr<IDBKey> create(const String& string)
+    {
+        return adoptRef(new IDBKey(string));
+    }
+    ~IDBKey() { }
+
+    // In order of the least to the most precident in terms of sort order.
+    enum Type {
+        NullType = 0,
+        StringType,
+        NumberType
+    };
+
+    Type type() const { return m_type; }
+
+    const String& string() const
+    {
+        ASSERT(m_type == StringType);
+        return m_string;
+    }
+
+    int32_t number() const
+    {
+        ASSERT(m_type == NumberType);
+        return m_number;
+    }
+
+private:
+    IDBKey();
+    explicit IDBKey(int32_t);
+    explicit IDBKey(const String&);
+
+    Type m_type;
+    String m_string;
+    int32_t m_number;
+};
+
+}
+
+#endif // ENABLE(INDEXED_DATABASE)
+
+#endif // IDBKey_h
diff --git a/WebCore/storage/IDBKey.idl b/WebCore/storage/IDBKey.idl
new file mode 100644
index 0000000..04995f3
--- /dev/null
+++ b/WebCore/storage/IDBKey.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module storage {
+
+    interface [
+        Conditional=INDEXED_DATABASE,
+        CustomToJS
+    ] IDBKey {
+        // This space is intentionally left blank.
+    };
+}
diff --git a/WebCore/storage/IDBKeyTree.h b/WebCore/storage/IDBKeyTree.h
new file mode 100644
index 0000000..0e39e77
--- /dev/null
+++ b/WebCore/storage/IDBKeyTree.h
@@ -0,0 +1,157 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBKeyTree_h
+#define IDBKeyTree_h
+
+#include "IDBKey.h"
+#include <wtf/AVLTree.h>
+#include <wtf/Vector.h>
+
+#if ENABLE(INDEXED_DATABASE)
+
+namespace WebCore {
+
+template <typename ValueType>
+class IDBKeyTree : public RefCounted<IDBKeyTree<ValueType> > {
+public:
+    static PassRefPtr<IDBKeyTree> create()
+    {
+        return adoptRef(new IDBKeyTree());
+    }
+    ~IDBKeyTree();
+
+    PassRefPtr<ValueType> get(PassRefPtr<IDBKey> key);
+    void put(PassRefPtr<IDBKey> key, PassRefPtr<ValueType> value);
+    void remove(PassRefPtr<IDBKey> key);
+
+private:
+    struct TreeNode {
+        RefPtr<ValueType> value;
+        RefPtr<IDBKey> key;
+
+        TreeNode* less;
+        TreeNode* greater;
+        int balanceFactor;
+    };
+
+    struct AVLTreeAbstractor {
+        typedef TreeNode* handle;
+        typedef size_t size;
+        typedef IDBKey* key;
+
+        handle get_less(handle h) { return h->less; }
+        void set_less(handle h, handle lh) { h->less = lh; }
+        handle get_greater(handle h) { return h->greater; }
+        void set_greater(handle h, handle gh) { h->greater = gh; }
+        int get_balance_factor(handle h) { return h->balanceFactor; }
+        void set_balance_factor(handle h, int bf) { h->balanceFactor = bf; }
+
+        static handle null() { return 0; }
+
+        int compare_key_key(key va, key vb);
+        int compare_key_node(key k, handle h) { return compare_key_key(k, h->key.get()); }
+        int compare_node_node(handle h1, handle h2) { return compare_key_key(h1->key.get(), h2->key.get()); }
+    };
+
+    IDBKeyTree();
+
+    typedef WTF::AVLTree<AVLTreeAbstractor> TreeType;
+    TreeType m_tree;
+};
+
+template <typename ValueType>
+IDBKeyTree<ValueType>::IDBKeyTree()
+{
+}
+
+template <typename ValueType>
+IDBKeyTree<ValueType>::~IDBKeyTree()
+{
+    typename TreeType::Iterator iter;
+    iter.start_iter_least(m_tree);
+    for (; *iter; ++iter)
+        delete *iter;
+    m_tree.purge();
+}
+
+template <typename ValueType>
+int IDBKeyTree<ValueType>::AVLTreeAbstractor::compare_key_key(key va, key vb)
+{
+    if (va->type() != vb->type())
+        return vb->type() - va->type();
+
+    switch (va->type()) {
+    case IDBKey::NullType:
+        return 0;
+    case IDBKey::NumberType:
+        return vb->number() - va->number();
+    case IDBKey::StringType:
+        return codePointCompare(va->string(), vb->string());
+    // FIXME: Handle dates.  Oh, and test this thoroughly.
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+template <typename ValueType>
+PassRefPtr<ValueType> IDBKeyTree<ValueType>::get(PassRefPtr<IDBKey> prpKey)
+{
+    RefPtr<IDBKey> key = prpKey;
+    TreeNode* node = m_tree.search(key.get());
+    if (!node)
+        return 0;
+    return node->value;
+}
+
+
+template <typename ValueType>
+void IDBKeyTree<ValueType>::put(PassRefPtr<IDBKey> prpKey, PassRefPtr<ValueType> value)
+{
+    RefPtr<IDBKey> key = prpKey;
+    TreeNode* node = m_tree.search(key.get());
+    if (!node) {
+        node = new TreeNode();
+        node->key = key.release();
+        m_tree.insert(node);
+    }
+    node->value = value;
+}
+
+template <typename ValueType>
+void IDBKeyTree<ValueType>::remove(PassRefPtr<IDBKey> prpKey)
+{
+    RefPtr<IDBKey> key = prpKey;
+    TreeNode* node = m_tree.remove(key.get());
+    if (node)
+        delete node;
+}
+
+}
+
+#endif // ENABLE(INDEXED_DATABASE)
+
+#endif // IDBKeyTree_h
diff --git a/WebCore/storage/IDBRequest.cpp b/WebCore/storage/IDBRequest.cpp
index f0ba25b..7ec8ee6 100644
--- a/WebCore/storage/IDBRequest.cpp
+++ b/WebCore/storage/IDBRequest.cpp
@@ -85,6 +85,11 @@ void IDBRequest::onSuccess(PassRefPtr<IDBIndex> idbIndex)
     m_result->set(IDBIndexRequest::create(idbIndex));
 }
 
+void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
+{
+    ASSERT_NOT_REACHED();
+}
+
 void IDBRequest::onSuccess(PassRefPtr<IDBObjectStore> idbObjectStore)
 {
     onEventCommon();
diff --git a/WebCore/storage/IDBRequest.h b/WebCore/storage/IDBRequest.h
index 4fb4eed..c763d96 100644
--- a/WebCore/storage/IDBRequest.h
+++ b/WebCore/storage/IDBRequest.h
@@ -66,6 +66,7 @@ public:
     virtual void onSuccess(); // For "null".
     virtual void onSuccess(PassRefPtr<IDBDatabase>);
     virtual void onSuccess(PassRefPtr<IDBIndex>);
+    virtual void onSuccess(PassRefPtr<IDBKey>);
     virtual void onSuccess(PassRefPtr<IDBObjectStore>);
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
 
diff --git a/WebCore/storage/SQLTransaction.cpp b/WebCore/storage/SQLTransaction.cpp
index 5a1e2b0..960427b 100644
--- a/WebCore/storage/SQLTransaction.cpp
+++ b/WebCore/storage/SQLTransaction.cpp
@@ -89,7 +89,7 @@ SQLTransaction::~SQLTransaction()
 
 void SQLTransaction::executeSQL(const String& sqlStatement, const Vector<SQLValue>& arguments, PassRefPtr<SQLStatementCallback> callback, PassRefPtr<SQLStatementErrorCallback> callbackError, ExceptionCode& e)
 {
-    if (!m_executeSqlAllowed || m_database->stopped()) {
+    if (!m_executeSqlAllowed || !m_database->opened()) {
         e = INVALID_STATE_ERR;
         return;
     }
@@ -149,7 +149,7 @@ const char* SQLTransaction::debugStepName(SQLTransaction::TransactionStepMethod
 
 void SQLTransaction::checkAndHandleClosedDatabase()
 {
-    if (!m_database->stopped())
+    if (m_database->opened())
         return;
 
     // If the database was stopped, don't do anything and cancel queued work
diff --git a/WebCore/svg/SVGAllInOne.cpp b/WebCore/svg/SVGAllInOne.cpp
index e9008dc..c1bf281 100644
--- a/WebCore/svg/SVGAllInOne.cpp
+++ b/WebCore/svg/SVGAllInOne.cpp
@@ -54,6 +54,7 @@
 #include "SVGFEColorMatrixElement.cpp"
 #include "SVGFEComponentTransferElement.cpp"
 #include "SVGFECompositeElement.cpp"
+#include "SVGFEConvolveMatrixElement.cpp"
 #include "SVGFEDiffuseLightingElement.cpp"
 #include "SVGFEDisplacementMapElement.cpp"
 #include "SVGFEDistantLightElement.cpp"
diff --git a/WebCore/svg/SVGCircleElement.cpp b/WebCore/svg/SVGCircleElement.cpp
index 135a96f..c90b8e3 100644
--- a/WebCore/svg/SVGCircleElement.cpp
+++ b/WebCore/svg/SVGCircleElement.cpp
@@ -71,6 +71,13 @@ void SVGCircleElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
+    bool isLengthAttribute = attrName == SVGNames::cxAttr
+                          || attrName == SVGNames::cyAttr
+                          || attrName == SVGNames::rAttr;
+
+    if (isLengthAttribute)
+        updateRelativeLengthsInformation();
+
     RenderPath* renderer = static_cast<RenderPath*>(this->renderer());
     if (!renderer)
         return;
@@ -81,9 +88,7 @@ void SVGCircleElement::svgAttributeChanged(const QualifiedName& attrName)
         return;
     }
 
-    if (attrName == SVGNames::cxAttr
-        || attrName == SVGNames::cyAttr
-        || attrName == SVGNames::rAttr) {
+    if (isLengthAttribute) {
         renderer->setNeedsPathUpdate();
         renderer->setNeedsLayout(true);
         return;
@@ -122,9 +127,11 @@ Path SVGCircleElement::toPathData() const
     return Path::createCircle(FloatPoint(cx().value(this), cy().value(this)), r().value(this));
 }
 
-bool SVGCircleElement::hasRelativeValues() const
+bool SVGCircleElement::selfHasRelativeLengths() const
 {
-    return (cx().isRelative() || cy().isRelative() || r().isRelative());
+    return cx().isRelative()
+        || cy().isRelative()
+        || r().isRelative();
 }
  
 }
diff --git a/WebCore/svg/SVGCircleElement.h b/WebCore/svg/SVGCircleElement.h
index eb2714c..0ffb934 100644
--- a/WebCore/svg/SVGCircleElement.h
+++ b/WebCore/svg/SVGCircleElement.h
@@ -45,10 +45,9 @@ namespace WebCore {
 
         virtual Path toPathData() const;
 
-    protected:
-        virtual bool hasRelativeValues() const;
-
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGCircleElement, SVGNames::cxAttr, SVGLength, Cx, cx)
         DECLARE_ANIMATED_PROPERTY(SVGCircleElement, SVGNames::cyAttr, SVGLength, Cy, cy)
         DECLARE_ANIMATED_PROPERTY(SVGCircleElement, SVGNames::rAttr, SVGLength, R, r)
diff --git a/WebCore/svg/SVGDocumentExtensions.cpp b/WebCore/svg/SVGDocumentExtensions.cpp
index 7b285eb..fc31551 100644
--- a/WebCore/svg/SVGDocumentExtensions.cpp
+++ b/WebCore/svg/SVGDocumentExtensions.cpp
@@ -37,7 +37,7 @@
 #include "SVGSMILElement.h"
 #include "SVGSVGElement.h"
 #include "SMILTimeContainer.h"
-#include "XMLDocumentParser.h"
+#include "ScriptableDocumentParser.h"
 #include "ScriptController.h"
 
 namespace WebCore {
@@ -125,16 +125,29 @@ bool SVGDocumentExtensions::sampleAnimationAtTime(const String& elementId, SVGSM
     return true;
 }
 
+// FIXME: Callers should probably use ScriptController::eventHandlerLineNumber()
+static int parserLineNumber(Document* document)
+{
+    ScriptableDocumentParser* parser = document->scriptableDocumentParser();
+    if (!parser)
+        return 1;
+    return parser->lineNumber();
+}
+
+static void reportMessage(Document* document, MessageLevel level, const String& message)
+{
+    if (Frame* frame = document->frame())
+        frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, level, message, parserLineNumber(document), String());
+}
+
 void SVGDocumentExtensions::reportWarning(const String& message)
 {
-    if (Frame* frame = m_doc->frame())
-        frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Warning: " + message, m_doc->parser() ? m_doc->parser()->lineNumber() : 1, String());
+    reportMessage(m_doc, WarningMessageLevel, "Warning: " + message);
 }
 
 void SVGDocumentExtensions::reportError(const String& message)
 {
-    if (Frame* frame = m_doc->frame())
-        frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Error: " + message, m_doc->parser() ? m_doc->parser()->lineNumber() : 1, String());
+    reportMessage(m_doc, ErrorMessageLevel, "Error: " + message);
 }
 
 void SVGDocumentExtensions::addPendingResource(const AtomicString& id, SVGStyledElement* obj)
diff --git a/WebCore/svg/SVGElement.cpp b/WebCore/svg/SVGElement.cpp
index 293e4d6..b262e45 100644
--- a/WebCore/svg/SVGElement.cpp
+++ b/WebCore/svg/SVGElement.cpp
@@ -301,6 +301,15 @@ void SVGElement::attributeChanged(Attribute* attr, bool preserveDecls)
         return;
 
     StyledElement::attributeChanged(attr, preserveDecls);
+
+    // When an animated SVG property changes through SVG DOM, svgAttributeChanged() is called, not attributeChanged().
+    // Next time someone tries to access the XML attributes, the synchronization code starts. During that synchronization
+    // SVGAnimatedPropertySynchronizer may call NamedNodeMap::removeAttribute(), which in turn calls attributeChanged().
+    // At this point we're not allowed to call svgAttributeChanged() again - it may lead to extra work being done, or crashes
+    // see bug https://bugs.webkit.org/show_bug.cgi?id=40994.
+    if (isSynchronizingSVGAttributes())
+        return;
+
     svgAttributeChanged(attr->name());
 }
 
diff --git a/WebCore/svg/SVGEllipseElement.cpp b/WebCore/svg/SVGEllipseElement.cpp
index d811b56..5509c2d 100644
--- a/WebCore/svg/SVGEllipseElement.cpp
+++ b/WebCore/svg/SVGEllipseElement.cpp
@@ -76,6 +76,14 @@ void SVGEllipseElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
+    bool isLengthAttribute = attrName == SVGNames::cxAttr
+                          || attrName == SVGNames::cyAttr
+                          || attrName == SVGNames::rxAttr
+                          || attrName == SVGNames::ryAttr;
+
+    if (isLengthAttribute)
+        updateRelativeLengthsInformation();
+
     RenderPath* renderer = static_cast<RenderPath*>(this->renderer());
     if (!renderer)
         return;
@@ -86,10 +94,7 @@ void SVGEllipseElement::svgAttributeChanged(const QualifiedName& attrName)
         return;
     }
 
-    if (attrName == SVGNames::cxAttr
-        || attrName == SVGNames::cyAttr
-        || attrName == SVGNames::rxAttr
-        || attrName == SVGNames::ryAttr) {
+    if (isLengthAttribute) {
         renderer->setNeedsPathUpdate();
         renderer->setNeedsLayout(true);
         return;
@@ -132,10 +137,12 @@ Path SVGEllipseElement::toPathData() const
                                           rx().value(this), ry().value(this));
 }
  
-bool SVGEllipseElement::hasRelativeValues() const
+bool SVGEllipseElement::selfHasRelativeLengths() const
 {
-    return (cx().isRelative() || cy().isRelative() ||
-            rx().isRelative() || ry().isRelative());
+    return cx().isRelative()
+        || cy().isRelative()
+        || rx().isRelative()
+        || ry().isRelative();
 }
 
 }
diff --git a/WebCore/svg/SVGEllipseElement.h b/WebCore/svg/SVGEllipseElement.h
index 4b2c38d..5a5060e 100644
--- a/WebCore/svg/SVGEllipseElement.h
+++ b/WebCore/svg/SVGEllipseElement.h
@@ -45,10 +45,9 @@ namespace WebCore {
 
         virtual Path toPathData() const;
 
-    protected:
-        virtual bool hasRelativeValues() const;
-
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGEllipseElement, SVGNames::cxAttr, SVGLength, Cx, cx)
         DECLARE_ANIMATED_PROPERTY(SVGEllipseElement, SVGNames::cyAttr, SVGLength, Cy, cy)
         DECLARE_ANIMATED_PROPERTY(SVGEllipseElement, SVGNames::rxAttr, SVGLength, Rx, rx)
diff --git a/WebCore/svg/SVGFEConvolveMatrixElement.cpp b/WebCore/svg/SVGFEConvolveMatrixElement.cpp
new file mode 100644
index 0000000..63d1365
--- /dev/null
+++ b/WebCore/svg/SVGFEConvolveMatrixElement.cpp
@@ -0,0 +1,161 @@
+/*
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFEConvolveMatrixElement.h"
+
+#include "Attr.h"
+#include "FloatPoint.h"
+#include "FloatSize.h"
+#include "IntPoint.h"
+#include "IntSize.h"
+#include "SVGNames.h"
+#include "SVGNumberList.h"
+#include "SVGParserUtilities.h"
+
+#include <math.h>
+
+namespace WebCore {
+
+char SVGKernelUnitLengthXAttrIdentifier[] = "SVGKernelUnitLengthXAttr";
+char SVGKernelUnitLengthYAttrIdentifier[] = "SVGKernelUnitLengthYAttr";
+
+SVGFEConvolveMatrixElement::SVGFEConvolveMatrixElement(const QualifiedName& tagName, Document* doc)
+    : SVGFilterPrimitiveStandardAttributes(tagName, doc)
+    , m_kernelMatrix(SVGNumberList::create(SVGNames::kernelMatrixAttr))
+    , m_edgeMode(EDGEMODE_DUPLICATE)
+{
+}
+
+SVGFEConvolveMatrixElement::~SVGFEConvolveMatrixElement()
+{
+}
+
+void SVGFEConvolveMatrixElement::parseMappedAttribute(Attribute* attr)
+{
+    const String& value = attr->value();
+    if (attr->name() == SVGNames::inAttr)
+        setIn1BaseValue(value);
+    else if (attr->name() == SVGNames::orderAttr) {
+        float x, y;
+        if (parseNumberOptionalNumber(value, x, y)) {
+            setOrderXBaseValue(x);
+            setOrderYBaseValue(y);
+        }
+    } else if (attr->name() == SVGNames::edgeModeAttr) {
+        if (value == "duplicate")
+            setEdgeModeBaseValue(EDGEMODE_DUPLICATE);
+        else if (value == "wrap")
+            setEdgeModeBaseValue(EDGEMODE_WRAP);
+        else if (value == "none")
+            setEdgeModeBaseValue(EDGEMODE_NONE);
+    } else if (attr->name() == SVGNames::kernelMatrixAttr)
+        kernelMatrixBaseValue()->parse(value);
+    else if (attr->name() == SVGNames::divisorAttr)
+        setDivisorBaseValue(value.toFloat());
+    else if (attr->name() == SVGNames::biasAttr)
+        setBiasBaseValue(value.toFloat());
+    else if (attr->name() == SVGNames::targetXAttr)
+        setTargetXBaseValue(value.toUIntStrict());
+    else if (attr->name() == SVGNames::targetYAttr)
+        setTargetYBaseValue(value.toUIntStrict());
+    else if (attr->name() == SVGNames::kernelUnitLengthAttr) {
+        float x, y;
+        if (parseNumberOptionalNumber(value, x, y)) {
+            setKernelUnitLengthXBaseValue(x);
+            setKernelUnitLengthYBaseValue(y);
+        }
+    } else if (attr->name() == SVGNames::preserveAlphaAttr) {
+        if (value == "true")
+            setPreserveAlphaBaseValue(true);
+        else if (value == "false")
+            setPreserveAlphaBaseValue(false);
+    } else
+        SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
+}
+
+void SVGFEConvolveMatrixElement::setOrder(float, float)
+{
+    // FIXME: Needs an implementation.
+}
+
+void SVGFEConvolveMatrixElement::setKernelUnitLength(float, float)
+{
+    // FIXME: Needs an implementation.
+}
+
+PassRefPtr<FilterEffect> SVGFEConvolveMatrixElement::build(SVGFilterBuilder* filterBuilder)
+{
+    FilterEffect* input1 = filterBuilder->getEffectById(in1());
+
+    if (!input1)
+        return 0;
+
+    Vector<float> kernelMatrixValues;
+    SVGNumberList* numbers = kernelMatrix();
+
+    ExceptionCode ec = 0;
+    int numberOfItems = numbers->numberOfItems();
+    for (int i = 0; i < numberOfItems; ++i)
+        kernelMatrixValues.append(numbers->getItem(i, ec));
+
+    int orderXValue = orderX();
+    int orderYValue = orderY();
+    if (!hasAttribute(SVGNames::orderAttr)) {
+        orderXValue = 3;
+        orderYValue = 3;
+    }
+    // The spec says this is a requirement, and should bail out if fails
+    if (orderXValue * orderYValue != numberOfItems)
+        return 0;
+
+    int targetXValue = targetX();
+    int targetYValue = targetY();
+    if (hasAttribute(SVGNames::targetXAttr) && (targetXValue < 0 || targetXValue >= orderXValue))
+        return 0;
+    // The spec says the default value is: targetX = floor ( orderX / 2 ))
+    if (!hasAttribute(SVGNames::targetXAttr))
+        targetXValue = static_cast<int>(floorf(orderXValue / 2));
+    if (hasAttribute(SVGNames::targetYAttr) && (targetYValue < 0 || targetYValue >= orderYValue))
+        return 0;
+    // The spec says the default value is: targetY = floor ( orderY / 2 ))
+    if (!hasAttribute(SVGNames::targetYAttr))
+        targetYValue = static_cast<int>(floorf(orderYValue / 2));
+
+    float divisorValue = divisor();
+    if (hasAttribute(SVGNames::divisorAttr) && !divisorValue)
+        return 0;
+    if (!hasAttribute(SVGNames::divisorAttr)) {
+        for (int i = 0; i < numberOfItems; ++i)
+            divisorValue += kernelMatrixValues[i];
+        if (!divisorValue)
+            divisorValue = 1;
+    }
+
+    return FEConvolveMatrix::create(
+        input1, IntSize(orderXValue, orderYValue), divisorValue,
+        bias(), IntPoint(targetXValue, targetYValue), static_cast<EdgeModeType>(edgeMode()),
+        FloatPoint(kernelUnitLengthX(), kernelUnitLengthX()), preserveAlpha(), kernelMatrixValues);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGFEConvolveMatrixElement.h b/WebCore/svg/SVGFEConvolveMatrixElement.h
new file mode 100644
index 0000000..56ae788
--- /dev/null
+++ b/WebCore/svg/SVGFEConvolveMatrixElement.h
@@ -0,0 +1,59 @@
+/*
+    Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef SVGFEConvolveMatrixElement_h
+#define SVGFEConvolveMatrixElement_h
+
+#if ENABLE(SVG) && ENABLE(FILTERS)
+#include "SVGFEConvolveMatrix.h"
+#include "SVGFilterPrimitiveStandardAttributes.h"
+#include "SVGNumberList.h"
+
+namespace WebCore {
+
+class SVGFEConvolveMatrixElement : public SVGFilterPrimitiveStandardAttributes {
+public:
+    SVGFEConvolveMatrixElement(const QualifiedName&, Document*);
+    virtual ~SVGFEConvolveMatrixElement();
+
+    void setOrder(float orderX, float orderY);
+    void setKernelUnitLength(float kernelUnitLengthX, float kernelUnitLengthY);
+
+    virtual void parseMappedAttribute(Attribute*);
+    virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*);
+
+private:
+    DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::inAttr, String, In1, in1)
+    DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::orderXAttr, long, OrderX, orderX)
+    DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::orderYAttr, long, OrderY, orderY)
+    DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::kernelMatrixAttr, SVGNumberList*, KernelMatrix, kernelMatrix)
+    DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::divisorAttr, float, Divisor, divisor)
+    DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::biasAttr, float, Bias, bias)
+    DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::targetXAttr, long, TargetX, targetX)
+    DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::targetYAttr, long, TargetY, targetY)
+    DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::operatorAttr, int, EdgeMode, edgeMode)
+    DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFEConvolveMatrixElement, SVGNames::kernelUnitLengthAttr, SVGKernelUnitLengthXIdentifier, float, KernelUnitLengthX, kernelUnitLengthX)
+    DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS(SVGFEConvolveMatrixElement, SVGNames::kernelUnitLengthAttr, SVGKernelUnitLengthYIdentifier, float, KernelUnitLengthY, kernelUnitLengthY)
+    DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::preserveAlphaAttr, bool, PreserveAlpha, preserveAlpha)
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/WebCore/svg/SVGFEConvolveMatrixElement.idl b/WebCore/svg/SVGFEConvolveMatrixElement.idl
new file mode 100644
index 0000000..5be4c33
--- /dev/null
+++ b/WebCore/svg/SVGFEConvolveMatrixElement.idl
@@ -0,0 +1,50 @@
+/*
+ * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module svg {
+
+    interface [Conditional=SVG&FILTERS, GenerateConstructor] SVGFEConvolveMatrixElement : SVGElement,
+                                                             SVGFilterPrimitiveStandardAttributes {
+        // Edge Mode Values
+        const unsigned short SVG_EDGEMODE_UNKNOWN   = 0;
+        const unsigned short SVG_EDGEMODE_DUPLICATE = 1;
+        const unsigned short SVG_EDGEMODE_WRAP      = 2;
+        const unsigned short SVG_EDGEMODE_NONE      = 3;
+
+        readonly attribute SVGAnimatedString      in1;
+        readonly attribute SVGAnimatedInteger     orderX;
+        readonly attribute SVGAnimatedInteger     orderY;
+        readonly attribute SVGAnimatedNumberList  kernelMatrix;
+        readonly attribute SVGAnimatedNumber      divisor;
+        readonly attribute SVGAnimatedNumber      bias;
+        readonly attribute SVGAnimatedInteger     targetX;
+        readonly attribute SVGAnimatedInteger     targetY;
+        readonly attribute SVGAnimatedEnumeration edgeMode;
+        readonly attribute SVGAnimatedNumber      kernelUnitLengthX;
+        readonly attribute SVGAnimatedNumber      kernelUnitLengthY;
+        readonly attribute SVGAnimatedBoolean     preserveAlpha;
+    };
+
+}
diff --git a/WebCore/svg/SVGFEDiffuseLightingElement.cpp b/WebCore/svg/SVGFEDiffuseLightingElement.cpp
index efe4d5e..fdb3b52 100644
--- a/WebCore/svg/SVGFEDiffuseLightingElement.cpp
+++ b/WebCore/svg/SVGFEDiffuseLightingElement.cpp
@@ -55,7 +55,7 @@ void SVGFEDiffuseLightingElement::parseMappedAttribute(Attribute* attr)
     else if (attr->name() == SVGNames::surfaceScaleAttr)
         setSurfaceScaleBaseValue(value.toFloat());
     else if (attr->name() == SVGNames::diffuseConstantAttr)
-        setDiffuseConstantBaseValue(value.toInt());
+        setDiffuseConstantBaseValue(value.toFloat());
     else if (attr->name() == SVGNames::kernelUnitLengthAttr) {
         float x, y;
         if (parseNumberOptionalNumber(value, x, y)) {
diff --git a/WebCore/svg/SVGFEImageElement.cpp b/WebCore/svg/SVGFEImageElement.cpp
index 7fa4c51..84f8734 100644
--- a/WebCore/svg/SVGFEImageElement.cpp
+++ b/WebCore/svg/SVGFEImageElement.cpp
@@ -28,6 +28,7 @@
 #include "CachedImage.h"
 #include "DocLoader.h"
 #include "Document.h"
+#include "RenderObject.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
 #include "SVGPreserveAspectRatio.h"
@@ -123,7 +124,7 @@ PassRefPtr<FilterEffect> SVGFEImageElement::build(SVGFilterBuilder*)
         IntRect targetRect = enclosingIntRect(renderer->objectBoundingBox());
         m_targetImage = ImageBuffer::create(targetRect.size(), LinearRGB);
 
-        renderSubtreeToImage(m_targetImage.get(), renderer);
+        SVGRenderSupport::renderSubtreeToImage(m_targetImage.get(), renderer);
     }
 
     return FEImage::create(m_targetImage ? m_targetImage->image() : m_cachedImage->image(), preserveAspectRatio());
diff --git a/WebCore/svg/SVGFilterElement.cpp b/WebCore/svg/SVGFilterElement.cpp
index f3ed90c..b86b8c4 100644
--- a/WebCore/svg/SVGFilterElement.cpp
+++ b/WebCore/svg/SVGFilterElement.cpp
@@ -105,6 +105,30 @@ void SVGFilterElement::parseMappedAttribute(Attribute* attr)
     }
 }
 
+void SVGFilterElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGStyledElement::svgAttributeChanged(attrName);
+
+    bool invalidateClients = false;
+    if (attrName == SVGNames::xAttr
+        || attrName == SVGNames::yAttr
+        || attrName == SVGNames::widthAttr
+        || attrName == SVGNames::heightAttr) {
+        invalidateClients = true;
+        updateRelativeLengthsInformation();
+    }
+
+    if (invalidateClients
+        || attrName == SVGNames::filterUnitsAttr
+        || attrName == SVGNames::primitiveUnitsAttr
+        || attrName == SVGNames::filterResAttr
+        || SVGURIReference::isKnownAttribute(attrName)
+        || SVGLangSpace::isKnownAttribute(attrName)
+        || SVGExternalResourcesRequired::isKnownAttribute(attrName)
+        || SVGStyledElement::isKnownAttribute(attrName))
+        invalidateResourceClients();
+}
+
 void SVGFilterElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGStyledElement::synchronizeProperty(attrName);
@@ -165,6 +189,15 @@ RenderObject* SVGFilterElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     return new (arena) RenderSVGResourceFilter(this);
 }
+
+bool SVGFilterElement::selfHasRelativeLengths() const
+{
+    return x().isRelative()
+        || y().isRelative()
+        || width().isRelative()
+        || height().isRelative();
+}
+
 }
 
 #endif
diff --git a/WebCore/svg/SVGFilterElement.h b/WebCore/svg/SVGFilterElement.h
index 3dad97f..85679c7 100644
--- a/WebCore/svg/SVGFilterElement.h
+++ b/WebCore/svg/SVGFilterElement.h
@@ -47,11 +47,14 @@ public:
     FloatRect filterBoundingBox(const FloatRect&) const;
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
 
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
 private:
+    virtual bool selfHasRelativeLengths() const;
+
     DECLARE_ANIMATED_PROPERTY(SVGFilterElement, SVGNames::filterUnitsAttr, int, FilterUnits, filterUnits)
     DECLARE_ANIMATED_PROPERTY(SVGFilterElement, SVGNames::primitiveUnitsAttr, int, PrimitiveUnits, primitiveUnits)
     DECLARE_ANIMATED_PROPERTY(SVGFilterElement, SVGNames::xAttr, SVGLength, X, x)
diff --git a/WebCore/svg/SVGForeignObjectElement.cpp b/WebCore/svg/SVGForeignObjectElement.cpp
index e3e8fab..d6bf1cf 100644
--- a/WebCore/svg/SVGForeignObjectElement.cpp
+++ b/WebCore/svg/SVGForeignObjectElement.cpp
@@ -76,6 +76,14 @@ void SVGForeignObjectElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
+    bool isLengthAttribute = attrName == SVGNames::xAttr
+                          || attrName == SVGNames::yAttr
+                          || attrName == SVGNames::widthAttr
+                          || attrName == SVGNames::heightAttr;
+
+    if (isLengthAttribute)
+        updateRelativeLengthsInformation();
+
     RenderObject* renderer = this->renderer();
     if (!renderer)
         return;
@@ -86,10 +94,7 @@ void SVGForeignObjectElement::svgAttributeChanged(const QualifiedName& attrName)
         return;
     }
 
-    if (attrName == SVGNames::xAttr
-        || attrName == SVGNames::yAttr
-        || attrName == SVGNames::widthAttr
-        || attrName == SVGNames::heightAttr
+    if (isLengthAttribute
         || SVGTests::isKnownAttribute(attrName)
         || SVGLangSpace::isKnownAttribute(attrName)
         || SVGExternalResourcesRequired::isKnownAttribute(attrName))
@@ -139,6 +144,14 @@ bool SVGForeignObjectElement::childShouldCreateRenderer(Node* child) const
     return StyledElement::childShouldCreateRenderer(child);
 }
 
+bool SVGForeignObjectElement::selfHasRelativeLengths() const
+{
+    return x().isRelative()
+        || y().isRelative()
+        || width().isRelative()
+        || height().isRelative();
+}
+
 }
 
 #endif
diff --git a/WebCore/svg/SVGForeignObjectElement.h b/WebCore/svg/SVGForeignObjectElement.h
index 2cd60a4..86edc08 100644
--- a/WebCore/svg/SVGForeignObjectElement.h
+++ b/WebCore/svg/SVGForeignObjectElement.h
@@ -48,6 +48,8 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena* arena, RenderStyle* style);
 
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGForeignObjectElement, SVGNames::xAttr, SVGLength, X, x)
         DECLARE_ANIMATED_PROPERTY(SVGForeignObjectElement, SVGNames::yAttr, SVGLength, Y, y)
         DECLARE_ANIMATED_PROPERTY(SVGForeignObjectElement, SVGNames::widthAttr, SVGLength, Width, width)
diff --git a/WebCore/svg/SVGImageElement.cpp b/WebCore/svg/SVGImageElement.cpp
index e67c337..711e9f3 100644
--- a/WebCore/svg/SVGImageElement.cpp
+++ b/WebCore/svg/SVGImageElement.cpp
@@ -91,6 +91,14 @@ void SVGImageElement::svgAttributeChanged(const QualifiedName& attrName)
     if (SVGURIReference::isKnownAttribute(attrName))
         m_imageLoader.updateFromElementIgnoringPreviousError();
 
+    bool isLengthAttribute = attrName == SVGNames::xAttr
+                          || attrName == SVGNames::yAttr
+                          || attrName == SVGNames::widthAttr
+                          || attrName == SVGNames::heightAttr;
+
+    if (isLengthAttribute)
+        updateRelativeLengthsInformation();
+
     RenderObject* renderer = this->renderer();
     if (!renderer)
         return;
@@ -101,10 +109,7 @@ void SVGImageElement::svgAttributeChanged(const QualifiedName& attrName)
         return;
     }
 
-    if (attrName == SVGNames::xAttr
-        || attrName == SVGNames::yAttr
-        || attrName == SVGNames::widthAttr
-        || attrName == SVGNames::heightAttr
+    if (isLengthAttribute
         || attrName == SVGNames::preserveAspectRatioAttr
         || SVGTests::isKnownAttribute(attrName)
         || SVGLangSpace::isKnownAttribute(attrName)
@@ -143,10 +148,12 @@ void SVGImageElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeHref();
 }
 
-bool SVGImageElement::hasRelativeValues() const
+bool SVGImageElement::selfHasRelativeLengths() const
 {
-    return (x().isRelative() || width().isRelative() ||
-            y().isRelative() || height().isRelative());
+    return x().isRelative()
+        || y().isRelative()
+        || width().isRelative()
+        || height().isRelative();
 }
 
 RenderObject* SVGImageElement::createRenderer(RenderArena* arena, RenderStyle*)
diff --git a/WebCore/svg/SVGImageElement.h b/WebCore/svg/SVGImageElement.h
index 06e3bdb..da3800a 100644
--- a/WebCore/svg/SVGImageElement.h
+++ b/WebCore/svg/SVGImageElement.h
@@ -59,9 +59,9 @@ namespace WebCore {
 
     protected:
         virtual bool haveLoadedRequiredResources();
-        virtual bool hasRelativeValues() const;
 
     private:
+        virtual bool selfHasRelativeLengths() const;
         virtual void willMoveToNewOwnerDocument();
 
         DECLARE_ANIMATED_PROPERTY(SVGImageElement, SVGNames::xAttr, SVGLength, X, x)
diff --git a/WebCore/svg/SVGLineElement.cpp b/WebCore/svg/SVGLineElement.cpp
index a840858..c6e5e04 100644
--- a/WebCore/svg/SVGLineElement.cpp
+++ b/WebCore/svg/SVGLineElement.cpp
@@ -72,6 +72,14 @@ void SVGLineElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
+    bool isLengthAttribute = attrName == SVGNames::x1Attr
+                          || attrName == SVGNames::y1Attr
+                          || attrName == SVGNames::x2Attr
+                          || attrName == SVGNames::y2Attr;
+
+    if (isLengthAttribute)
+        updateRelativeLengthsInformation();
+
     RenderPath* renderer = static_cast<RenderPath*>(this->renderer());
     if (!renderer)
         return;
@@ -82,10 +90,7 @@ void SVGLineElement::svgAttributeChanged(const QualifiedName& attrName)
         return;
     }
 
-    if (attrName == SVGNames::x1Attr
-        || attrName == SVGNames::y1Attr
-        || attrName == SVGNames::x2Attr
-        || attrName == SVGNames::y2Attr) {
+    if (isLengthAttribute) {
         renderer->setNeedsPathUpdate();
         renderer->setNeedsLayout(true);
         return;
@@ -128,10 +133,12 @@ Path SVGLineElement::toPathData() const
                             FloatPoint(x2().value(this), y2().value(this)));
 }
 
-bool SVGLineElement::hasRelativeValues() const
+bool SVGLineElement::selfHasRelativeLengths() const
 {
-    return (x1().isRelative() || y1().isRelative() ||
-            x2().isRelative() || y2().isRelative());
+    return x1().isRelative()
+        || y1().isRelative()
+        || x2().isRelative()
+        || y2().isRelative();
 }
 
 }
diff --git a/WebCore/svg/SVGLineElement.h b/WebCore/svg/SVGLineElement.h
index 1fbe421..d07ee6d 100644
--- a/WebCore/svg/SVGLineElement.h
+++ b/WebCore/svg/SVGLineElement.h
@@ -49,10 +49,9 @@ namespace WebCore {
 
         virtual bool supportsMarkers() const { return true; }
 
-    protected:
-        virtual bool hasRelativeValues() const;
-
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGLineElement, SVGNames::x1Attr, SVGLength, X1, x1)
         DECLARE_ANIMATED_PROPERTY(SVGLineElement, SVGNames::y1Attr, SVGLength, Y1, y1)
         DECLARE_ANIMATED_PROPERTY(SVGLineElement, SVGNames::x2Attr, SVGLength, X2, x2)
diff --git a/WebCore/svg/SVGLinearGradientElement.cpp b/WebCore/svg/SVGLinearGradientElement.cpp
index 29ee85e..d95c084 100644
--- a/WebCore/svg/SVGLinearGradientElement.cpp
+++ b/WebCore/svg/SVGLinearGradientElement.cpp
@@ -74,8 +74,10 @@ void SVGLinearGradientElement::svgAttributeChanged(const QualifiedName& attrName
     if (attrName == SVGNames::x1Attr
         || attrName == SVGNames::y1Attr
         || attrName == SVGNames::x2Attr
-        || attrName == SVGNames::y2Attr)
+        || attrName == SVGNames::y2Attr) {
+        updateRelativeLengthsInformation();
         invalidateResourceClients();
+    }
 }
 
 void SVGLinearGradientElement::synchronizeProperty(const QualifiedName& attrName)
@@ -176,6 +178,14 @@ void SVGLinearGradientElement::calculateStartEndPoints(const LinearGradientAttri
     }
 }
 
+bool SVGLinearGradientElement::selfHasRelativeLengths() const
+{
+    return x1().isRelative()
+        || y1().isRelative()
+        || x2().isRelative()
+        || y2().isRelative();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGLinearGradientElement.h b/WebCore/svg/SVGLinearGradientElement.h
index b248c48..62b972f 100644
--- a/WebCore/svg/SVGLinearGradientElement.h
+++ b/WebCore/svg/SVGLinearGradientElement.h
@@ -44,6 +44,8 @@ namespace WebCore {
         void calculateStartEndPoints(const LinearGradientAttributes&, FloatPoint& startPoint, FloatPoint& endPoint);
 
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGLinearGradientElement, SVGNames::x1Attr, SVGLength, X1, x1)
         DECLARE_ANIMATED_PROPERTY(SVGLinearGradientElement, SVGNames::y1Attr, SVGLength, Y1, y1)
         DECLARE_ANIMATED_PROPERTY(SVGLinearGradientElement, SVGNames::x2Attr, SVGLength, X2, x2)
diff --git a/WebCore/svg/SVGMarkerElement.cpp b/WebCore/svg/SVGMarkerElement.cpp
index 9ffbd8d..01faf21 100644
--- a/WebCore/svg/SVGMarkerElement.cpp
+++ b/WebCore/svg/SVGMarkerElement.cpp
@@ -104,13 +104,22 @@ void SVGMarkerElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledElement::svgAttributeChanged(attrName);
 
-    if (attrName == SVGNames::markerUnitsAttr || attrName == SVGNames::refXAttr ||
-        attrName == SVGNames::refYAttr || attrName == SVGNames::markerWidthAttr ||
-        attrName == SVGNames::markerHeightAttr || attrName == SVGNames::orientAttr ||
-        SVGLangSpace::isKnownAttribute(attrName) ||
-        SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
-        SVGFitToViewBox::isKnownAttribute(attrName) ||
-        SVGStyledElement::isKnownAttribute(attrName))
+    bool invalidateClients = false;
+    if (attrName == SVGNames::refXAttr
+        || attrName == SVGNames::refYAttr
+        || attrName == SVGNames::markerWidthAttr
+        || attrName == SVGNames::markerHeightAttr) {
+        invalidateClients = true;
+        updateRelativeLengthsInformation();
+    }
+
+    if (invalidateClients
+        || attrName == SVGNames::markerUnitsAttr
+        || attrName == SVGNames::orientAttr
+        || SVGLangSpace::isKnownAttribute(attrName)
+        || SVGExternalResourcesRequired::isKnownAttribute(attrName)
+        || SVGFitToViewBox::isKnownAttribute(attrName)
+        || SVGStyledElement::isKnownAttribute(attrName))
         invalidateResourceClients();
 }
 
@@ -182,6 +191,14 @@ RenderObject* SVGMarkerElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGResourceMarker(this);
 }
 
+bool SVGMarkerElement::selfHasRelativeLengths() const
+{
+    return refX().isRelative()
+        || refY().isRelative()
+        || markerWidth().isRelative()
+        || markerHeight().isRelative();
+}
+
 }
 
 #endif
diff --git a/WebCore/svg/SVGMarkerElement.h b/WebCore/svg/SVGMarkerElement.h
index bd397b5..689a7e5 100644
--- a/WebCore/svg/SVGMarkerElement.h
+++ b/WebCore/svg/SVGMarkerElement.h
@@ -69,6 +69,8 @@ public:
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
 private:
+    virtual bool selfHasRelativeLengths() const;
+
     DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::refXAttr, SVGLength, RefX, refX)
     DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::refYAttr, SVGLength, RefY, refY)
     DECLARE_ANIMATED_PROPERTY(SVGMarkerElement, SVGNames::markerWidthAttr, SVGLength, MarkerWidth, markerWidth)
diff --git a/WebCore/svg/SVGMaskElement.cpp b/WebCore/svg/SVGMaskElement.cpp
index 07afe08..1376480 100644
--- a/WebCore/svg/SVGMaskElement.cpp
+++ b/WebCore/svg/SVGMaskElement.cpp
@@ -96,14 +96,23 @@ void SVGMaskElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledElement::svgAttributeChanged(attrName);
 
-    if (attrName == SVGNames::maskUnitsAttr || attrName == SVGNames::maskContentUnitsAttr ||
-        attrName == SVGNames::xAttr || attrName == SVGNames::yAttr ||
-        attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr ||
-        SVGURIReference::isKnownAttribute(attrName) ||
-        SVGTests::isKnownAttribute(attrName) ||
-        SVGLangSpace::isKnownAttribute(attrName) ||
-        SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
-        SVGStyledElement::isKnownAttribute(attrName))
+    bool invalidateClients = false;
+    if (attrName == SVGNames::xAttr
+        || attrName == SVGNames::yAttr
+        || attrName == SVGNames::widthAttr
+        || attrName == SVGNames::heightAttr) {
+        invalidateClients = true;
+        updateRelativeLengthsInformation();
+    }
+
+    if (invalidateClients
+        || attrName == SVGNames::maskUnitsAttr
+        || attrName == SVGNames::maskContentUnitsAttr
+        || SVGURIReference::isKnownAttribute(attrName)
+        || SVGTests::isKnownAttribute(attrName)
+        || SVGLangSpace::isKnownAttribute(attrName)
+        || SVGExternalResourcesRequired::isKnownAttribute(attrName)
+        || SVGStyledElement::isKnownAttribute(attrName))
         invalidateResourceClients();
 }
 
@@ -165,6 +174,14 @@ RenderObject* SVGMaskElement::createRenderer(RenderArena* arena, RenderStyle*)
     return new (arena) RenderSVGResourceMasker(this);
 }
 
+bool SVGMaskElement::selfHasRelativeLengths() const
+{
+    return x().isRelative()
+        || y().isRelative()
+        || width().isRelative()
+        || height().isRelative();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGMaskElement.h b/WebCore/svg/SVGMaskElement.h
index 79e0bf0..467128d 100644
--- a/WebCore/svg/SVGMaskElement.h
+++ b/WebCore/svg/SVGMaskElement.h
@@ -51,6 +51,8 @@ namespace WebCore {
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGMaskElement, SVGNames::maskUnitsAttr, int, MaskUnits, maskUnits)
         DECLARE_ANIMATED_PROPERTY(SVGMaskElement, SVGNames::maskContentUnitsAttr, int, MaskContentUnits, maskContentUnits)
         DECLARE_ANIMATED_PROPERTY(SVGMaskElement, SVGNames::xAttr, SVGLength, X, x)
diff --git a/WebCore/svg/SVGPatternElement.cpp b/WebCore/svg/SVGPatternElement.cpp
index fe889e3..e258946 100644
--- a/WebCore/svg/SVGPatternElement.cpp
+++ b/WebCore/svg/SVGPatternElement.cpp
@@ -120,13 +120,19 @@ void SVGPatternElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledElement::svgAttributeChanged(attrName);
 
-    if (attrName == SVGNames::patternUnitsAttr
-        || attrName == SVGNames::patternContentUnitsAttr
-        || attrName == SVGNames::patternTransformAttr
-        || attrName == SVGNames::xAttr
+    bool invalidateClients = false;
+    if (attrName == SVGNames::xAttr
         || attrName == SVGNames::yAttr
         || attrName == SVGNames::widthAttr
-        || attrName == SVGNames::heightAttr
+        || attrName == SVGNames::heightAttr) {
+        invalidateClients = true;
+        updateRelativeLengthsInformation();
+    }
+
+    if (invalidateClients
+        || attrName == SVGNames::patternUnitsAttr
+        || attrName == SVGNames::patternContentUnitsAttr
+        || attrName == SVGNames::patternTransformAttr
         || SVGURIReference::isKnownAttribute(attrName)
         || SVGTests::isKnownAttribute(attrName)
         || SVGLangSpace::isKnownAttribute(attrName)
@@ -239,6 +245,14 @@ PatternAttributes SVGPatternElement::collectPatternProperties() const
     return attributes;
 }
 
+bool SVGPatternElement::selfHasRelativeLengths() const
+{
+    return x().isRelative()
+        || y().isRelative()
+        || width().isRelative()
+        || height().isRelative();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGPatternElement.h b/WebCore/svg/SVGPatternElement.h
index 56f7238..105b8e2 100644
--- a/WebCore/svg/SVGPatternElement.h
+++ b/WebCore/svg/SVGPatternElement.h
@@ -58,6 +58,8 @@ namespace WebCore {
         PatternAttributes collectPatternProperties() const;
 
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::xAttr, SVGLength, X, x)
         DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::yAttr, SVGLength, Y, y)
         DECLARE_ANIMATED_PROPERTY(SVGPatternElement, SVGNames::widthAttr, SVGLength, Width, width)
diff --git a/WebCore/svg/SVGPolyElement.cpp b/WebCore/svg/SVGPolyElement.cpp
index 053b700..6f88b22 100644
--- a/WebCore/svg/SVGPolyElement.cpp
+++ b/WebCore/svg/SVGPolyElement.cpp
@@ -67,10 +67,8 @@ void SVGPolyElement::parseMappedAttribute(Attribute* attr)
         ExceptionCode ec = 0;
         points()->clear(ec);
 
-        if (!pointsListFromSVGData(points(), value)) {
-            points()->clear(ec);
+        if (!pointsListFromSVGData(points(), value))
             document()->accessSVGExtensions()->reportError("Problem parsing points=\"" + value + "\"");
-        }
     } else {
         if (SVGTests::parseMappedAttribute(attr))
             return;
diff --git a/WebCore/svg/SVGRadialGradientElement.cpp b/WebCore/svg/SVGRadialGradientElement.cpp
index 14e0163..2a97b9d 100644
--- a/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/WebCore/svg/SVGRadialGradientElement.cpp
@@ -81,8 +81,10 @@ void SVGRadialGradientElement::svgAttributeChanged(const QualifiedName& attrName
         || attrName == SVGNames::cyAttr
         || attrName == SVGNames::fxAttr
         || attrName == SVGNames::fyAttr
-        || attrName == SVGNames::rAttr)
+        || attrName == SVGNames::rAttr) {
+        updateRelativeLengthsInformation();
         invalidateResourceClients();
+    }
 }
 
 void SVGRadialGradientElement::synchronizeProperty(const QualifiedName& attrName)
@@ -214,6 +216,15 @@ void SVGRadialGradientElement::calculateFocalCenterPointsAndRadius(const RadialG
     }
 }
 
+bool SVGRadialGradientElement::selfHasRelativeLengths() const
+{
+    return cy().isRelative()
+        || cy().isRelative()
+        || r().isRelative()
+        || fx().isRelative()
+        || fy().isRelative();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGRadialGradientElement.h b/WebCore/svg/SVGRadialGradientElement.h
index 0db08a3..8debc9c 100644
--- a/WebCore/svg/SVGRadialGradientElement.h
+++ b/WebCore/svg/SVGRadialGradientElement.h
@@ -44,6 +44,8 @@ namespace WebCore {
         void calculateFocalCenterPointsAndRadius(const RadialGradientAttributes&, FloatPoint& focalPoint, FloatPoint& centerPoint, float& radius);
 
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGRadialGradientElement, SVGNames::cxAttr, SVGLength, Cx, cx)
         DECLARE_ANIMATED_PROPERTY(SVGRadialGradientElement, SVGNames::cyAttr, SVGLength, Cy, cy)
         DECLARE_ANIMATED_PROPERTY(SVGRadialGradientElement, SVGNames::rAttr, SVGLength, R, r)
diff --git a/WebCore/svg/SVGRectElement.cpp b/WebCore/svg/SVGRectElement.cpp
index b4dc624..3e559ed 100644
--- a/WebCore/svg/SVGRectElement.cpp
+++ b/WebCore/svg/SVGRectElement.cpp
@@ -85,6 +85,16 @@ void SVGRectElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
+    bool isLengthAttribute = attrName == SVGNames::xAttr
+                          || attrName == SVGNames::yAttr
+                          || attrName == SVGNames::widthAttr
+                          || attrName == SVGNames::heightAttr
+                          || attrName == SVGNames::rxAttr
+                          || attrName == SVGNames::ryAttr;
+
+    if (isLengthAttribute)
+        updateRelativeLengthsInformation();
+
     RenderPath* renderer = static_cast<RenderPath*>(this->renderer());
     if (!renderer)
         return;
@@ -95,12 +105,7 @@ void SVGRectElement::svgAttributeChanged(const QualifiedName& attrName)
         return;
     }
 
-    if (attrName == SVGNames::xAttr
-        || attrName == SVGNames::yAttr
-        || attrName == SVGNames::widthAttr
-        || attrName == SVGNames::heightAttr
-        || attrName == SVGNames::rxAttr
-        || attrName == SVGNames::ryAttr) {
+    if (isLengthAttribute) {
         renderer->setNeedsPathUpdate();
         renderer->setNeedsLayout(true);
         return;
@@ -158,11 +163,14 @@ Path SVGRectElement::toPathData() const
     return Path::createRectangle(rect);
 }
 
-bool SVGRectElement::hasRelativeValues() const
+bool SVGRectElement::selfHasRelativeLengths() const
 {
-    return (x().isRelative() || width().isRelative() ||
-            y().isRelative() || height().isRelative() ||
-            rx().isRelative() || ry().isRelative());
+    return x().isRelative()
+        || y().isRelative()
+        || width().isRelative()
+        || height().isRelative()
+        || rx().isRelative()
+        || ry().isRelative();
 }
 
 }
diff --git a/WebCore/svg/SVGRectElement.h b/WebCore/svg/SVGRectElement.h
index 16f8408..4aafc13 100644
--- a/WebCore/svg/SVGRectElement.h
+++ b/WebCore/svg/SVGRectElement.h
@@ -45,10 +45,9 @@ namespace WebCore {
 
         virtual Path toPathData() const;
 
-    protected:
-        virtual bool hasRelativeValues() const;
-
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGRectElement, SVGNames::xAttr, SVGLength, X, x)
         DECLARE_ANIMATED_PROPERTY(SVGRectElement, SVGNames::yAttr, SVGLength, Y, y)
         DECLARE_ANIMATED_PROPERTY(SVGRectElement, SVGNames::widthAttr, SVGLength, Width, width)
diff --git a/WebCore/svg/SVGSVGElement.cpp b/WebCore/svg/SVGSVGElement.cpp
index 154ad7a..a719323 100644
--- a/WebCore/svg/SVGSVGElement.cpp
+++ b/WebCore/svg/SVGSVGElement.cpp
@@ -294,21 +294,32 @@ void SVGSVGElement::svgAttributeChanged(const QualifiedName& attrName)
     // Thus the CSS length value for width is not updated, and width() calcWidth()
     // calculations on RenderSVGRoot will be wrong.
     // https://bugs.webkit.org/show_bug.cgi?id=25387
-    if (attrName == SVGNames::widthAttr)
+    bool updateRelativeLengths = false;
+    if (attrName == SVGNames::widthAttr) {
         updateCSSForAttribute(this, attrName, CSSPropertyWidth, widthBaseValue());
-    else if (attrName == SVGNames::heightAttr)
+        updateRelativeLengths = true;
+    } else if (attrName == SVGNames::heightAttr) {
         updateCSSForAttribute(this, attrName, CSSPropertyHeight, heightBaseValue());
+        updateRelativeLengths = true;
+    }
+
+    if (updateRelativeLengths
+        || attrName == SVGNames::xAttr
+        || attrName == SVGNames::yAttr
+        || SVGFitToViewBox::isKnownAttribute(attrName)) {
+        updateRelativeLengths = true;
+        updateRelativeLengthsInformation();
+    }
 
     if (!renderer())
         return;
 
-    if (attrName == SVGNames::xAttr || attrName == SVGNames::yAttr ||
-        SVGTests::isKnownAttribute(attrName) ||
-        SVGLangSpace::isKnownAttribute(attrName) ||
-        SVGExternalResourcesRequired::isKnownAttribute(attrName) ||
-        SVGFitToViewBox::isKnownAttribute(attrName) ||
-        SVGZoomAndPan::isKnownAttribute(attrName) ||
-        SVGStyledLocatableElement::isKnownAttribute(attrName))
+    if (updateRelativeLengths
+        || SVGTests::isKnownAttribute(attrName)
+        || SVGLangSpace::isKnownAttribute(attrName)
+        || SVGExternalResourcesRequired::isKnownAttribute(attrName)
+        || SVGZoomAndPan::isKnownAttribute(attrName)
+        || SVGStyledLocatableElement::isKnownAttribute(attrName))
         renderer()->setNeedsLayout(true);
 }
 
@@ -430,7 +441,7 @@ FloatRect SVGSVGElement::createSVGRect()
 
 SVGTransform SVGSVGElement::createSVGTransform()
 {
-    return SVGTransform();
+    return SVGTransform(SVGTransform::SVG_TRANSFORM_MATRIX);
 }
 
 SVGTransform SVGSVGElement::createSVGTransformFromMatrix(const AffineTransform& matrix)
@@ -510,10 +521,13 @@ void SVGSVGElement::setCurrentTime(float /* seconds */)
     // FIXME: Implement me, bug 12073
 }
 
-bool SVGSVGElement::hasRelativeValues() const
+bool SVGSVGElement::selfHasRelativeLengths() const
 {
-    return (x().isRelative() || width().isRelative() ||
-            y().isRelative() || height().isRelative());
+    return x().isRelative()
+        || y().isRelative()
+        || width().isRelative()
+        || height().isRelative()
+        || hasAttribute(SVGNames::viewBoxAttr);
 }
 
 bool SVGSVGElement::isOutermostSVG() const
@@ -522,9 +536,11 @@ bool SVGSVGElement::isOutermostSVG() const
     if (!parentNode())
         return true;
 
+#if ENABLE(SVG_FOREIGN_OBJECT)
     // We act like an outermost SVG element, if we're a direct child of a <foreignObject> element.
     if (parentNode()->hasTagName(SVGNames::foreignObjectTag))
         return true;
+#endif
 
     // This is true whenever this is the outermost SVG, even if there are HTML elements outside it
     return !parentNode()->isSVGElement();
@@ -579,5 +595,3 @@ void SVGSVGElement::documentDidBecomeActive()
 }
 
 #endif // ENABLE(SVG)
-
-// vim:ts=4:noet
diff --git a/WebCore/svg/SVGSVGElement.h b/WebCore/svg/SVGSVGElement.h
index e941034..88ce958 100644
--- a/WebCore/svg/SVGSVGElement.h
+++ b/WebCore/svg/SVGSVGElement.h
@@ -128,9 +128,10 @@ namespace WebCore {
         void inheritViewAttributes(SVGViewElement*);
 
         bool isOutermostSVG() const;
-        virtual bool hasRelativeValues() const;
 
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGSVGElement, SVGNames::xAttr, SVGLength, X, x)
         DECLARE_ANIMATED_PROPERTY(SVGSVGElement, SVGNames::yAttr, SVGLength, Y, y)
         DECLARE_ANIMATED_PROPERTY(SVGSVGElement, SVGNames::widthAttr, SVGLength, Width, width)
diff --git a/WebCore/svg/SVGStyledElement.cpp b/WebCore/svg/SVGStyledElement.cpp
index 10cc793..1d7e4ec 100644
--- a/WebCore/svg/SVGStyledElement.cpp
+++ b/WebCore/svg/SVGStyledElement.cpp
@@ -251,7 +251,7 @@ void SVGStyledElement::svgAttributeChanged(const QualifiedName& attrName)
         invalidateResourcesInAncestorChain();
 
         // If we're referencing resources, tell them we've changed.
-        deregisterFromResources(object);
+        RenderSVGResource::invalidateAllResourcesOfRenderer(object);
     }
 
     // Invalidate all SVGElementInstances associated with us
@@ -295,6 +295,18 @@ void SVGStyledElement::invalidateResourceClients()
         object->toRenderSVGResourceContainer()->invalidateClients();
 }
 
+void SVGStyledElement::insertedIntoDocument()
+{
+    SVGElement::insertedIntoDocument();
+    updateRelativeLengthsInformation();
+}
+
+void SVGStyledElement::removedFromDocument()
+{
+    updateRelativeLengthsInformation(false, this);
+    SVGElement::removedFromDocument();
+}
+
 void SVGStyledElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
 {
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
@@ -354,6 +366,12 @@ AffineTransform SVGStyledElement::localCoordinateSpaceTransform(SVGLocatable::CT
     return AffineTransform();
 }
 
+void SVGStyledElement::updateRelativeLengthsInformation(bool, SVGStyledElement*)
+{
+    // FIXME: The actual code will land in a follow-up patch.
+    // See https://bugs.webkit.org/show_bug.cgi?id=41566
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGStyledElement.h b/WebCore/svg/SVGStyledElement.h
index cf78050..d0b52db 100644
--- a/WebCore/svg/SVGStyledElement.h
+++ b/WebCore/svg/SVGStyledElement.h
@@ -26,6 +26,7 @@
 #include "SVGElement.h"
 #include "SVGLocatable.h"
 #include "SVGStylable.h"
+#include <wtf/HashSet.h>
 
 namespace WebCore {
 
@@ -39,7 +40,9 @@ namespace WebCore {
 
         virtual String title() const;
 
-        virtual bool hasRelativeValues() const { return false; }
+        // FIXME: The actual code will land in a follow-up patch.
+        bool hasRelativeLengths() const { return selfHasRelativeLengths(); }
+
         virtual bool isStyled() const { return true; }
         virtual bool supportsMarkers() const { return false; }
 
@@ -55,6 +58,8 @@ namespace WebCore {
         virtual void svgAttributeChanged(const QualifiedName&);
         virtual void synchronizeProperty(const QualifiedName&);
 
+        virtual void insertedIntoDocument();
+        virtual void removedFromDocument();
         virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
         // Centralized place to force a manual style resolution. Hacky but needed for now.
@@ -70,6 +75,10 @@ namespace WebCore {
 
     protected: 
         static int cssPropertyIdForSVGAttributeName(const QualifiedName&);
+        void updateRelativeLengthsInformation() { updateRelativeLengthsInformation(selfHasRelativeLengths(), this); }
+        void updateRelativeLengthsInformation(bool hasRelativeLengths, SVGStyledElement*);
+
+        virtual bool selfHasRelativeLengths() const { return false; }
 
     private:
         DECLARE_ANIMATED_PROPERTY(SVGStyledElement, HTMLNames::classAttr, String, ClassName, className)
diff --git a/WebCore/svg/SVGSymbolElement.cpp b/WebCore/svg/SVGSymbolElement.cpp
index 40dab91..2ee21f6 100644
--- a/WebCore/svg/SVGSymbolElement.cpp
+++ b/WebCore/svg/SVGSymbolElement.cpp
@@ -51,6 +51,14 @@ void SVGSymbolElement::parseMappedAttribute(Attribute* attr)
     SVGStyledElement::parseMappedAttribute(attr);
 }
 
+void SVGSymbolElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGStyledElement::svgAttributeChanged(attrName);
+
+    if (attrName == SVGNames::viewBoxAttr)
+        updateRelativeLengthsInformation();
+}
+
 void SVGSymbolElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGStyledElement::synchronizeProperty(attrName);
@@ -76,6 +84,11 @@ void SVGSymbolElement::synchronizeProperty(const QualifiedName& attrName)
     } 
 }
 
+bool SVGSymbolElement::selfHasRelativeLengths() const
+{
+    return hasAttribute(SVGNames::viewBoxAttr);
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGSymbolElement.h b/WebCore/svg/SVGSymbolElement.h
index 9db81c4..7a7ef87 100644
--- a/WebCore/svg/SVGSymbolElement.h
+++ b/WebCore/svg/SVGSymbolElement.h
@@ -38,10 +38,13 @@ namespace WebCore {
         virtual ~SVGSymbolElement();
 
         virtual void parseMappedAttribute(Attribute*);
+        virtual void svgAttributeChanged(const QualifiedName&);
         virtual void synchronizeProperty(const QualifiedName&);
         virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         // SVGExternalResourcesRequired
         DECLARE_ANIMATED_PROPERTY(SVGSymbolElement, SVGNames::externalResourcesRequiredAttr, bool, ExternalResourcesRequired, externalResourcesRequired)
  
diff --git a/WebCore/svg/SVGTextContentElement.cpp b/WebCore/svg/SVGTextContentElement.cpp
index 12b9b31..234c03a 100644
--- a/WebCore/svg/SVGTextContentElement.cpp
+++ b/WebCore/svg/SVGTextContentElement.cpp
@@ -217,6 +217,11 @@ bool SVGTextContentElement::isKnownAttribute(const QualifiedName& attrName)
             SVGStyledElement::isKnownAttribute(attrName));
 }
 
+bool SVGTextContentElement::selfHasRelativeLengths() const
+{
+    return textLength().isRelative();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGTextContentElement.h b/WebCore/svg/SVGTextContentElement.h
index f73d5e4..44220b9 100644
--- a/WebCore/svg/SVGTextContentElement.h
+++ b/WebCore/svg/SVGTextContentElement.h
@@ -63,6 +63,9 @@ namespace WebCore {
 
         bool isKnownAttribute(const QualifiedName&);
 
+    protected:
+        virtual bool selfHasRelativeLengths() const;
+
     private:
         DECLARE_ANIMATED_PROPERTY(SVGTextContentElement, SVGNames::textLengthAttr, SVGLength, TextLength, textLength)
         DECLARE_ANIMATED_PROPERTY(SVGTextContentElement, SVGNames::lengthAdjustAttr, int, LengthAdjust, lengthAdjust)
diff --git a/WebCore/svg/SVGTextPathElement.cpp b/WebCore/svg/SVGTextPathElement.cpp
index 4a2cea5..288edfd 100644
--- a/WebCore/svg/SVGTextPathElement.cpp
+++ b/WebCore/svg/SVGTextPathElement.cpp
@@ -69,6 +69,22 @@ void SVGTextPathElement::parseMappedAttribute(Attribute* attr)
     }
 }
 
+void SVGTextPathElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGTextContentElement::svgAttributeChanged(attrName);
+
+    if (attrName == SVGNames::startOffsetAttr)
+        updateRelativeLengthsInformation();
+
+    if (!renderer())
+        return;
+
+    if (attrName == SVGNames::startOffsetAttr
+        || SVGTextContentElement::isKnownAttribute(attrName)
+        || SVGURIReference::isKnownAttribute(attrName))
+        renderer()->setNeedsLayout(true);
+}
+
 void SVGTextPathElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGTextContentElement::synchronizeProperty(attrName);
@@ -110,7 +126,7 @@ bool SVGTextPathElement::childShouldCreateRenderer(Node* child) const
 
 void SVGTextPathElement::insertedIntoDocument()
 {
-    SVGElement::insertedIntoDocument();
+    SVGTextContentElement::insertedIntoDocument();
 
     String id = SVGURIReference::getTarget(href());
     Element* targetElement = ownerDocument()->getElementById(id);
@@ -120,6 +136,12 @@ void SVGTextPathElement::insertedIntoDocument()
     }
 }
 
+bool SVGTextPathElement::selfHasRelativeLengths() const
+{
+    return startOffset().isRelative()
+        || SVGTextContentElement::selfHasRelativeLengths();
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGTextPathElement.h b/WebCore/svg/SVGTextPathElement.h
index 943d795..4e7f914 100644
--- a/WebCore/svg/SVGTextPathElement.h
+++ b/WebCore/svg/SVGTextPathElement.h
@@ -57,12 +57,15 @@ namespace WebCore {
         virtual void insertedIntoDocument();
 
         virtual void parseMappedAttribute(Attribute*);
+        virtual void svgAttributeChanged(const QualifiedName&);
         virtual void synchronizeProperty(const QualifiedName&);
         virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
         bool childShouldCreateRenderer(Node*) const;
 
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGTextPathElement, SVGNames::startOffsetAttr, SVGLength, StartOffset, startOffset)
         DECLARE_ANIMATED_PROPERTY(SVGTextPathElement, SVGNames::methodAttr, int, Method, method)
         DECLARE_ANIMATED_PROPERTY(SVGTextPathElement, SVGNames::spacingAttr, int, Spacing, spacing)
diff --git a/WebCore/svg/SVGTextPositioningElement.cpp b/WebCore/svg/SVGTextPositioningElement.cpp
index 12b1975..ef47322 100644
--- a/WebCore/svg/SVGTextPositioningElement.cpp
+++ b/WebCore/svg/SVGTextPositioningElement.cpp
@@ -65,6 +65,12 @@ void SVGTextPositioningElement::svgAttributeChanged(const QualifiedName& attrNam
 {
     SVGTextContentElement::svgAttributeChanged(attrName);
 
+    if (attrName == SVGNames::xAttr
+        || attrName == SVGNames::yAttr
+        || attrName == SVGNames::dxAttr
+        || attrName == SVGNames::dyAttr)
+        updateRelativeLengthsInformation();
+
     if (!renderer())
         return;
 
@@ -107,6 +113,39 @@ bool SVGTextPositioningElement::isKnownAttribute(const QualifiedName& attrName)
             SVGTextContentElement::isKnownAttribute(attrName));
 }
 
+static inline bool listContainsRelativeValue(SVGLengthList* list)
+{
+    if (!list)
+        return false;
+
+    ExceptionCode ec = 0;
+    int length = list->numberOfItems();
+    for (int i = 0; i < length; ++i) {
+        SVGLength length(list->getItem(i, ec));
+        ASSERT(!ec);
+
+        if (length.isRelative())
+            return true;
+    }
+
+    return false;
+}
+
+bool SVGTextPositioningElement::selfHasRelativeLengths() const
+{
+    if (SVGTextContentElement::selfHasRelativeLengths())
+        return true;
+    if (listContainsRelativeValue(x()))
+        return true;
+    if (listContainsRelativeValue(y()))
+        return true;
+    if (listContainsRelativeValue(dx()))
+        return true;
+    if (listContainsRelativeValue(dy()))
+        return true;
+    return false;
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGTextPositioningElement.h b/WebCore/svg/SVGTextPositioningElement.h
index f3e11bc..985ced4 100644
--- a/WebCore/svg/SVGTextPositioningElement.h
+++ b/WebCore/svg/SVGTextPositioningElement.h
@@ -40,6 +40,8 @@ namespace WebCore {
         bool isKnownAttribute(const QualifiedName&);
 
     private:
+        virtual bool selfHasRelativeLengths() const;
+
         DECLARE_ANIMATED_PROPERTY(SVGTextPositioningElement, SVGNames::xAttr, SVGLengthList*, X, x)
         DECLARE_ANIMATED_PROPERTY(SVGTextPositioningElement, SVGNames::yAttr, SVGLengthList*, Y, y)
         DECLARE_ANIMATED_PROPERTY(SVGTextPositioningElement, SVGNames::dxAttr, SVGLengthList*, Dx, dx)
diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
index 17b4212..b90bd53 100644
--- a/WebCore/svg/SVGUseElement.cpp
+++ b/WebCore/svg/SVGUseElement.cpp
@@ -120,7 +120,7 @@ void SVGUseElement::parseMappedAttribute(Attribute* attr)
 void SVGUseElement::insertedIntoDocument()
 {
     // This functions exists to assure assumptions made in the code regarding SVGElementInstance creation/destruction are satisfied.
-    SVGElement::insertedIntoDocument();
+    SVGStyledTransformableElement::insertedIntoDocument();
     ASSERT(!m_targetElementInstance);
     ASSERT(!m_isPendingResource);
 }
@@ -128,13 +128,19 @@ void SVGUseElement::insertedIntoDocument()
 void SVGUseElement::removedFromDocument()
 {
     m_targetElementInstance = 0;
-    SVGElement::removedFromDocument();
+    SVGStyledTransformableElement::removedFromDocument();
 }
 
 void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
+    bool isXYAttribute = attrName == SVGNames::xAttr || attrName == SVGNames::yAttr;
+    bool isWidthHeightAttribute = attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr;
+
+    if (isXYAttribute || isWidthHeightAttribute)
+        updateRelativeLengthsInformation();
+
     if (!renderer())
         return;
 
@@ -149,12 +155,12 @@ void SVGUseElement::svgAttributeChanged(const QualifiedName& attrName)
         return;
     }
 
-    if (attrName == SVGNames::xAttr || attrName == SVGNames::yAttr) {
+    if (isXYAttribute) {
         updateContainerOffsets();
         return;
     }
 
-    if (attrName == SVGNames::widthAttr || attrName == SVGNames::heightAttr) {
+    if (isWidthHeightAttribute) {
         updateContainerSizes();
         return;
     }
@@ -552,6 +558,9 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
     // Update container offset/size
     updateContainerOffsets();
     updateContainerSizes();
+
+    // Update relative length information
+    updateRelativeLengthsInformation();
 }
 
 RenderObject* SVGUseElement::createRenderer(RenderArena* arena, RenderStyle*)
@@ -979,9 +988,22 @@ void SVGUseElement::transferUseAttributesToReplacedElement(SVGElement* from, SVG
     ASSERT(!ec);
 }
 
-bool SVGUseElement::hasRelativeValues() const
+bool SVGUseElement::selfHasRelativeLengths() const
 {
-    return x().isRelative() || y().isRelative() || width().isRelative() || height().isRelative();
+    if (x().isRelative()
+     || y().isRelative()
+     || width().isRelative()
+     || height().isRelative())
+        return true;
+
+    if (!m_targetElementInstance)
+        return false;
+
+    SVGElement* element = m_targetElementInstance->correspondingElement();
+    if (!element || !element->isStyled())
+        return false;
+
+    return static_cast<SVGStyledElement*>(element)->hasRelativeLengths();
 }
 
 }
diff --git a/WebCore/svg/SVGUseElement.h b/WebCore/svg/SVGUseElement.h
index 01a193b..bfda95e 100644
--- a/WebCore/svg/SVGUseElement.h
+++ b/WebCore/svg/SVGUseElement.h
@@ -74,7 +74,7 @@ namespace WebCore {
         void buildShadowAndInstanceTree(SVGShadowTreeRootElement*);
 
     private:
-        virtual bool hasRelativeValues() const;
+        virtual bool selfHasRelativeLengths() const;
 
         DECLARE_ANIMATED_PROPERTY(SVGUseElement, SVGNames::xAttr, SVGLength, X, x)
         DECLARE_ANIMATED_PROPERTY(SVGUseElement, SVGNames::yAttr, SVGLength, Y, y)
diff --git a/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp b/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
index 916b2f9..39b3e57 100644
--- a/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.cpp
@@ -2,6 +2,8 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2009 Dirk Schulze <krit@webkit.org>
+                  2010 Zoltan Herczeg <zherczeg@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -23,17 +25,19 @@
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFEConvolveMatrix.h"
+
+#include "CanvasPixelArray.h"
 #include "Filter.h"
+#include "ImageData.h"
 #include "SVGRenderTreeAsText.h"
 
 namespace WebCore {
 
-FEConvolveMatrix::FEConvolveMatrix(FilterEffect* in, FilterEffect* in2, const FloatSize& kernelSize, 
-    const float& divisor, const float& bias, const FloatSize& targetOffset, EdgeModeType edgeMode,
+FEConvolveMatrix::FEConvolveMatrix(FilterEffect* in, const IntSize& kernelSize,
+    float divisor, float bias, const IntPoint& targetOffset, EdgeModeType edgeMode,
     const FloatPoint& kernelUnitLength, bool preserveAlpha, const Vector<float>& kernelMatrix)
     : FilterEffect()
     , m_in(in)
-    , m_in2(in2)
     , m_kernelSize(kernelSize)
     , m_divisor(divisor)
     , m_bias(bias)
@@ -45,21 +49,21 @@ FEConvolveMatrix::FEConvolveMatrix(FilterEffect* in, FilterEffect* in2, const Fl
 {
 }
 
-PassRefPtr<FEConvolveMatrix> FEConvolveMatrix::create(FilterEffect* in, FilterEffect* in2, const FloatSize& kernelSize, 
-    const float& divisor, const float& bias, const FloatSize& targetOffset, EdgeModeType edgeMode, 
+PassRefPtr<FEConvolveMatrix> FEConvolveMatrix::create(FilterEffect* in, const IntSize& kernelSize,
+    float divisor, float bias, const IntPoint& targetOffset, EdgeModeType edgeMode,
     const FloatPoint& kernelUnitLength, bool preserveAlpha, const Vector<float>& kernelMatrix)
 {
-    return adoptRef(new FEConvolveMatrix(in, in2, kernelSize, divisor, bias, targetOffset, edgeMode, kernelUnitLength,
+    return adoptRef(new FEConvolveMatrix(in, kernelSize, divisor, bias, targetOffset, edgeMode, kernelUnitLength,
         preserveAlpha, kernelMatrix));
 }
 
 
-FloatSize FEConvolveMatrix::kernelSize() const
+IntSize FEConvolveMatrix::kernelSize() const
 {
     return m_kernelSize;
 }
 
-void FEConvolveMatrix::setKernelSize(FloatSize kernelSize)
+void FEConvolveMatrix::setKernelSize(IntSize kernelSize)
 {
     m_kernelSize = kernelSize; 
 }
@@ -94,12 +98,12 @@ void FEConvolveMatrix::setBias(float bias)
     m_bias = bias; 
 }
 
-FloatSize FEConvolveMatrix::targetOffset() const
+IntPoint FEConvolveMatrix::targetOffset() const
 {
     return m_targetOffset; 
 }
 
-void FEConvolveMatrix::setTargetOffset(FloatSize targetOffset)
+void FEConvolveMatrix::setTargetOffset(IntPoint targetOffset)
 {
     m_targetOffset = targetOffset; 
 }
@@ -134,8 +138,295 @@ void FEConvolveMatrix::setPreserveAlpha(bool preserveAlpha)
     m_preserveAlpha = preserveAlpha; 
 }
 
-void FEConvolveMatrix::apply(Filter*)
+/*
+   -----------------------------------
+      ConvolveMatrix implementation
+   -----------------------------------
+
+   The image rectangle is split in the following way:
+
+      +---------------------+
+      |          A          |
+      +---------------------+
+      |   |             |   |
+      | B |      C      | D |
+      |   |             |   |
+      +---------------------+
+      |          E          |
+      +---------------------+
+
+   Where region C contains those pixels, whose values
+   can be calculated without crossing the edge of the rectangle.
+
+   Example:
+      Image size: width: 10, height: 10
+
+      Order (kernel matrix size): width: 3, height 4
+      Target: x:1, y:3
+
+      The following figure shows the target inside the kernel matrix:
+
+        ...
+        ...
+        ...
+        .X.
+
+   The regions in this case are the following:
+      Note: (x1, y1) top-left and (x2, y2) is the bottom-right corner
+      Note: row x2 and column y2 is not part of the region
+            only those (x, y) pixels, where x1 <= x < x2 and y1 <= y < y2
+
+      Region A: x1: 0, y1: 0, x2: 10, y2: 3
+      Region B: x1: 0, y1: 3, x2: 1, y2: 10
+      Region C: x1: 1, y1: 3, x2: 9, y2: 10
+      Region D: x1: 9, y1: 3, x2: 10, y2: 10
+      Region E: x1: 0, y1: 10, x2: 10, y2: 10 (empty region)
+
+   Since region C (often) contains most of the pixels, we implemented
+   a fast algoritm to calculate these values, called fastSetInteriorPixels.
+   For other regions, fastSetOuterPixels is used, which calls getPixelValue,
+   to handle pixels outside of the image. In a rare situations, when
+   kernel matrix is bigger than the image, all pixels are calculated by this
+   function.
+
+   Although these two functions have lot in common, I decided not to make
+   common a template for them, since there are key differences as well,
+   and would make it really hard to understand.
+*/
+
+static ALWAYS_INLINE unsigned char clampRGBAValue(float rgba)
+{
+    if (rgba <= 0)
+        return 0;
+    if (rgba >= 255)
+        return 255;
+    return rgba;
+}
+
+// Only for region C
+template<bool preserveAlphaValues>
+ALWAYS_INLINE void FEConvolveMatrix::fastSetInteriorPixels(PaintingData& paintingData, int clipRight, int clipBottom)
 {
+    // edge mode does not affect these pixels
+    int pixel = (m_targetOffset.y() * paintingData.width + m_targetOffset.x()) * 4;
+    int startKernelPixel = 0;
+    int kernelIncrease = clipRight * 4;
+    int xIncrease = (m_kernelSize.width() - 1) * 4;
+    // Contains the sum of rgb(a) components
+    float totals[3 + (preserveAlphaValues ? 0 : 1)];
+
+    // m_divisor cannot be 0, SVGFEConvolveMatrixElement ensures this
+    ASSERT(m_divisor);
+
+    for (int y = clipBottom + 1; y > 0; --y) {
+        for (int x = clipRight + 1; x > 0; --x) {
+            int kernelValue = m_kernelMatrix.size() - 1;
+            int kernelPixel = startKernelPixel;
+            int width = m_kernelSize.width();
+
+            totals[0] = 0;
+            totals[1] = 0;
+            totals[2] = 0;
+            if (!preserveAlphaValues)
+                totals[3] = 0;
+
+            while (kernelValue >= 0) {
+                totals[0] += m_kernelMatrix[kernelValue] * static_cast<float>(paintingData.srcPixelArray->get(kernelPixel++));
+                totals[1] += m_kernelMatrix[kernelValue] * static_cast<float>(paintingData.srcPixelArray->get(kernelPixel++));
+                totals[2] += m_kernelMatrix[kernelValue] * static_cast<float>(paintingData.srcPixelArray->get(kernelPixel++));
+                if (!preserveAlphaValues)
+                    totals[3] += m_kernelMatrix[kernelValue] * static_cast<float>(paintingData.srcPixelArray->get(kernelPixel));
+                ++kernelPixel;
+                --kernelValue;
+                if (!--width) {
+                    kernelPixel += kernelIncrease;
+                    width = m_kernelSize.width();
+                }
+            }
+
+            paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[0] / m_divisor + paintingData.bias));
+            paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[1] / m_divisor + paintingData.bias));
+            paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[2] / m_divisor + paintingData.bias));
+            if (!preserveAlphaValues)
+                paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[3] / m_divisor + paintingData.bias));
+            else {
+                paintingData.dstPixelArray->set(pixel, paintingData.srcPixelArray->get(pixel));
+                ++pixel;
+            }
+            startKernelPixel += 4;
+        }
+        pixel += xIncrease;
+        startKernelPixel += xIncrease;
+    }
+}
+
+ALWAYS_INLINE int FEConvolveMatrix::getPixelValue(PaintingData& paintingData, int x, int y)
+{
+    if (x >= 0 && x < paintingData.width && x >= 0 && y < paintingData.height)
+        return (y * paintingData.width + x) << 2;
+
+    switch (m_edgeMode) {
+    default: // EDGEMODE_NONE
+        return -1;
+    case EDGEMODE_DUPLICATE:
+        if (x < 0)
+            x = 0;
+        else if (x >= paintingData.width)
+            x = paintingData.width - 1;
+        if (y < 0)
+            y = 0;
+        else if (y >= paintingData.height)
+            y = paintingData.height - 1;
+        return (y * paintingData.width + x) << 2;
+    case EDGEMODE_WRAP:
+        while (x < 0)
+            x += paintingData.width;
+        x %= paintingData.width;
+        while (y < 0)
+            y += paintingData.height;
+        y %= paintingData.height;
+        return (y * paintingData.width + x) << 2;
+    }
+}
+
+// For other regions than C
+template<bool preserveAlphaValues>
+void FEConvolveMatrix::fastSetOuterPixels(PaintingData& paintingData, int x1, int y1, int x2, int y2)
+{
+    int pixel = (y1 * paintingData.width + x1) * 4;
+    int height = y2 - y1;
+    int width = x2 - x1;
+    int beginKernelPixelX = x1 - m_targetOffset.x();
+    int startKernelPixelX = beginKernelPixelX;
+    int startKernelPixelY = y1 - m_targetOffset.y();
+    int xIncrease = (paintingData.width - width) * 4;
+    // Contains the sum of rgb(a) components
+    float totals[3 + (preserveAlphaValues ? 0 : 1)];
+
+    // m_divisor cannot be 0, SVGFEConvolveMatrixElement ensures this
+    ASSERT(m_divisor);
+
+    for (int y = height; y > 0; --y) {
+        for (int x = width; x > 0; --x) {
+            int kernelValue = m_kernelMatrix.size() - 1;
+            int kernelPixelX = startKernelPixelX;
+            int kernelPixelY = startKernelPixelY;
+            int width = m_kernelSize.width();
+
+            totals[0] = 0;
+            totals[1] = 0;
+            totals[2] = 0;
+            if (!preserveAlphaValues)
+                totals[3] = 0;
+
+            while (kernelValue >= 0) {
+                int pixelIndex = getPixelValue(paintingData, kernelPixelX, kernelPixelY);
+                if (pixelIndex >= 0) {
+                    totals[0] += m_kernelMatrix[kernelValue] * static_cast<float>(paintingData.srcPixelArray->get(pixelIndex));
+                    totals[1] += m_kernelMatrix[kernelValue] * static_cast<float>(paintingData.srcPixelArray->get(pixelIndex + 1));
+                    totals[2] += m_kernelMatrix[kernelValue] * static_cast<float>(paintingData.srcPixelArray->get(pixelIndex + 2));
+                }
+                if (!preserveAlphaValues && pixelIndex >= 0)
+                    totals[3] += m_kernelMatrix[kernelValue] * static_cast<float>(paintingData.srcPixelArray->get(pixelIndex + 3));
+                ++kernelPixelX;
+                --kernelValue;
+                if (!--width) {
+                    kernelPixelX = startKernelPixelX;
+                    ++kernelPixelY;
+                    width = m_kernelSize.width();
+                }
+            }
+
+            paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[0] / m_divisor + paintingData.bias));
+            paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[1] / m_divisor + paintingData.bias));
+            paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[2] / m_divisor + paintingData.bias));
+            if (!preserveAlphaValues)
+                paintingData.dstPixelArray->set(pixel++, clampRGBAValue(totals[3] / m_divisor + paintingData.bias));
+            else {
+                paintingData.dstPixelArray->set(pixel, paintingData.srcPixelArray->get(pixel));
+                ++pixel;
+            }
+            ++startKernelPixelX;
+        }
+        pixel += xIncrease;
+        startKernelPixelX = beginKernelPixelX;
+        ++startKernelPixelY;
+    }
+}
+
+ALWAYS_INLINE void FEConvolveMatrix::setInteriorPixels(PaintingData& paintingData, int clipRight, int clipBottom)
+{
+    // Must be implemented here, since it refers another ALWAYS_INLINE
+    // function, which defined in this C++ source file as well
+    if (m_preserveAlpha)
+        fastSetInteriorPixels<true>(paintingData, clipRight, clipBottom);
+    else
+        fastSetInteriorPixels<false>(paintingData, clipRight, clipBottom);
+}
+
+ALWAYS_INLINE void FEConvolveMatrix::setOuterPixels(PaintingData& paintingData, int x1, int y1, int x2, int y2)
+{
+    // Although this function can be moved to the header, it is implemented here
+    // because setInteriorPixels is also implemented here
+    if (m_preserveAlpha)
+        fastSetOuterPixels<true>(paintingData, x1, y1, x2, y2);
+    else
+        fastSetOuterPixels<false>(paintingData, x1, y1, x2, y2);
+}
+
+void FEConvolveMatrix::apply(Filter* filter)
+{
+    m_in->apply(filter);
+    if (!m_in->resultImage())
+        return;
+
+    if (!getEffectContext())
+        return;
+
+    IntRect imageRect(IntPoint(), resultImage()->size());
+    IntRect effectDrawingRect = calculateDrawingIntRect(m_in->subRegion());
+
+    RefPtr<CanvasPixelArray> srcPixelArray;
+    if (m_preserveAlpha)
+        srcPixelArray = m_in->resultImage()->getUnmultipliedImageData(effectDrawingRect)->data();
+    else
+        srcPixelArray = m_in->resultImage()->getPremultipliedImageData(effectDrawingRect)->data();
+
+    RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
+
+    PaintingData paintingData;
+    paintingData.srcPixelArray = srcPixelArray.get();
+    paintingData.dstPixelArray = imageData->data();
+    paintingData.width = imageRect.width();
+    paintingData.height = imageRect.height();
+    paintingData.bias = m_bias * 255;
+
+    // Drawing fully covered pixels
+    int clipRight = imageRect.width() - m_kernelSize.width();
+    int clipBottom = imageRect.height() - m_kernelSize.height();
+
+    if (clipRight >= 0 && clipBottom >= 0) {
+        setInteriorPixels(paintingData, clipRight, clipBottom);
+
+        clipRight += m_targetOffset.x() + 1;
+        clipBottom += m_targetOffset.y() + 1;
+        if (m_targetOffset.y() > 0)
+            setOuterPixels(paintingData, 0, 0, imageRect.width(), m_targetOffset.y());
+        if (clipBottom < imageRect.height())
+            setOuterPixels(paintingData, 0, clipBottom, imageRect.width(), imageRect.height());
+        if (m_targetOffset.x() > 0)
+            setOuterPixels(paintingData, 0, m_targetOffset.y(), m_targetOffset.x(), clipBottom);
+        if (clipRight < imageRect.width())
+            setOuterPixels(paintingData, clipRight, m_targetOffset.y(), imageRect.width(), clipBottom);
+    } else {
+        // Rare situation, not optimizied for speed
+        setOuterPixels(paintingData, 0, 0, imageRect.width(), imageRect.height());
+    }
+
+    if (m_preserveAlpha)
+        resultImage()->putUnmultipliedImageData(imageData.get(), imageRect, IntPoint());
+    else
+        resultImage()->putPremultipliedImageData(imageData.get(), imageRect, IntPoint());
 }
 
 void FEConvolveMatrix::dump()
@@ -144,8 +435,7 @@ void FEConvolveMatrix::dump()
 
 static TextStream& operator<<(TextStream& ts, const EdgeModeType& type)
 {
-    switch (type)
-    {
+    switch (type) {
     case EDGEMODE_UNKNOWN:
         ts << "UNKNOWN";
         break;
@@ -176,7 +466,6 @@ TextStream& FEConvolveMatrix::externalRepresentation(TextStream& ts, int indent)
        << "kernelUnitLength=\"" << m_kernelUnitLength << "\" "
        << "preserveAlpha=\"" << m_preserveAlpha << "\"]\n";
     m_in->externalRepresentation(ts, indent + 1);
-    m_in2->externalRepresentation(ts, indent + 1);
     return ts;
 }
 
diff --git a/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h b/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h
index 8e3a9bd..7b8da0b 100644
--- a/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h
+++ b/WebCore/svg/graphics/filters/SVGFEConvolveMatrix.h
@@ -2,6 +2,7 @@
     Copyright (C) 2004, 2005, 2006, 2007 Nikolas Zimmermann <zimmermann@kde.org>
                   2004, 2005 Rob Buis <buis@kde.org>
                   2005 Eric Seidel <eric@webkit.org>
+                  2010 Zoltan Herczeg <zherczeg@webkit.org>
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -27,68 +28,90 @@
 #include "FloatPoint.h"
 #include "FloatSize.h"
 #include "Filter.h"
+#include <wtf/AlwaysInline.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
-    enum EdgeModeType {
-        EDGEMODE_UNKNOWN   = 0,
-        EDGEMODE_DUPLICATE = 1,
-        EDGEMODE_WRAP      = 2,
-        EDGEMODE_NONE      = 3
-    };
+enum EdgeModeType {
+    EDGEMODE_UNKNOWN   = 0,
+    EDGEMODE_DUPLICATE = 1,
+    EDGEMODE_WRAP      = 2,
+    EDGEMODE_NONE      = 3
+};
+
+class CanvasPixelArray;
 
-    class FEConvolveMatrix : public FilterEffect {
-    public:
-        static PassRefPtr<FEConvolveMatrix> create(FilterEffect*, FilterEffect*, const FloatSize&, 
-                const float&, const float&, const FloatSize&, EdgeModeType, const FloatPoint&,
-                bool, const Vector<float>&);
+class FEConvolveMatrix : public FilterEffect {
+public:
+    static PassRefPtr<FEConvolveMatrix> create(FilterEffect*, const IntSize&,
+            float, float, const IntPoint&, EdgeModeType, const FloatPoint&,
+            bool, const Vector<float>&);
 
-        FloatSize kernelSize() const;
-        void setKernelSize(FloatSize);
+    IntSize kernelSize() const;
+    void setKernelSize(IntSize);
 
-        const Vector<float>& kernel() const;
-        void setKernel(const Vector<float>&);
+    const Vector<float>& kernel() const;
+    void setKernel(const Vector<float>&);
 
-        float divisor() const;
-        void setDivisor(float);
+    float divisor() const;
+    void setDivisor(float);
 
-        float bias() const;
-        void setBias(float);
+    float bias() const;
+    void setBias(float);
 
-        FloatSize targetOffset() const;
-        void setTargetOffset(FloatSize);
+    IntPoint targetOffset() const;
+    void setTargetOffset(IntPoint);
 
-        EdgeModeType edgeMode() const;
-        void setEdgeMode(EdgeModeType);
+    EdgeModeType edgeMode() const;
+    void setEdgeMode(EdgeModeType);
 
-        FloatPoint kernelUnitLength() const;
-        void setKernelUnitLength(FloatPoint);
+    FloatPoint kernelUnitLength() const;
+    void setKernelUnitLength(FloatPoint);
 
-        bool preserveAlpha() const;
-        void setPreserveAlpha(bool);
+    bool preserveAlpha() const;
+    void setPreserveAlpha(bool);
 
-        virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get(), m_in2.get()); }
-        void apply(Filter*);
-        void dump();
-        TextStream& externalRepresentation(TextStream&, int indent) const;
+    virtual FloatRect uniteChildEffectSubregions(Filter* filter) { return calculateUnionOfChildEffectSubregions(filter, m_in.get()); }
+    void apply(Filter*);
+    void dump();
+    TextStream& externalRepresentation(TextStream&, int indent) const;
 
-    private:
-        FEConvolveMatrix(FilterEffect*, FilterEffect*, const FloatSize&, const float&, const float&,
-                const FloatSize&, EdgeModeType, const FloatPoint&, bool, const Vector<float>&);
+private:
+    FEConvolveMatrix(FilterEffect*, const IntSize&, float, float,
+            const IntPoint&, EdgeModeType, const FloatPoint&, bool, const Vector<float>&);
 
-        RefPtr<FilterEffect> m_in;
-        RefPtr<FilterEffect> m_in2;
-        FloatSize m_kernelSize;
-        float m_divisor;
-        float m_bias;
-        FloatSize m_targetOffset;
-        EdgeModeType m_edgeMode;
-        FloatPoint m_kernelUnitLength;
-        bool m_preserveAlpha;
-        Vector<float> m_kernelMatrix;
+    struct PaintingData {
+        CanvasPixelArray* srcPixelArray;
+        CanvasPixelArray* dstPixelArray;
+        int width;
+        int height;
+        float bias;
     };
 
+    template<bool preserveAlphaValues>
+    ALWAYS_INLINE void fastSetInteriorPixels(PaintingData&, int clipRight, int clipBottom);
+
+    ALWAYS_INLINE int getPixelValue(PaintingData&, int x, int y);
+
+    template<bool preserveAlphaValues>
+    void fastSetOuterPixels(PaintingData&, int x1, int y1, int x2, int y2);
+
+    // Wrapper functions
+    ALWAYS_INLINE void setInteriorPixels(PaintingData& paintingData, int clipRight, int clipBottom);
+    ALWAYS_INLINE void setOuterPixels(PaintingData& paintingData, int x1, int y1, int x2, int y2);
+
+    RefPtr<FilterEffect> m_in;
+    IntSize m_kernelSize;
+    float m_divisor;
+    float m_bias;
+    IntPoint m_targetOffset;
+    EdgeModeType m_edgeMode;
+    FloatPoint m_kernelUnitLength;
+    bool m_preserveAlpha;
+    Vector<float> m_kernelMatrix;
+};
+
 } // namespace WebCore
 
 #endif // ENABLE(SVG) && ENABLE(FILTERS)
diff --git a/WebCore/svg/svgattrs.in b/WebCore/svg/svgattrs.in
index dbe7663..fe48c8a 100644
--- a/WebCore/svg/svgattrs.in
+++ b/WebCore/svg/svgattrs.in
@@ -141,6 +141,8 @@ onzoom
 opacity
 operator
 order
+orderX
+orderY
 orient
 orientation
 origin
diff --git a/WebCore/svg/svgtags.in b/WebCore/svg/svgtags.in
index 5d44e03..adf0b24 100644
--- a/WebCore/svg/svgtags.in
+++ b/WebCore/svg/svgtags.in
@@ -31,9 +31,7 @@ feBlend createWithNew
 feColorMatrix createWithNew
 feComponentTransfer createWithNew
 feComposite createWithNew
-#if 0
 feConvolveMatrix createWithNew
-#endif
 feDiffuseLighting createWithNew
 feDisplacementMap createWithNew
 feDistantLight createWithNew
diff --git a/WebCore/websockets/WebSocketHandshake.cpp b/WebCore/websockets/WebSocketHandshake.cpp
index ba14732..7711604 100644
--- a/WebCore/websockets/WebSocketHandshake.cpp
+++ b/WebCore/websockets/WebSocketHandshake.cpp
@@ -107,9 +107,11 @@ static void generateSecWebSocketKey(uint32_t& number, String& key)
     }
     DEFINE_STATIC_LOCAL(String, spaceChar, (" "));
     for (uint32_t i = 0; i < space; i++) {
-        int pos = static_cast<int>(randomNumber() * s.length() - 1) + 1;
+        int pos = static_cast<int>(randomNumber() * (s.length() - 1)) + 1;
         s.insert(spaceChar, pos);
     }
+    ASSERT(s[0] != ' ');
+    ASSERT(s[s.length() - 1] != ' ');
     key = s;
 }
 
diff --git a/WebCore/xml/XSLTProcessor.cpp b/WebCore/xml/XSLTProcessor.cpp
index 61f414e..f949163 100644
--- a/WebCore/xml/XSLTProcessor.cpp
+++ b/WebCore/xml/XSLTProcessor.cpp
@@ -102,7 +102,7 @@ static inline RefPtr<DocumentFragment> createFragmentFromSource(const String& so
     if (sourceMIMEType == "text/html")
         fragment->parseHTML(sourceString);
     else if (sourceMIMEType == "text/plain")
-        fragment->addChild(Text::create(outputDoc, sourceString));
+        fragment->legacyParserAddChild(Text::create(outputDoc, sourceString));
     else {
         bool successfulParse = fragment->parseXML(sourceString, outputDoc->documentElement());
         if (!successfulParse)
diff --git a/WebKit/ChangeLog b/WebKit/ChangeLog
index fc1195b..7ba39c3 100644
--- a/WebKit/ChangeLog
+++ b/WebKit/ChangeLog
@@ -1,3 +1,55 @@
+2010-06-30  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Implement windowRect() and setWindowRect() in ChromeClientEfl.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=40876
+
+        * efl/WebCoreSupport/ChromeClientEfl.cpp: Implements two methods
+        to change window size.
+
+        (WebCore::ChromeClientEfl::windowRect):
+        (WebCore::ChromeClientEfl::setWindowRect):
+
+2010-06-28  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Unreviewed build fix.
+
+        [EFL] Build fix for latest version of Ecore library.
+        Ecore recently changed return type of callbacks from int to Eina_Bool.
+
+        * efl/EWebLauncher/main.c:
+        * efl/ewk/ewk_view.cpp:
+        (_ewk_view_zoom_animator_cb): Return Eina_Bool instead of int.
+
+2010-06-28  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Simplify zoom setting by narrowing with WebCore API.
+        Instead of creating a zoom_text_only field, use the already defined enum
+        by WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=40993
+
+        * efl/ewk/ewk_frame.cpp: sd->zoom_text_only => sd->zoom_mode
+        (ewk_frame_zoom_set):
+        (ewk_frame_zoom_text_only_get):
+        (ewk_frame_zoom_text_only_set):
+
+2010-06-28  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Implement download requests
+        When a download request arrives through FrameLoaderClient, forward it to
+        browser in order to be possible to download files.
+        https://bugs.webkit.org/show_bug.cgi?id=40967
+
+        * efl/WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::download): get file names and
+        forward to ewk_view_download_request()
+        * efl/ewk/ewk_private.h: export private function to WebCoreSupport
+
 2010-06-25  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
 
         Reviewed by Kenneth Rohde Christiansen.
diff --git a/WebKit/chromium/ChangeLog b/WebKit/chromium/ChangeLog
index 2a56d9d..29cf8f4 100644
--- a/WebKit/chromium/ChangeLog
+++ b/WebKit/chromium/ChangeLog
@@ -1,3 +1,553 @@
+2010-07-05  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [v8] Web Inspector: remove v8-specific code dealing with getOwnPropertyNames from InjectedScript.js
+        https://bugs.webkit.org/show_bug.cgi?id=41595
+
+        * src/js/DebuggerScript.js:
+
+2010-07-03  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Fix issue where a contextmenu event was reporting the wrong target
+        if the context menu was shown due to pressing the context menu key
+        (or Shift+F10).
+
+        https://bugs.webkit.org/show_bug.cgi?id=38129
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::sendContextMenuEvent):
+
+2010-07-02  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [v8] Web Inspector: inspected page crashes on attempt to change iframe's src attribute
+        https://bugs.webkit.org/show_bug.cgi?id=41511
+
+        * src/WebBindings.cpp:
+        (WebKit::getEvent):
+
+2010-07-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62349.
+        http://trac.webkit.org/changeset/62349
+        https://bugs.webkit.org/show_bug.cgi?id=41499
+
+        It broke the chromium Linux build. (Requested by dave_levin on
+        #webkit).
+
+        * public/WebNode.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::registerPasswordListener):
+        (WebKit::WebFrameImpl::notifiyPasswordListenerOfAutocomplete):
+
+2010-07-01  David Holloway  <dhollowa@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Exposes WebNode::unwrap() and WebNode::constUnwrap() for 
+        use by other code in WebKit/chromium/src.
+
+        Specific use of these methods is made in WebFrameImpl.cpp.  This is
+        preferred to the cast operator call that was happening prior to this
+        change.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41477
+
+        * public/WebNode.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::registerPasswordListener):
+        (WebKit::WebFrameImpl::notifiyPasswordListenerOfAutocomplete):
+
+2010-07-01  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Stop linking against opengl32.lib in Windows Chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=41424
+
+        * WebKit.gyp:
+        * src/WebGraphicsContext3DDefaultImpl.cpp:
+        (WebKit::WebGraphicsContext3DDefaultImpl::~WebGraphicsContext3DDefaultImpl):
+        (WebKit::WebGraphicsContext3DDefaultImpl::initialize):
+        (WebKit::WebGraphicsContext3DDefaultImpl::makeContextCurrent):
+        * src/WebGraphicsContext3DDefaultImpl.h:
+
+2010-07-01  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62246.
+        http://trac.webkit.org/changeset/62246
+        https://bugs.webkit.org/show_bug.cgi?id=41470
+
+        "Worker tests are broken in Chromium" (Requested by yurys on
+        #webkit).
+
+        * src/WebBindings.cpp:
+        (WebKit::getEvent):
+
+2010-07-01  David Holloway  <dhollowa@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Consolidates AutoFill and Autocomplete popup menus into a single popup menu.
+
+        This change combines SuggestionsPopupMenuClient, AutoFillPopupMenuClient, and 
+        AutocompletePopupMenuClient classes into a single consolidated AutoFillPopupMenuClient class.
+        Prior to this change the contents of the AutoFill popup menu only included AutoFill
+        suggestions and similarly the Autocomplete popup menu only included Autocomplete
+        suggestions.  With this consolidation, both AutoFill and Autocomplete suggestions can
+        now be displayed in a single menu.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41236
+
+        * WebKit.gyp:
+        * public/WebFrame.h:
+        * public/WebView.h:
+        * src/AutoFillPopupMenuClient.cpp:
+        (WebKit::AutoFillPopupMenuClient::AutoFillPopupMenuClient):
+        (WebKit::AutoFillPopupMenuClient::~AutoFillPopupMenuClient):
+        (WebKit::AutoFillPopupMenuClient::valueChanged):
+        (WebKit::AutoFillPopupMenuClient::selectionCleared):
+        (WebKit::AutoFillPopupMenuClient::itemText):
+        (WebKit::AutoFillPopupMenuClient::itemStyle):
+        (WebKit::AutoFillPopupMenuClient::menuStyle):
+        (WebKit::AutoFillPopupMenuClient::clientPaddingLeft):
+        (WebKit::AutoFillPopupMenuClient::clientPaddingRight):
+        (WebKit::AutoFillPopupMenuClient::popupDidHide):
+        (WebKit::AutoFillPopupMenuClient::setTextFromItem):
+        (WebKit::AutoFillPopupMenuClient::fontSelector):
+        (WebKit::AutoFillPopupMenuClient::hostWindow):
+        (WebKit::AutoFillPopupMenuClient::createScrollbar):
+        (WebKit::AutoFillPopupMenuClient::initialize):
+        (WebKit::AutoFillPopupMenuClient::getWebView):
+        (WebKit::AutoFillPopupMenuClient::textFieldStyle):
+        * src/AutoFillPopupMenuClient.h:
+        (WebKit::AutoFillPopupMenuClient::itemToolTip):
+        (WebKit::AutoFillPopupMenuClient::itemAccessibilityText):
+        (WebKit::AutoFillPopupMenuClient::itemIsEnabled):
+        (WebKit::AutoFillPopupMenuClient::clientInsetLeft):
+        (WebKit::AutoFillPopupMenuClient::clientInsetRight):
+        (WebKit::AutoFillPopupMenuClient::listSize):
+        (WebKit::AutoFillPopupMenuClient::selectedIndex):
+        (WebKit::AutoFillPopupMenuClient::itemIsLabel):
+        (WebKit::AutoFillPopupMenuClient::itemIsSelected):
+        (WebKit::AutoFillPopupMenuClient::shouldPopOver):
+        (WebKit::AutoFillPopupMenuClient::valueShouldChangeOnHotTrack):
+        (WebKit::AutoFillPopupMenuClient::setAutocompleteMode):
+        (WebKit::AutoFillPopupMenuClient::getTextField):
+        (WebKit::AutoFillPopupMenuClient::getSelectedIndex):
+        (WebKit::AutoFillPopupMenuClient::setSelectedIndex):
+        * src/AutocompletePopupMenuClient.cpp: Removed.
+        * src/AutocompletePopupMenuClient.h: Removed.
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::textFieldDidEndEditing):
+        (WebKit::EditorClientImpl::doAutofill):
+        (WebKit::EditorClientImpl::onAutocompleteSuggestionAccepted):
+        * src/SuggestionsPopupMenuClient.cpp: Removed.
+        * src/SuggestionsPopupMenuClient.h: Removed.
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::currentHistoryItem):
+        (WebKit::WebFrameImpl::notifiyPasswordListenerOfAutocomplete):
+        * src/WebFrameImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::):
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::mouseDown):
+        (WebKit::WebViewImpl::mouseUp):
+        (WebKit::WebViewImpl::selectPopupHandleKeyEvent):
+        (WebKit::WebViewImpl::autocompleteHandleKeyEvent):
+        (WebKit::WebViewImpl::hideAutoFillPopup):
+        (WebKit::WebViewImpl::setFocus):
+        (WebKit::WebViewImpl::applyAutoFillSuggestions):
+        (WebKit::WebViewImpl::applyAutocompleteSuggestions):
+        (WebKit::WebViewImpl::hidePopups):
+        (WebKit::WebViewImpl::refreshAutoFillPopup):
+        * src/WebViewImpl.h:
+        (WebKit::WebViewImpl::autoFillPopupDidHide):
+
+2010-07-01  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [v8] Web Inspector: inspected page crashes on attempt to change iframe's src attribute
+        https://bugs.webkit.org/show_bug.cgi?id=41350
+
+        * src/WebBindings.cpp:
+        (WebKit::getEvent):
+
+2010-07-01  Aaron Boodman  <aa@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Make the user script API static. This makes it more convenient to use
+        if you don't have a WebView instance yet.
+
+        Added static versions of the three methods and re-route current ones
+        temporarily through the static versions. Will remove the non-static
+        versions once Chromium has been updated.
+
+        Also, expose the URLPattern configuration for user stylesheets, since
+        they were not before.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41385
+
+        * public/WebView.h:
+        (WebKit::WebView::addUserScript):
+        (WebKit::WebView::addUserStyleSheet):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebView::addUserScript):
+        (WebKit::WebView::addUserStyleSheet):
+        (WebKit::WebView::removeAllUserContent):
+
+2010-06-30  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Roll forward Chromium DEPS to r51287
+        https://bugs.webkit.org/show_bug.cgi?id=41430
+
+        * DEPS:
+
+2010-06-25  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Chrome DevTools: Finalize migration to new WebView constructor
+        (devtools agent is now created within WebViewImpl only).
+
+        https://bugs.webkit.org/show_bug.cgi?id=41212
+
+        * public/WebDevToolsAgent.h:
+        * public/WebView.h:
+        * src/WebDevToolsAgentImpl.cpp:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        * src/WebViewImpl.h:
+        * src/WebWorkerBase.cpp:
+        (WebKit::WebWorkerBase::initializeLoader):
+        * tests/PopupMenuTest.cpp:
+        (WebKit::SelectPopupMenuTest::SetUp):
+
+2010-06-29  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Implement getAttachedShaders
+        https://bugs.webkit.org/show_bug.cgi?id=31172
+
+        * public/WebGraphicsContext3D.h: Declaration of getAttachedShaders().
+        * src/GraphicsContext3D.cpp: Implementation of getAttachedShaders().
+        * src/WebGraphicsContext3DDefaultImpl.cpp: Ditto.
+        * src/WebGraphicsContext3DDefaultImpl.h: Declaration of getAttachedShaders().
+
+2010-06-29  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Simplify the WebDatabase interface.
+        https://bugs.webkit.org/show_bug.cgi?id=40607
+
+        Do not ref()/deref() the private AbstractDatabase member. This
+        allows us to use WebDatabase in the destructors of the DB
+        classes.
+
+        * public/WebDatabase.h:
+        (WebKit::WebDatabase::WebDatabase):
+        * src/WebDatabase.cpp:
+        (WebKit::WebDatabase::name):
+        (WebKit::WebDatabase::displayName):
+        (WebKit::WebDatabase::estimatedSize):
+        (WebKit::WebDatabase::securityOrigin):
+        (WebKit::WebDatabase::WebDatabase):
+
+2010-06-29  Zhe Su  <suzhe@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        A crash caused by the patch of bug 40608.
+        https://bugs.webkit.org/show_bug.cgi?id=41334
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::caretOrSelectionBounds):
+
+2010-06-29  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium]: Update webkit for chromium multi dll build.
+
+        1. Export more webkit APIs for chromium multi dll build.
+        2. Update DumpRenderTree sources so it can build with webkit.dll
+        3. Temp disable webkit unit tests for chromium multi dll build.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41231
+
+        * WebKit.gyp:
+        * public/WebAccessibilityCache.h:
+        * public/WebAccessibilityObject.h:
+        * public/WebEventListener.h:
+        * public/WebGeolocationServiceMock.h:
+        * public/WebGraphicsContext3D.h:
+        * public/WebIDBDatabaseError.h:
+        (WebKit::WebIDBDatabaseError::WebIDBDatabaseError):
+        (WebKit::WebIDBDatabaseError::operator=):
+        * public/WebNotification.h:
+        * public/WebPasswordFormData.h:
+        * public/WebSearchableFormData.h:
+        * public/WebStorageEventDispatcher.h:
+        * public/WebString.h:
+        (WebKit::WebString::WebString):
+        (WebKit::WebString::operator=):
+
+2010-06-29  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Hooking up GraphicsContext3D to the gpu compositor.
+        GraphicsContext3DInternal is now initialized with a pointer to the HostWindow
+        that corresponds to the WebView containing the context. The initializer
+        forces a WebGLES2Context to be created for the WebView (if one doesn't already
+        exist) and uses the view's GL context as a parent to the GL context created
+        for WebGL. This allows the compositor to read the texture associated with 
+        WebGL's frame buffer. We also plumb though GraphicsContext3D's prepareTexture
+        and platformLayer methods which are required by the compositor code.
+        https://bugs.webkit.org/show_bug.cgi?id=41243
+
+        * public/WebGraphicsContext3D.h:
+        * public/WebView.h:
+            Made gles2Context() a virtual method on WebView instead of WebViewImpl
+            to allow access to it from GraphicsContext3DInternal::initialize().
+        * src/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3DInternal::initialize):
+        (WebCore::GraphicsContext3DInternal::platformGraphicsContext3D):
+        (WebCore::GraphicsContext3DInternal::platformTexture):
+        (WebCore::GraphicsContext3DInternal::prepareTexture):
+        (WebCore::GraphicsContext3DInternal::platformLayer):
+        (WebCore::GraphicsContext3D::create):
+        (WebCore::GraphicsContext3D::prepareTexture):
+        (WebCore::GraphicsContext3D::platformLayer):
+        * src/WebGraphicsContext3DDefaultImpl.cpp:
+        (WebKit::WebGraphicsContext3DDefaultImpl::initialize):
+        (WebKit::WebGraphicsContext3DDefaultImpl::getPlatformTextureId):
+        (WebKit::WebGraphicsContext3DDefaultImpl::prepareTexture):
+        * src/WebGraphicsContext3DDefaultImpl.h:
+        * src/WebViewImpl.h:
+
+2010-06-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: return line number where breakpoint was actually set by v8 from setBreakpoint function.
+        https://bugs.webkit.org/show_bug.cgi?id=40781
+
+        * src/js/DebuggerScript.js:
+        ():
+
+2010-06-23  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Kent Tamura.
+
+        add ENABLE_DIRECTORY_UPLOAD build support
+        https://bugs.webkit.org/show_bug.cgi?id=41100
+
+        * features.gypi:
+
+2010-06-28  Zhe Su  <suzhe@chromium.org>
+
+        Reviewed by Jian Li.
+
+        [chromium]Remove deprecated code related to input method.
+        https://bugs.webkit.org/show_bug.cgi?id=41244
+
+        Also update TestWebWidget in tests/PopupMenuTest.cpp to add missing implementations.
+
+        * WebKit.gyp:
+        * public/WebCompositionCommand.h: Removed.
+        * public/WebViewClient.h:
+        * public/WebWidget.h:
+        * src/EditorClientImpl.cpp:
+        (WebKit::EditorClientImpl::setInputMethodState):
+        * src/WebPopupMenuImpl.cpp:
+        * src/WebPopupMenuImpl.h:
+        * src/WebViewImpl.cpp:
+        * src/WebViewImpl.h:
+        * tests/PopupMenuTest.cpp:
+        (WebKit::TestWebWidget::setComposition):
+        (WebKit::TestWebWidget::confirmComposition):
+        (WebKit::TestWebWidget::textInputType):
+        (WebKit::TestWebWidget::caretOrSelectionBounds):
+
+2010-06-27  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Get the selected text from plugins for right click menu
+        https://bugs.webkit.org/show_bug.cgi?id=41242
+
+        * public/WebContextMenuData.h:
+        (WebKit::WebContextMenuData::):
+        * public/WebPlugin.h:
+        (WebKit::WebPlugin::selectedText):
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::selectedText):
+        * src/WebPluginContainerImpl.h:
+
+2010-06-28  Yury Semikhatsky  <yurys@chromium.org>
+
+        Unreviewed. Fix Chromium debugger tests.
+
+        * src/js/Tests.js:
+        (.TestSuite.prototype.testDebugIntrinsicProperties):
+
+2010-06-25  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Shinichiro Hamaji.
+
+        Improve default value handling for page format properties.
+        https://bugs.webkit.org/show_bug.cgi?id=41150
+
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::pageSizeAndMarginsInPixels):
+        * src/WebFrameImpl.h:
+
+2010-06-26  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r61943.
+        http://trac.webkit.org/changeset/61943
+        https://bugs.webkit.org/show_bug.cgi?id=41251
+
+        Totally breaks webkit_unit_tests on Chromium linux and mac
+        (Requested by mnaganov on #webkit).
+
+        * WebKit.gyp:
+        * src/WebFrameImpl.cpp:
+        (WebKit::frameContentAsPlainText):
+        * tests/RunAllTests.cpp:
+        (main):
+        * tests/WebFrameTest.cpp: Removed.
+        * tests/data/iframes_test.html: Removed.
+        * tests/data/invisible_iframe.html: Removed.
+        * tests/data/visible_iframe.html: Removed.
+        * tests/data/zero_sized_iframe.html: Removed.
+
+2010-06-26  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Disable Web Timing support by default for chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=38924
+
+        * features.gypi:
+
+2010-06-25  Jay Civelli  <jcivelli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Made WebFrame not report the text from hidden frames.
+        (some pages contain hidden frames with garbage text that
+        should not be indexed or used to detect the page's language).
+        https://bugs.webkit.org/show_bug.cgi?id=39456
+
+        * DEPS:
+        * WebKit.gyp:
+        * src/WebFrameImpl.cpp:
+        (WebKit::frameContentAsPlainText):
+        * tests/RunAllTests.cpp:
+        (main):
+        * tests/WebFrameTest.cpp: Added.
+        * tests/data: Added.
+        * tests/data/iframes_test.html: Added.
+        * tests/data/invisible_iframe.html: Added.
+        * tests/data/visible_iframe.html: Added.
+        * tests/data/zero_sized_iframe.html: Added.
+
+2010-06-25  Bernhard Bauer  <bauerb@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Add plugin accessors to WebPluginContainer.
+        https://bugs.webkit.org/show_bug.cgi?id=41145
+
+        * public/WebPluginContainer.h:
+        * src/WebPluginContainerImpl.h:
+        (WebKit::WebPluginContainerImpl::setPlugin):
+
+2010-06-25  Sterling Swigart  <sswigart@google.com>
+
+        Reviewed by David Levin.
+
+        Resetting ENABLE_IMAGE_RESIZER to 0. Image.webkitGetImage needs to be developed under
+        a 0 value, at least until both the JSC and V8 bindings are in place.
+        https://bugs.webkit.org/show_bug.cgi?id=41116
+
+        * features.gypi: ENABLE_IMAGE_RESIZER=0
+
+2010-06-25  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Update chromium webkit gyp so it has
+        option to be built as DLL.
+
+        Chromium webkit is built as webkit.dll on windows
+        if it is inside chromium build and variable component
+        is set to shared_library.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41161
+
+        * WebKit.gyp:
+
+2010-06-25  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by David Levin.
+
+        [chromium] Send unhandled events to Node's default handler
+        https://bugs.webkit.org/show_bug.cgi?id=41223
+
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::handleEvent):
+
+2010-06-25  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Add new stubs for querying platform drag-and-drop and copy-and-paste data.
+
+        This change adds new stubs for querying for data in a clipboard or drag operation. This is
+        so adding support for more data types in clipboard/drag operations doesn't become
+        increasingly expensive, since we currently copy all the drag data we need every time a new
+        web drop target is entered. It also adds a new mechanism to write back to the system
+        clipboard that isn't tied to one data type.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40540
+
+        * public/WebClipboard.h:
+        (WebKit::WebClipboard::):
+        (WebKit::WebClipboard::isFormatAvailable):
+        (WebKit::WebClipboard::readPlainText):
+        (WebKit::WebClipboard::readHTML):
+        (WebKit::WebClipboard::writePlainText):
+        (WebKit::WebClipboard::writeHTML):
+        (WebKit::WebClipboard::writeURL):
+        (WebKit::WebClipboard::writeImage):
+        (WebKit::WebClipboard::writeData):
+        (WebKit::WebClipboard::readAvailableTypes):
+        (WebKit::WebClipboard::readData):
+        (WebKit::WebClipboard::readFilenames):
+        * public/WebKitClient.h:
+        * src/AssertMatchingEnums.cpp:
+        * src/ChromiumBridge.cpp:
+        (WebCore::ChromiumBridge::clipboardWriteData):
+        (WebCore::ChromiumBridge::clipboardReadAvailableTypes):
+        (WebCore::ChromiumBridge::clipboardReadData):
+        (WebCore::ChromiumBridge::clipboardReadFilenames):
+
 2010-06-25  Lei Zheng  <lzheng@chromium.org>
 
         Reviewed by Dimitri Glazkov.
diff --git a/WebKit/chromium/DEPS b/WebKit/chromium/DEPS
index b6b35a5..fe3754f 100644
--- a/WebKit/chromium/DEPS
+++ b/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '50676',
+  'chromium_rev': '51287',
 }
 
 deps = {
diff --git a/WebKit/chromium/WebKit.gyp b/WebKit/chromium/WebKit.gyp
index a53dd28..e2da1b4 100644
--- a/WebKit/chromium/WebKit.gyp
+++ b/WebKit/chromium/WebKit.gyp
@@ -52,7 +52,6 @@
     'targets': [
         {
             'target_name': 'webkit',
-            'type': '<(webkit_target_type)',
             'msvs_guid': '5ECEC9E5-8F23-47B6-93E0-C3B328B3BE65',
             'dependencies': [
                 '../../WebCore/WebCore.gyp/WebCore.gyp:webcore',
@@ -93,7 +92,6 @@
                 'public/WebColorName.h',
                 'public/WebCommon.h',
                 'public/WebCommonWorkerClient.h',
-                'public/WebCompositionCommand.h',
                 'public/WebCompositionUnderline.h',
                 'public/WebConsoleMessage.h',
                 'public/WebContextMenuData.h',
@@ -231,8 +229,6 @@
                 'src/ApplicationCacheHost.cpp',
                 'src/ApplicationCacheHostInternal.h',
                 'src/AssertMatchingEnums.cpp',
-                'src/AutocompletePopupMenuClient.cpp',
-                'src/AutocompletePopupMenuClient.h',
                 'src/AutoFillPopupMenuClient.cpp',
                 'src/AutoFillPopupMenuClient.h',
                 'src/BackForwardListClientImpl.cpp',
@@ -312,8 +308,6 @@
                 'src/StorageEventDispatcherImpl.h',
                 'src/StorageNamespaceProxy.cpp',
                 'src/StorageNamespaceProxy.h',
-                'src/SuggestionsPopupMenuClient.cpp',
-                'src/SuggestionsPopupMenuClient.h',
                 'src/TemporaryGlue.h',
                 'src/ToolsAgent.h',
                 'src/WebAccessibilityCache.cpp',
@@ -447,6 +441,34 @@
                 'src/win/WebScreenInfoFactory.cpp',
             ],
             'conditions': [
+                ['inside_chromium_build==1 and OS=="win"', {
+                    'type': '<(component)',
+
+                    'conditions': [
+                        ['component=="shared_library"', {
+                            'defines': [
+                                'WEBKIT_DLL',
+                                'USING_V8_SHARED',
+                            ],
+                            'dependencies': [
+                                '../../WebCore/WebCore.gyp/WebCore.gyp:webcore_bindings',
+                                '<(chromium_src_dir)/gpu/gpu.gyp:gles2_c_lib',
+                                '<(chromium_src_dir)/third_party/icu/icu.gyp:*',
+                                '<(chromium_src_dir)/third_party/libjpeg/libjpeg.gyp:libjpeg',
+                                '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
+                                '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
+                                '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
+                                '<(chromium_src_dir)/third_party/modp_b64/modp_b64.gyp:modp_b64',
+                                '<(chromium_src_dir)/third_party/nss/nss.gyp:*',
+                                '<(chromium_src_dir)/third_party/ots/ots.gyp:ots',
+                                '<(chromium_src_dir)/third_party/zlib/zlib.gyp:zlib',
+                                '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
+                            ],
+                        }],
+                    ],
+                }, {
+                    'type': '<(webkit_target_type)'
+                }],
                 ['OS=="linux" or OS=="freebsd"', {
                     'dependencies': [
                         '<(chromium_src_dir)/build/linux/system.gyp:fontconfig',
@@ -504,13 +526,6 @@
                         'GLEW_NO_GLU=1',
                     ],
                     'conditions': [
-                        ['OS=="win"', {
-                            'link_settings': {
-                                'libraries': [
-                                    '-lopengl32.lib',
-                                ],
-                            },
-                        }],
                         ['OS=="mac"', {
                             'link_settings': {
                                 'libraries': [
@@ -524,39 +539,46 @@
         },
         {
             'target_name': 'webkit_unit_tests',
-            'type': 'executable',
-            'msvs_guid': '7CEFE800-8403-418A-AD6A-2D52C6FC3EAD',
-            'dependencies': [
-                'webkit',
-                '../../WebCore/WebCore.gyp/WebCore.gyp:webcore',
-                '<(chromium_src_dir)/testing/gtest.gyp:gtest',
-                '<(chromium_src_dir)/base/base.gyp:base',
-                '<(chromium_src_dir)/base/base.gyp:base_i18n',
-                '<(chromium_src_dir)/gpu/gpu.gyp:gles2_c_lib',
-            ],
-            'include_dirs': [
-                'public',
-                'src',
-            ],
-            'sources': [
-                'tests/DragImageTest.cpp',
-                'tests/KeyboardTest.cpp',
-                'tests/KURLTest.cpp',
-                'tests/RunAllTests.cpp',
-            ],
             'conditions': [
-                ['OS=="win"', {
-                    'sources': [
-                        # FIXME: Port PopupMenuTest to Linux and Mac.
-                        'tests/PopupMenuTest.cpp',
-                        'tests/TransparencyWinTest.cpp',
-                        'tests/UniscribeHelperTest.cpp',
+                # FIXME: make webkit unit tests working for multi dll build.
+                ['inside_chromium_build==1 and OS=="win" and component=="shared_library"', {
+                    'type': 'none',
+                }, {
+                    'type': 'executable',
+                    'msvs_guid': '7CEFE800-8403-418A-AD6A-2D52C6FC3EAD',
+                    'dependencies': [
+                        'webkit',
+                        '../../WebCore/WebCore.gyp/WebCore.gyp:webcore',
+                        '<(chromium_src_dir)/testing/gtest.gyp:gtest',
+                        '<(chromium_src_dir)/base/base.gyp:base',
+                        '<(chromium_src_dir)/base/base.gyp:base_i18n',
+                        '<(chromium_src_dir)/gpu/gpu.gyp:gles2_c_lib',
                     ],
-                }],
-                ['OS=="mac"', {
-                    'sources!': [
-                        # FIXME: Port DragImageTest to Mac.
+                    'include_dirs': [
+                        'public',
+                        'src',
+                    ],
+                    'sources': [
                         'tests/DragImageTest.cpp',
+                        'tests/KeyboardTest.cpp',
+                        'tests/KURLTest.cpp',
+                        'tests/RunAllTests.cpp',
+                    ],
+                    'conditions': [
+                        ['OS=="win"', {
+                            'sources': [
+                                # FIXME: Port PopupMenuTest to Linux and Mac.
+                                'tests/PopupMenuTest.cpp',
+                                'tests/TransparencyWinTest.cpp',
+                                'tests/UniscribeHelperTest.cpp',
+                            ],
+                        }],
+                        ['OS=="mac"', {
+                            'sources!': [
+                                # FIXME: Port DragImageTest to Mac.
+                                'tests/DragImageTest.cpp',
+                            ],
+                        }],
                     ],
                 }],
             ],
@@ -614,6 +636,20 @@
                         '<(SHARED_INTERMEDIATE_DIR)/webkit/webkit_resources.rc',
                         '<(SHARED_INTERMEDIATE_DIR)/webkit/webkit_strings_en-US.rc',
                     ],
+                    'conditions': [
+                        ['inside_chromium_build==1 and component=="shared_library"', {
+                            'sources': [
+                                'src/ChromiumCurrentTime.cpp',
+                                'src/ChromiumThreading.cpp',
+                            ],
+                            'include_dirs': [
+                                'public',
+                            ],
+                            'dependencies': [
+                                '../../JavaScriptCore/JavaScriptCore.gyp/JavaScriptCore.gyp:wtf',
+                            ],
+                        }],
+                    ],
                     'copies': [{
                         'destination': '<(PRODUCT_DIR)',
                         'files': ['<(ahem_path)'],
diff --git a/WebKit/chromium/features.gypi b/WebKit/chromium/features.gypi
index 256192b..a280f4f 100644
--- a/WebKit/chromium/features.gypi
+++ b/WebKit/chromium/features.gypi
@@ -45,6 +45,7 @@
         'ENABLE_DASHBOARD_SUPPORT=0',
         'ENABLE_DATABASE=1',
         'ENABLE_DATAGRID=0',
+        'ENABLE_DIRECTORY_UPLOAD=1',
         'ENABLE_DOM_STORAGE=1',
         'ENABLE_EVENTSOURCE=1',
         'ENABLE_FILE_READER=1',
@@ -52,7 +53,7 @@
         'ENABLE_FILTERS=1',
         'ENABLE_GEOLOCATION=1',
         'ENABLE_ICONDATABASE=0',
-        'ENABLE_IMAGE_RESIZER=1',
+        'ENABLE_IMAGE_RESIZER=0',
         'ENABLE_INDEXED_DATABASE=1',
         'ENABLE_INPUT_SPEECH=1',
         'ENABLE_JAVASCRIPT_DEBUGGER=1',
@@ -75,6 +76,7 @@
         'ENABLE_TOUCH_EVENTS=1',
         'ENABLE_VIDEO=1',
         'ENABLE_WEB_SOCKETS=1',
+        'ENABLE_WEB_TIMING=0',
         'ENABLE_WORKERS=1',
         'ENABLE_XHTMLMP=0',
         'ENABLE_XPATH=1',
diff --git a/WebKit/chromium/public/WebAccessibilityCache.h b/WebKit/chromium/public/WebAccessibilityCache.h
index 94704a0..52e438c 100644
--- a/WebKit/chromium/public/WebAccessibilityCache.h
+++ b/WebKit/chromium/public/WebAccessibilityCache.h
@@ -43,8 +43,8 @@ public:
     WebAccessibilityCache() {}
     virtual ~WebAccessibilityCache() {}
 
-    static WebAccessibilityCache* create();
-    static void enableAccessibility();
+    WEBKIT_API static WebAccessibilityCache* create();
+    WEBKIT_API static void enableAccessibility();
 
     virtual void initialize(WebView* view) = 0;
     virtual bool isInitialized() const = 0;
diff --git a/WebKit/chromium/public/WebAccessibilityObject.h b/WebKit/chromium/public/WebAccessibilityObject.h
index 191d40f..f1b2474 100644
--- a/WebKit/chromium/public/WebAccessibilityObject.h
+++ b/WebKit/chromium/public/WebAccessibilityObject.h
@@ -64,44 +64,44 @@ public:
 
     bool isNull() const { return !m_private; }
 
-    WebString accessibilityDescription() const;
-    WebString actionVerb() const;
-    bool canSetFocusAttribute() const;
-    bool canSetValueAttribute() const;
-
-    unsigned childCount() const;
-
-    WebAccessibilityObject childAt(unsigned) const;
-    WebAccessibilityObject firstChild() const;
-    WebAccessibilityObject focusedChild() const;
-    WebAccessibilityObject lastChild() const;
-    WebAccessibilityObject nextSibling() const;
-    WebAccessibilityObject parentObject() const;
-    WebAccessibilityObject previousSibling() const;
-
-    bool isAnchor() const;
-    bool isChecked() const;
-    bool isFocused() const;
-    bool isEnabled() const;
-    bool isHovered() const;
-    bool isIndeterminate() const;
-    bool isMultiSelectable() const;
-    bool isOffScreen() const;
-    bool isPasswordField() const;
-    bool isPressed() const;
-    bool isReadOnly() const;
-    bool isVisited() const;
-
-    WebRect boundingBoxRect() const;
-    WebString helpText() const;
-    int headingLevel() const;
-    WebAccessibilityObject hitTest(const WebPoint&) const;
-    WebString keyboardShortcut() const;
-    bool performDefaultAction() const;
-    WebAccessibilityRole roleValue() const;
-    void setFocused(bool) const;
-    WebString stringValue() const;
-    WebString title() const;
+    WEBKIT_API WebString accessibilityDescription() const;
+    WEBKIT_API WebString actionVerb() const;
+    WEBKIT_API bool canSetFocusAttribute() const;
+    WEBKIT_API bool canSetValueAttribute() const;
+
+    WEBKIT_API unsigned childCount() const;
+
+    WEBKIT_API WebAccessibilityObject childAt(unsigned) const;
+    WEBKIT_API WebAccessibilityObject firstChild() const;
+    WEBKIT_API WebAccessibilityObject focusedChild() const;
+    WEBKIT_API WebAccessibilityObject lastChild() const;
+    WEBKIT_API WebAccessibilityObject nextSibling() const;
+    WEBKIT_API WebAccessibilityObject parentObject() const;
+    WEBKIT_API WebAccessibilityObject previousSibling() const;
+
+    WEBKIT_API bool isAnchor() const;
+    WEBKIT_API bool isChecked() const;
+    WEBKIT_API bool isFocused() const;
+    WEBKIT_API bool isEnabled() const;
+    WEBKIT_API bool isHovered() const;
+    WEBKIT_API bool isIndeterminate() const;
+    WEBKIT_API bool isMultiSelectable() const;
+    WEBKIT_API bool isOffScreen() const;
+    WEBKIT_API bool isPasswordField() const;
+    WEBKIT_API bool isPressed() const;
+    WEBKIT_API bool isReadOnly() const;
+    WEBKIT_API bool isVisited() const;
+
+    WEBKIT_API WebRect boundingBoxRect() const;
+    WEBKIT_API WebString helpText() const;
+    WEBKIT_API int headingLevel() const;
+    WEBKIT_API WebAccessibilityObject hitTest(const WebPoint&) const;
+    WEBKIT_API WebString keyboardShortcut() const;
+    WEBKIT_API bool performDefaultAction() const;
+    WEBKIT_API WebAccessibilityRole roleValue() const;
+    WEBKIT_API void setFocused(bool) const;
+    WEBKIT_API WebString stringValue() const;
+    WEBKIT_API WebString title() const;
 
 #if WEBKIT_IMPLEMENTATION
     WebAccessibilityObject(const WTF::PassRefPtr<WebCore::AccessibilityObject>&);
diff --git a/WebKit/chromium/public/WebClipboard.h b/WebKit/chromium/public/WebClipboard.h
index 68e22b5..6755d96 100644
--- a/WebKit/chromium/public/WebClipboard.h
+++ b/WebKit/chromium/public/WebClipboard.h
@@ -32,11 +32,13 @@
 #define WebClipboard_h
 
 #include "WebCommon.h"
+#include "WebString.h"
+#include "WebVector.h"
 
 namespace WebKit {
 
+class WebDragData;
 class WebImage;
-class WebString;
 class WebURL;
 
 class WebClipboard {
@@ -51,22 +53,35 @@ public:
         BufferStandard,
         // Used on platforms like the X Window System that treat selection
         // as a type of clipboard.
-        BufferSelection
+        BufferSelection,
+        // Read-only buffer corresponding to the current drag operation, if any.
+        BufferDrag,
     };
 
-    virtual bool isFormatAvailable(Format, Buffer) = 0;
+    virtual bool isFormatAvailable(Format, Buffer) { return false; }
 
-    virtual WebString readPlainText(Buffer) = 0;
-    virtual WebString readHTML(Buffer, WebURL*) = 0;
+    virtual WebString readPlainText(Buffer) { return WebString(); }
+    virtual WebString readHTML(Buffer, WebURL*) { return WebString(); }
 
-    virtual void writePlainText(const WebString&) = 0;
+    virtual void writePlainText(const WebString&) { }
     virtual void writeHTML(
         const WebString& htmlText, const WebURL&,
-        const WebString& plainText, bool writeSmartPaste) = 0;
+        const WebString& plainText, bool writeSmartPaste) { }
     virtual void writeURL(
-        const WebURL&, const WebString& title) = 0;
+        const WebURL&, const WebString& title) { }
     virtual void writeImage(
-        const WebImage&, const WebURL&, const WebString& title) = 0;
+        const WebImage&, const WebURL&, const WebString& title) { }
+    virtual void writeData(const WebDragData&) { }
+
+    // The following functions are used for reading platform data for copy and
+    // paste, drag and drop, and selection copy (on X).
+    virtual WebVector<WebString> readAvailableTypes(
+        Buffer, bool* containsFilenames) { return WebVector<WebString>(); }
+    // Returns true if the requested type was successfully read from the buffer. 
+    virtual bool readData(
+        Buffer, const WebString& type, WebString* data,
+        WebString* metadata) { return false; }
+    virtual WebVector<WebString> readFilenames(Buffer) { return WebVector<WebString>(); }
 
 protected:
     ~WebClipboard() {}
diff --git a/WebKit/chromium/public/WebContextMenuData.h b/WebKit/chromium/public/WebContextMenuData.h
index 8ed1f1b..e3aee4e 100644
--- a/WebKit/chromium/public/WebContextMenuData.h
+++ b/WebKit/chromium/public/WebContextMenuData.h
@@ -124,6 +124,7 @@ struct WebContextMenuData {
         CanPaste = 0x10,
         CanDelete = 0x20,
         CanSelectAll = 0x40,
+        CanTranslate = 0x80,
     };
 
     // Which edit operations are available in the context.
diff --git a/WebKit/chromium/public/WebDatabase.h b/WebKit/chromium/public/WebDatabase.h
index 4679f68..0a5d4f8 100644
--- a/WebKit/chromium/public/WebDatabase.h
+++ b/WebKit/chromium/public/WebDatabase.h
@@ -34,33 +34,15 @@
 #include "WebCommon.h"
 #include "WebSecurityOrigin.h"
 
-#if WEBKIT_IMPLEMENTATION
 namespace WebCore { class AbstractDatabase; }
-namespace WTF { template <typename T> class PassRefPtr; }
-#endif
 
 namespace WebKit {
 
 class WebDatabaseObserver;
-class WebDatabasePrivate;
 class WebString;
 
 class WebDatabase {
 public:
-    WebDatabase() : m_private(0) { }
-    WebDatabase(const WebDatabase& d) : m_private(0) { assign(d); }
-    ~WebDatabase() { reset(); }
-
-    WebDatabase& operator=(const WebDatabase& d)
-    {
-        assign(d);
-        return *this;
-    }
-
-    WEBKIT_API void reset();
-    WEBKIT_API void assign(const WebDatabase&);
-    bool isNull() const { return !m_private; }
-
     WEBKIT_API WebString name() const;
     WEBKIT_API WebString displayName() const;
     WEBKIT_API unsigned long estimatedSize() const;
@@ -76,15 +58,12 @@ public:
         const WebString& originIdentifier, const WebString& databaseName);
 
 #if WEBKIT_IMPLEMENTATION
-    WebDatabase(const WTF::PassRefPtr<WebCore::AbstractDatabase>&);
-    WebDatabase& operator=(const WTF::PassRefPtr<WebCore::AbstractDatabase>&);
-    operator WTF::PassRefPtr<WebCore::AbstractDatabase>() const;
+    WebDatabase(const WebCore::AbstractDatabase*);
 #endif
 
 private:
-    void assign(WebDatabasePrivate*);
-
-    WebDatabasePrivate* m_private;
+    WebDatabase() { }
+    const WebCore::AbstractDatabase* m_database;
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/public/WebDevToolsAgent.h b/WebKit/chromium/public/WebDevToolsAgent.h
index d1ad23c..3bdee3c 100644
--- a/WebKit/chromium/public/WebDevToolsAgent.h
+++ b/WebKit/chromium/public/WebDevToolsAgent.h
@@ -47,8 +47,6 @@ struct WebURLError;
 
 class WebDevToolsAgent {
 public:
-    WEBKIT_API static WebDevToolsAgent* create(WebView*, WebDevToolsAgentClient*);
-
     virtual ~WebDevToolsAgent() {}
 
     virtual void attach() = 0;
diff --git a/WebKit/chromium/public/WebEventListener.h b/WebKit/chromium/public/WebEventListener.h
index 52de1cd..62ca0de 100644
--- a/WebKit/chromium/public/WebEventListener.h
+++ b/WebKit/chromium/public/WebEventListener.h
@@ -31,6 +31,8 @@
 #ifndef WebEventListener_h
 #define WebEventListener_h
 
+#include "WebCommon.h"
+
 #if WEBKIT_IMPLEMENTATION
 namespace WebCore { class Node; }
 #endif
@@ -45,8 +47,8 @@ class WebString;
 
 class WebEventListener {
 public:
-    WebEventListener();
-    virtual ~WebEventListener();
+    WEBKIT_API WebEventListener();
+    WEBKIT_API virtual ~WebEventListener();
 
     // Called when an event is received.
     virtual void handleEvent(const WebEvent&) = 0;
diff --git a/WebKit/chromium/public/WebFrame.h b/WebKit/chromium/public/WebFrame.h
index 319ce38..c4fa7ae 100644
--- a/WebKit/chromium/public/WebFrame.h
+++ b/WebKit/chromium/public/WebFrame.h
@@ -408,12 +408,16 @@ public:
     // Returns true if page box (margin boxes and page borders) is visible.
     virtual bool isPageBoxVisible(int pageIndex) = 0;
 
-    // Returns the page area rectangle in pixels, assuming 96 pixels per inch.
-    virtual WebRect pageAreaRectInPixels(int pageIndex) = 0;
-
-    // Returns the preferred page size in pixels, assuming 96 pixels per inch.
-    virtual WebSize preferredPageSizeInPixels(int pageIndex) = 0;
-
+    // Returns the preferred page size and margins in pixels, assuming 96
+    // pixels per inch. pageSize, marginTop, marginRight, marginBottom,
+    // marginLeft must be initialized to the default values that are used if
+    // auto is specified.
+    virtual void pageSizeAndMarginsInPixels(int pageIndex,
+                                            WebSize& pageSize,
+                                            int& marginTop,
+                                            int& marginRight,
+                                            int& marginBottom,
+                                            int& marginLeft) = 0;
 
     // Find-in-page --------------------------------------------------------
 
@@ -484,6 +488,11 @@ public:
         WebInputElement,
         WebPasswordAutocompleteListener*) = 0;
 
+    // Dispatches an Autocompletion notification to registered listener if one
+    // exists that is registered against the WebInputElement specified.
+    virtual void notifiyPasswordListenerOfAutocomplete(
+        const WebInputElement&) = 0;
+
 
     // Utility -------------------------------------------------------------
 
diff --git a/WebKit/chromium/public/WebGeolocationServiceMock.h b/WebKit/chromium/public/WebGeolocationServiceMock.h
index d1a146b..407fe9d 100644
--- a/WebKit/chromium/public/WebGeolocationServiceMock.h
+++ b/WebKit/chromium/public/WebGeolocationServiceMock.h
@@ -31,6 +31,7 @@
 #ifndef WebGeolocationServiceMock_h
 #define WebGeolocationServiceMock_h
 
+#include "WebCommon.h"
 #include "WebGeolocationService.h"
 
 namespace WebKit {
@@ -39,10 +40,10 @@ class WebString;
 
 class WebGeolocationServiceMock : public WebGeolocationService {
 public:
-    static WebGeolocationServiceMock* createWebGeolocationServiceMock();
-    static void setMockGeolocationPermission(bool allowed);
-    static void setMockGeolocationPosition(double latitude, double longitude, double accuracy);
-    static void setMockGeolocationError(int errorCode, const WebString& message);
+    WEBKIT_API static WebGeolocationServiceMock* createWebGeolocationServiceMock();
+    WEBKIT_API static void setMockGeolocationPermission(bool allowed);
+    WEBKIT_API static void setMockGeolocationPosition(double latitude, double longitude, double accuracy);
+    WEBKIT_API static void setMockGeolocationError(int errorCode, const WebString& message);
 
 protected:
     static bool s_mockGeolocationPermission;
diff --git a/WebKit/chromium/public/WebGraphicsContext3D.h b/WebKit/chromium/public/WebGraphicsContext3D.h
index dc4f534..4378afb 100644
--- a/WebKit/chromium/public/WebGraphicsContext3D.h
+++ b/WebKit/chromium/public/WebGraphicsContext3D.h
@@ -40,6 +40,8 @@ namespace WebKit {
 // Typedef for server-side objects like OpenGL textures and program objects.
 typedef unsigned int WebGLId;
 
+class WebView;
+
 // This interface abstracts the operations performed by the
 // GraphicsContext3D in order to implement WebGL. Nearly all of the
 // methods exposed on this interface map directly to entry points in
@@ -77,11 +79,11 @@ public:
 
     // Creates a "default" implementation of WebGraphicsContext3D which calls
     // OpenGL directly.
-    static WebGraphicsContext3D* createDefault();
+    WEBKIT_API static WebGraphicsContext3D* createDefault();
 
     // Initializes the graphics context; should be the first operation performed
     // on newly-constructed instances. Returns true on success.
-    virtual bool initialize(Attributes) = 0;
+    virtual bool initialize(Attributes, WebView*) = 0;
 
     // Makes the OpenGL context current on the current thread. Returns true on
     // success.
@@ -108,6 +110,15 @@ public:
     // Returns true on success.
     virtual bool readBackFramebuffer(unsigned char* pixels, size_t bufferSize) = 0;
 
+    // Returns the id of the texture which is used for storing the contents of
+    // the framebuffer associated with this context. This texture is accessible
+    // by the gpu-based page compositor.
+    virtual unsigned getPlatformTextureId() = 0;
+
+    // Copies the contents of the off-screen render target used by the WebGL
+    // context to the corresponding texture used by the compositor.
+    virtual void prepareTexture() = 0;
+
     // Synthesizes an OpenGL error which will be returned from a
     // later call to getError. This is used to emulate OpenGL ES
     // 2.0 behavior on the desktop and to enforce additional error
@@ -169,6 +180,8 @@ public:
     virtual bool getActiveAttrib(WebGLId program, unsigned long index, ActiveInfo&) = 0;
     virtual bool getActiveUniform(WebGLId program, unsigned long index, ActiveInfo&) = 0;
 
+    virtual void getAttachedShaders(WebGLId program, int maxCount, int* count, unsigned int* shaders) = 0;
+
     virtual int  getAttribLocation(WebGLId program, const char* name) = 0;
 
     virtual void getBooleanv(unsigned long pname, unsigned char* value) = 0;
diff --git a/WebKit/chromium/public/WebIDBDatabaseError.h b/WebKit/chromium/public/WebIDBDatabaseError.h
index f56a0d0..255d175 100644
--- a/WebKit/chromium/public/WebIDBDatabaseError.h
+++ b/WebKit/chromium/public/WebIDBDatabaseError.h
@@ -40,11 +40,11 @@ namespace WebKit {
 // See comment in WebIndexedDatabase for a high level overview these classes.
 class WebIDBDatabaseError {
 public:
-    ~WebIDBDatabaseError();
+    WEBKIT_API ~WebIDBDatabaseError();
 
-    WebIDBDatabaseError(unsigned short code, const WebString& message) { assign(code, message); }
-    WebIDBDatabaseError(const WebIDBDatabaseError& e) { assign(e); }
-    WebIDBDatabaseError& operator=(const WebIDBDatabaseError& e)
+    WEBKIT_API WebIDBDatabaseError(unsigned short code, const WebString& message) { assign(code, message); }
+    WEBKIT_API WebIDBDatabaseError(const WebIDBDatabaseError& e) { assign(e); }
+    WEBKIT_API WebIDBDatabaseError& operator=(const WebIDBDatabaseError& e)
     {
         assign(e);
         return *this;
diff --git a/WebKit/chromium/public/WebKitClient.h b/WebKit/chromium/public/WebKitClient.h
index d1da883..48765ac 100644
--- a/WebKit/chromium/public/WebKitClient.h
+++ b/WebKit/chromium/public/WebKitClient.h
@@ -83,7 +83,6 @@ public:
     // May return null.
     virtual WebCookieJar* cookieJar() { return 0; }
 
-
     // DOM Storage --------------------------------------------------
 
     // Return a LocalStorage namespace that corresponds to the following path.
diff --git a/WebKit/chromium/public/WebNotification.h b/WebKit/chromium/public/WebNotification.h
index 787d4f3..f872111 100644
--- a/WebKit/chromium/public/WebNotification.h
+++ b/WebKit/chromium/public/WebNotification.h
@@ -64,7 +64,7 @@ public:
 
     // Operators required to put WebNotification in an ordered map.
     bool equals(const WebNotification& other) const { return m_private == other.m_private; }
-    bool lessThan(const WebNotification& other) const;
+    WEBKIT_API bool lessThan(const WebNotification& other) const;
 
     // Is the notification HTML vs. icon-title-text?
     WEBKIT_API bool isHTML() const;
diff --git a/WebKit/chromium/public/WebPasswordFormData.h b/WebKit/chromium/public/WebPasswordFormData.h
index e1804d1..30ce5ca 100644
--- a/WebKit/chromium/public/WebPasswordFormData.h
+++ b/WebKit/chromium/public/WebPasswordFormData.h
@@ -40,7 +40,7 @@ namespace WebKit {
 struct WebPasswordFormData {
     // If the provided form is suitable for password completion, isValid() will
     // return true;
-    WebPasswordFormData(const WebFormElement&);
+    WEBKIT_API WebPasswordFormData(const WebFormElement&);
 
     // If creation failed, return false.
     bool isValid() const { return action.isValid(); }
diff --git a/WebKit/chromium/public/WebPlugin.h b/WebKit/chromium/public/WebPlugin.h
index f57c621..57f1cba 100644
--- a/WebKit/chromium/public/WebPlugin.h
+++ b/WebKit/chromium/public/WebPlugin.h
@@ -32,6 +32,7 @@
 #define WebPlugin_h
 
 #include "WebCanvas.h"
+#include "WebString.h"
 
 struct NPObject;
 
@@ -93,6 +94,8 @@ public:
     // Ends the print operation.
     virtual void printEnd() { }
 
+    virtual WebString selectedText() { return WebString(); }
+
 protected:
     ~WebPlugin() { }
 };
diff --git a/WebKit/chromium/public/WebPluginContainer.h b/WebKit/chromium/public/WebPluginContainer.h
index 7b23f08..66ef9ab 100644
--- a/WebKit/chromium/public/WebPluginContainer.h
+++ b/WebKit/chromium/public/WebPluginContainer.h
@@ -36,6 +36,7 @@ struct NPObject;
 namespace WebKit {
 
 class WebElement;
+class WebPlugin;
 class WebString;
 class WebURL;
 class WebURLRequest;
@@ -77,6 +78,9 @@ public:
     virtual void loadFrameRequest(
         const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData) = 0;
 
+    virtual WebPlugin* plugin() = 0;
+    virtual void setPlugin(WebPlugin*) = 0;
+
 protected:
     ~WebPluginContainer() { }
 };
diff --git a/WebKit/chromium/public/WebSearchableFormData.h b/WebKit/chromium/public/WebSearchableFormData.h
index e453387..5cd1d9b 100644
--- a/WebKit/chromium/public/WebSearchableFormData.h
+++ b/WebKit/chromium/public/WebSearchableFormData.h
@@ -43,7 +43,7 @@ class WebSearchableFormData {
 public:
     // If the provided form is suitable for automated searching, isValid()
     // will return false.
-    WebSearchableFormData(const WebFormElement&);
+    WEBKIT_API WebSearchableFormData(const WebFormElement&);
 
     bool isValid() { return m_url.isValid(); }
 
diff --git a/WebKit/chromium/public/WebStorageEventDispatcher.h b/WebKit/chromium/public/WebStorageEventDispatcher.h
index 57750e8..37ceb7c 100644
--- a/WebKit/chromium/public/WebStorageEventDispatcher.h
+++ b/WebKit/chromium/public/WebStorageEventDispatcher.h
@@ -41,7 +41,7 @@ class WebURL;
 // FIXME: Make this (or something) work for SessionStorage!
 class WebStorageEventDispatcher {
 public:
-    static WebStorageEventDispatcher* create();
+    WEBKIT_API static WebStorageEventDispatcher* create();
 
     virtual ~WebStorageEventDispatcher() { }
 
diff --git a/WebKit/chromium/public/WebString.h b/WebKit/chromium/public/WebString.h
index d2cf9ea..2c9664e 100644
--- a/WebKit/chromium/public/WebString.h
+++ b/WebKit/chromium/public/WebString.h
@@ -131,7 +131,7 @@ public:
     WebString(const NullableString16& s) : m_private(0)
     {
         if (s.is_null())
-            assign(0);
+            reset();
         else
             assign(s.string().data(), s.string().length());
     }
@@ -139,7 +139,7 @@ public:
     WebString& operator=(const NullableString16& s)
     {
         if (s.is_null())
-            assign(0);
+            reset();
         else
             assign(s.string().data(), s.string().length());
         return *this;
diff --git a/WebKit/chromium/public/WebView.h b/WebKit/chromium/public/WebView.h
index eadfc26..1efd752 100644
--- a/WebKit/chromium/public/WebView.h
+++ b/WebKit/chromium/public/WebView.h
@@ -32,6 +32,8 @@
 #define WebView_h
 
 #include "WebDragOperation.h"
+#include "WebString.h"
+#include "WebVector.h"
 #include "WebWidget.h"
 
 namespace WebKit {
@@ -42,13 +44,13 @@ class WebDevToolsAgentClient;
 class WebDragData;
 class WebFrame;
 class WebFrameClient;
+class WebGLES2Context;
 class WebNode;
 class WebSettings;
 class WebString;
 class WebViewClient;
 struct WebMediaPlayerAction;
 struct WebPoint;
-template <typename T> class WebVector;
 
 class WebView : public WebWidget {
 public:
@@ -57,7 +59,7 @@ public:
     // Creates a WebView that is NOT yet initialized.  You will need to
     // call initializeMainFrame to finish the initialization.  It is valid
     // to pass null WebViewClient and WebDevToolsAgentClient pointers.
-    WEBKIT_API static WebView* create(WebViewClient*, WebDevToolsAgentClient* = 0);
+    WEBKIT_API static WebView* create(WebViewClient*, WebDevToolsAgentClient*);
 
     // After creating a WebView, you should immediately call this method.
     // You can optionally modify the settings before calling this method.
@@ -224,7 +226,6 @@ public:
     // The embedder may optionally engage a WebDevToolsAgent.  This may only
     // be set once per WebView.
     virtual WebDevToolsAgent* devToolsAgent() = 0;
-    virtual void setDevToolsAgent(WebDevToolsAgent*) = 0;
 
 
     // Accessibility -------------------------------------------------------
@@ -233,17 +234,18 @@ public:
     virtual WebAccessibilityObject accessibilityObject() = 0;
 
 
-    // AutoFill / Autocomplete ---------------------------------------------
+    // AutoFill  -----------------------------------------------------------
 
     // Notifies the WebView that AutoFill suggestions are available for a node.
     virtual void applyAutoFillSuggestions(
         const WebNode&,
         const WebVector<WebString>& names,
         const WebVector<WebString>& labels,
-        int defaultSuggestionIndex) = 0;
+        int separatorIndex) = 0;
 
     // Notifies the WebView that Autocomplete suggestions are available for a
     // node.
+    // DEPRECATED: merging with applyAutoFillSuggestions.
     virtual void applyAutocompleteSuggestions(
         const WebNode&,
         const WebVector<WebString>& suggestions,
@@ -281,10 +283,22 @@ public:
                                     unsigned inactiveForegroundColor) = 0;
 
     // User scripts --------------------------------------------------------
-    virtual void addUserScript(const WebString& sourceCode,
-                               bool runAtStart) = 0;
-    virtual void addUserStyleSheet(const WebString& sourceCode) = 0;
-    virtual void removeAllUserContent() = 0;
+    // FIXME: These two methods are DEPRECATED. Remove once Chromium has been rolled.
+    virtual void addUserScript(const WebString& sourceCode, bool runAtStart)
+    {
+        addUserScript(sourceCode, WebVector<WebString>(), runAtStart);
+    }
+    virtual void addUserStyleSheet(const WebString& sourceCode)
+    {
+        addUserStyleSheet(sourceCode, WebVector<WebString>());
+    }
+
+    WEBKIT_API static void addUserScript(const WebString& sourceCode,
+                                         const WebVector<WebString>& patterns,
+                                         bool runAtStart);
+    WEBKIT_API static void addUserStyleSheet(const WebString& sourceCode,
+                                             const WebVector<WebString>& patterns);
+    WEBKIT_API static void removeAllUserContent();
 
     // Modal dialog support ------------------------------------------------
 
@@ -293,6 +307,12 @@ public:
     WEBKIT_API static void willEnterModalLoop();
     WEBKIT_API static void didExitModalLoop();
 
+    // GPU acceleration support --------------------------------------------
+
+    // Returns the GLES2Context associated with this WebView. One will be
+    // created if it doesn't already exist.
+    virtual WebGLES2Context* gles2Context() = 0;
+
 protected:
     ~WebView() {}
 };
diff --git a/WebKit/chromium/public/WebViewClient.h b/WebKit/chromium/public/WebViewClient.h
index 0712815..a59289d 100644
--- a/WebKit/chromium/public/WebViewClient.h
+++ b/WebKit/chromium/public/WebViewClient.h
@@ -126,9 +126,6 @@ public:
     virtual bool isSmartInsertDeleteEnabled() { return true; }
     virtual bool isSelectTrailingWhitespaceEnabled() { return true; }
 
-    // DEPRECATED: replaced by WebWidgetClient::resetInputMethod().
-    virtual void setInputMethodEnabled(bool enabled) { }
-
     virtual void didBeginEditing() { }
     virtual void didChangeSelection(bool isSelectionEmpty) { }
     virtual void didChangeContents() { }
diff --git a/WebKit/chromium/public/WebWidget.h b/WebKit/chromium/public/WebWidget.h
index 3da245b..5c9f54e 100644
--- a/WebKit/chromium/public/WebWidget.h
+++ b/WebKit/chromium/public/WebWidget.h
@@ -33,7 +33,6 @@
 
 #include "WebCanvas.h"
 #include "WebCommon.h"
-#include "WebCompositionCommand.h"
 #include "WebCompositionUnderline.h"
 #include "WebTextInputType.h"
 #include "WebTextDirection.h"
@@ -79,13 +78,6 @@ public:
     // Called to inform the WebWidget that it has gained or lost keyboard focus.
     virtual void setFocus(bool) = 0;
 
-    // DEPRECATED. It's replaced by setComposition() and confirmComposition().
-    virtual bool handleCompositionEvent(WebCompositionCommand command,
-                                        int cursorPosition,
-                                        int targetStart,
-                                        int targetEnd,
-                                        const WebString& text) = 0;
-
     // Called to inform the WebWidget of a new composition text.
     // If selectionStart and selectionEnd has the same value, then it indicates
     // the input caret position. If the text is empty, then the existing
@@ -101,10 +93,6 @@ public:
     // Returns true if there is an ongoing composition.
     virtual bool confirmComposition() = 0;
 
-    // DEPRECATED. It's replaced by textInputType() and
-    // caretOrSelectionBounds().
-    virtual bool queryCompositionStatus(bool* enabled, WebRect* caretBounds) = 0;
-
     // Returns the current text input type of this WebWidget.
     virtual WebTextInputType textInputType() = 0;
 
diff --git a/WebKit/chromium/src/AssertMatchingEnums.cpp b/WebKit/chromium/src/AssertMatchingEnums.cpp
index 819339d..5736ca0 100644
--- a/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -181,6 +181,7 @@ COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::FormatSmartPaste, PasteboardPrivate::
 
 COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::BufferStandard, PasteboardPrivate::StandardBuffer);
 COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::BufferSelection, PasteboardPrivate::SelectionBuffer);
+COMPILE_ASSERT_MATCHING_ENUM(WebClipboard::BufferDrag, PasteboardPrivate::DragBuffer);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypePointer, PlatformCursor::TypePointer);
 COMPILE_ASSERT_MATCHING_ENUM(WebCursorInfo::TypeCross, PlatformCursor::TypeCross);
diff --git a/WebKit/chromium/src/AutoFillPopupMenuClient.cpp b/WebKit/chromium/src/AutoFillPopupMenuClient.cpp
index 04c02f2..1294561 100644
--- a/WebKit/chromium/src/AutoFillPopupMenuClient.cpp
+++ b/WebKit/chromium/src/AutoFillPopupMenuClient.cpp
@@ -31,7 +31,12 @@
 #include "config.h"
 #include "AutoFillPopupMenuClient.h"
 
+#include "CSSStyleSelector.h"
+#include "CSSValueKeywords.h"
+#include "Chrome.h"
+#include "FrameView.h"
 #include "HTMLInputElement.h"
+#include "RenderTheme.h"
 #include "WebNode.h"
 #include "WebString.h"
 #include "WebVector.h"
@@ -42,6 +47,18 @@ using namespace WebCore;
 
 namespace WebKit {
 
+AutoFillPopupMenuClient::AutoFillPopupMenuClient()
+    : m_separatorIndex(-1)
+    , m_selectedIndex(-1)
+    , m_textField(0)
+    , m_AutocompleteModeEnabled(false)
+{
+}
+
+AutoFillPopupMenuClient::~AutoFillPopupMenuClient()
+{
+}
+
 unsigned AutoFillPopupMenuClient::getSuggestionsCount() const
 {
     return m_names.size() + ((m_separatorIndex == -1) ? 0 : 1);
@@ -75,19 +92,35 @@ void AutoFillPopupMenuClient::removeSuggestionAtIndex(unsigned listIndex)
 
 void AutoFillPopupMenuClient::valueChanged(unsigned listIndex, bool fireEvents)
 {
-    WebViewImpl* webView = getWebView();
-    if (!webView)
-        return;
-
-    if (m_separatorIndex != -1 && listIndex > static_cast<unsigned>(m_separatorIndex))
-        --listIndex;
-
-    ASSERT(listIndex < m_names.size());
-
-    webView->client()->didAcceptAutoFillSuggestion(WebNode(getTextField()),
-                                                   m_names[listIndex],
-                                                   m_labels[listIndex],
-                                                   listIndex);
+    // DEPRECATED: Will be removed once AutoFill and Autocomplete merge is
+    // completed.
+    if (m_AutocompleteModeEnabled) {
+        m_textField->setValue(getSuggestion(listIndex));
+
+        WebViewImpl* webView = getWebView();
+        if (!webView)
+            return;
+
+        EditorClientImpl* editor =
+            static_cast<EditorClientImpl*>(webView->page()->editorClient());
+        ASSERT(editor);
+        editor->onAutocompleteSuggestionAccepted(
+            static_cast<HTMLInputElement*>(m_textField.get()));
+    } else {
+      WebViewImpl* webView = getWebView();
+      if (!webView)
+          return;
+
+      if (m_separatorIndex != -1 && listIndex > static_cast<unsigned>(m_separatorIndex))
+          --listIndex;
+
+      ASSERT(listIndex < m_names.size());
+
+      webView->client()->didAcceptAutoFillSuggestion(WebNode(getTextField()),
+                                                     m_names[listIndex],
+                                                     m_labels[listIndex],
+                                                     listIndex);
+    }
 }
 
 void AutoFillPopupMenuClient::selectionChanged(unsigned listIndex, bool fireEvents)
@@ -108,22 +141,52 @@ void AutoFillPopupMenuClient::selectionChanged(unsigned listIndex, bool fireEven
 
 void AutoFillPopupMenuClient::selectionCleared()
 {
-    WebViewImpl* webView = getWebView();
-    if (!webView)
-        return;
+    // Same effect desired as popupDidHide, so call through.
+    popupDidHide();
+}
 
-    webView->suggestionsPopupDidHide();
-    webView->client()->didClearAutoFillSelection(WebNode(getTextField()));
+String AutoFillPopupMenuClient::itemText(unsigned listIndex) const
+{
+    return getSuggestion(listIndex);
+}
+
+PopupMenuStyle AutoFillPopupMenuClient::itemStyle(unsigned listIndex) const
+{
+    return *m_style;
+}
+
+PopupMenuStyle AutoFillPopupMenuClient::menuStyle() const
+{
+    return *m_style;
+}
+
+int AutoFillPopupMenuClient::clientPaddingLeft() const
+{
+    // Bug http://crbug.com/7708 seems to indicate the style can be 0.
+    RenderStyle* style = textFieldStyle();
+    if (!style)
+       return 0;
+
+    return RenderTheme::defaultTheme()->popupInternalPaddingLeft(style);
+}
+
+int AutoFillPopupMenuClient::clientPaddingRight() const
+{
+    // Bug http://crbug.com/7708 seems to indicate the style can be 0.
+    RenderStyle* style = textFieldStyle();
+    if (!style)
+        return 0;
+
+    return RenderTheme::defaultTheme()->popupInternalPaddingRight(style);
 }
 
 void AutoFillPopupMenuClient::popupDidHide()
 {
-    // FIXME: Refactor this method, as selectionCleared() and popupDidHide()
-    // share the exact same functionality.
     WebViewImpl* webView = getWebView();
     if (!webView)
         return;
 
+    webView->autoFillPopupDidHide();
     webView->client()->didClearAutoFillSelection(WebNode(getTextField()));
 }
 
@@ -132,6 +195,29 @@ bool AutoFillPopupMenuClient::itemIsSeparator(unsigned listIndex) const
     return (m_separatorIndex != -1 && static_cast<unsigned>(m_separatorIndex) == listIndex);
 }
 
+void AutoFillPopupMenuClient::setTextFromItem(unsigned listIndex)
+{
+    m_textField->setValue(getSuggestion(listIndex));
+}
+
+FontSelector* AutoFillPopupMenuClient::fontSelector() const
+{
+    return m_textField->document()->styleSelector()->fontSelector();
+}
+
+HostWindow* AutoFillPopupMenuClient::hostWindow() const
+{
+    return m_textField->document()->view()->hostWindow();
+}
+
+PassRefPtr<Scrollbar> AutoFillPopupMenuClient::createScrollbar(
+    ScrollbarClient* client,
+    ScrollbarOrientation orientation,
+    ScrollbarControlSize size)
+{
+    return Scrollbar::createNativeScrollbar(client, orientation, size);
+}
+
 void AutoFillPopupMenuClient::initialize(
     HTMLInputElement* textField,
     const WebVector<WebString>& names,
@@ -141,11 +227,26 @@ void AutoFillPopupMenuClient::initialize(
     ASSERT(names.size() == labels.size());
     ASSERT(separatorIndex < static_cast<int>(names.size()));
 
+    m_selectedIndex = -1;
+    m_textField = textField;
+
     // The suggestions must be set before initializing the
-    // SuggestionsPopupMenuClient.
+    // AutoFillPopupMenuClient.
     setSuggestions(names, labels, separatorIndex);
 
-    SuggestionsPopupMenuClient::initialize(textField, -1);
+    FontDescription fontDescription;
+    RenderTheme::defaultTheme()->systemFont(CSSValueWebkitControl,
+                                            fontDescription);
+    RenderStyle* style = m_textField->computedStyle();
+    fontDescription.setComputedSize(style->fontDescription().computedSize());
+
+    Font font(fontDescription, 0, 0);
+    font.update(textField->document()->styleSelector()->fontSelector());
+    // The direction of text in popup menu is set the same as the direction of
+    // the input element: textField.
+    m_style.set(new PopupMenuStyle(Color::black, Color::white, font, true,
+                                   Length(WebCore::Fixed),
+                                   textField->renderer()->style()->direction()));
 }
 
 void AutoFillPopupMenuClient::setSuggestions(const WebVector<WebString>& names,
@@ -169,4 +270,30 @@ void AutoFillPopupMenuClient::setSuggestions(const WebVector<WebString>& names,
         setSelectedIndex(-1);
 }
 
+WebViewImpl* AutoFillPopupMenuClient::getWebView() const
+{
+    Frame* frame = m_textField->document()->frame();
+    if (!frame)
+        return 0;
+
+    Page* page = frame->page();
+    if (!page)
+        return 0;
+
+    return static_cast<ChromeClientImpl*>(page->chrome()->client())->webView();
+}
+
+RenderStyle* AutoFillPopupMenuClient::textFieldStyle() const
+{
+    RenderStyle* style = m_textField->computedStyle();
+    if (!style) {
+        // It seems we can only have a 0 style in a TextField if the
+        // node is detached, in which case we the popup shoud not be
+        // showing.  Please report this in http://crbug.com/7708 and
+        // include the page you were visiting.
+        ASSERT_NOT_REACHED();
+    }
+    return style;
+}
+
 } // namespace WebKit
diff --git a/WebKit/chromium/src/AutoFillPopupMenuClient.h b/WebKit/chromium/src/AutoFillPopupMenuClient.h
index 488bdb1..a7d6693 100644
--- a/WebKit/chromium/src/AutoFillPopupMenuClient.h
+++ b/WebKit/chromium/src/AutoFillPopupMenuClient.h
@@ -31,31 +31,64 @@
 #ifndef AutoFillPopupMenuClient_h
 #define AutoFillPopupMenuClient_h
 
-#include "SuggestionsPopupMenuClient.h"
+#include "PopupMenuClient.h"
 
 namespace WebCore {
 class HTMLInputElement;
+class PopupMenuStyle;
+class RenderStyle;
 }
 
 namespace WebKit {
 class WebString;
+class WebViewImpl;
 template <typename T> class WebVector;
 
 // The AutoFill suggestions popup menu client, used to display name suggestions
 // with right-justified labels.
-class AutoFillPopupMenuClient : public SuggestionsPopupMenuClient {
+class AutoFillPopupMenuClient : public WebCore::PopupMenuClient {
 public:
-    // SuggestionsPopupMenuClient implementation:
+    AutoFillPopupMenuClient();
+    virtual ~AutoFillPopupMenuClient();
+
+    // Returns the number of suggestions available.
     virtual unsigned getSuggestionsCount() const;
+
+    // Returns the suggestion at |listIndex|.
     virtual WebString getSuggestion(unsigned listIndex) const;
+
+    // Removes the suggestion at |listIndex| from the list of suggestions.
     virtual void removeSuggestionAtIndex(unsigned listIndex);
 
-    // WebCore::PopupMenuClient implementation:
+    // WebCore::PopupMenuClient methods:
     virtual void valueChanged(unsigned listIndex, bool fireEvents = true);
-    virtual void selectionChanged(unsigned listIndex, bool fireEvents = true);
+    virtual void selectionChanged(unsigned, bool);
     virtual void selectionCleared();
+    virtual WebCore::String itemText(unsigned listIndex) const;
+    virtual WebCore::String itemToolTip(unsigned lastIndex) const { return WebCore::String(); }
+    virtual WebCore::String itemAccessibilityText(unsigned lastIndex) const { return WebCore::String(); }
+    virtual bool itemIsEnabled(unsigned listIndex) const { return true; }
+    virtual WebCore::PopupMenuStyle itemStyle(unsigned listIndex) const;
+    virtual WebCore::PopupMenuStyle menuStyle() const;
+    virtual int clientInsetLeft() const { return 0; }
+    virtual int clientInsetRight() const { return 0; }
+    virtual int clientPaddingLeft() const;
+    virtual int clientPaddingRight() const;
+    virtual int listSize() const { return getSuggestionsCount(); }
+    virtual int selectedIndex() const { return m_selectedIndex; }
     virtual void popupDidHide();
     virtual bool itemIsSeparator(unsigned listIndex) const;
+    virtual bool itemIsLabel(unsigned listIndex) const { return false; }
+    virtual bool itemIsSelected(unsigned listIndex) const { return false; }
+    virtual bool shouldPopOver() const { return false; }
+    virtual bool valueShouldChangeOnHotTrack() const { return false; }
+    virtual void setTextFromItem(unsigned listIndex);
+    virtual WebCore::FontSelector* fontSelector() const;
+    virtual WebCore::HostWindow* hostWindow() const;
+    virtual PassRefPtr<WebCore::Scrollbar> createScrollbar(
+        WebCore::ScrollbarClient* client,
+        WebCore::ScrollbarOrientation orientation,
+        WebCore::ScrollbarControlSize size);
 
     void initialize(WebCore::HTMLInputElement*,
                     const WebVector<WebString>& names,
@@ -66,12 +99,34 @@ public:
                         const WebVector<WebString>& labels,
                         int separatorIndex);
 
+    // DEPRECATED: Will be removed once Autocomplete and AutoFill merge is
+    // complete.
+    void setAutocompleteMode(bool enabled) { m_AutocompleteModeEnabled = enabled; }
+
 private:
+    WebViewImpl* getWebView() const;
+    WebCore::HTMLInputElement* getTextField() const { return m_textField.get(); }
+    WebCore::RenderStyle* textFieldStyle() const;
+
+    int getSelectedIndex() const { return m_selectedIndex; }
+    void setSelectedIndex(int index) { m_selectedIndex = index; }
+
+    // The names and labels that make up the text of the menu items.
     Vector<WebCore::String> m_names;
     Vector<WebCore::String> m_labels;
 
     // The index of the separator.  -1 if there is no separator.
     int m_separatorIndex;
+
+    // The index of the selected item.  -1 if there is no selected item.
+    int m_selectedIndex;
+
+    RefPtr<WebCore::HTMLInputElement> m_textField;
+    OwnPtr<WebCore::PopupMenuStyle> m_style;
+
+    // DEPRECATED: Will be removed once Autocomplete and AutoFill merge is
+    // complete.
+    bool m_AutocompleteModeEnabled;
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/ChromiumBridge.cpp b/WebKit/chromium/src/ChromiumBridge.cpp
index 4963f78..5124a7f 100644
--- a/WebKit/chromium/src/ChromiumBridge.cpp
+++ b/WebKit/chromium/src/ChromiumBridge.cpp
@@ -40,6 +40,7 @@
 #include "WebCookieJar.h"
 #include "WebCursorInfo.h"
 #include "WebData.h"
+#include "WebDragData.h"
 #include "WebFileSystem.h"
 #include "WebFrameClient.h"
 #include "WebFrameImpl.h"
@@ -197,6 +198,48 @@ void ChromiumBridge::clipboardWriteImage(NativeImagePtr image,
     webKitClient()->clipboard()->writeImage(webImage, sourceURL, title);
 }
 
+void ChromiumBridge::clipboardWriteData(ClipboardData* data)
+{
+    notImplemented();
+    WebDragData dragData; // FIXME: Define the conversion from ClipboardData to WebDragData.
+    webKitClient()->clipboard()->writeData(dragData);
+}
+
+HashSet<String> ChromiumBridge::clipboardReadAvailableTypes(
+    PasteboardPrivate::ClipboardBuffer buffer, bool* containsFilenames)
+{
+    WebVector<WebString> result = webKitClient()->clipboard()->readAvailableTypes(
+        static_cast<WebClipboard::Buffer>(buffer), containsFilenames);
+    HashSet<String> types;
+    for (size_t i = 0; i < result.size(); ++i)
+        types.add(result[i]);
+    return types;
+}
+
+bool ChromiumBridge::clipboardReadData(PasteboardPrivate::ClipboardBuffer buffer,
+                                       const String& type, String& data, String& metadata)
+{
+    WebString resultData;
+    WebString resultMetadata;
+    bool succeeded = webKitClient()->clipboard()->readData(
+        static_cast<WebClipboard::Buffer>(buffer), type, &resultData, &resultMetadata);
+    if (succeeded) {
+        data = resultData;
+        metadata = resultMetadata;
+    }
+    return succeeded;
+}
+
+Vector<String> ChromiumBridge::clipboardReadFilenames(PasteboardPrivate::ClipboardBuffer buffer)
+{
+    WebVector<WebString> result = webKitClient()->clipboard()->readFilenames(
+        static_cast<WebClipboard::Buffer>(buffer));
+    Vector<String> convertedResult;
+    for (size_t i = 0; i < result.size(); ++i)
+        convertedResult.append(result[i]);
+    return convertedResult;
+}
+
 // Cookies --------------------------------------------------------------------
 
 void ChromiumBridge::setCookies(const Document* document, const KURL& url,
diff --git a/WebKit/chromium/src/ContextMenuClientImpl.cpp b/WebKit/chromium/src/ContextMenuClientImpl.cpp
index 8dd3393..f757d9c 100644
--- a/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -46,6 +46,7 @@
 #include "KURL.h"
 #include "MediaError.h"
 #include "PlatformString.h"
+#include "RenderWidget.h"
 #include "TextBreakIterator.h"
 #include "Widget.h"
 
@@ -53,6 +54,7 @@
 #include "WebDataSourceImpl.h"
 #include "WebFrameImpl.h"
 #include "WebMenuItemInfo.h"
+#include "WebPluginContainerImpl.h"
 #include "WebPoint.h"
 #include "WebString.h"
 #include "WebURL.h"
@@ -147,6 +149,24 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
     WebContextMenuData data;
     data.mousePosition = selectedFrame->view()->contentsToWindow(r.point());
 
+    // Compute edit flags.
+    data.editFlags = WebContextMenuData::CanDoNone;
+    if (m_webView->focusedWebCoreFrame()->editor()->canUndo())
+        data.editFlags |= WebContextMenuData::CanUndo;
+    if (m_webView->focusedWebCoreFrame()->editor()->canRedo())
+        data.editFlags |= WebContextMenuData::CanRedo;
+    if (m_webView->focusedWebCoreFrame()->editor()->canCut())
+        data.editFlags |= WebContextMenuData::CanCut;
+    if (m_webView->focusedWebCoreFrame()->editor()->canCopy())
+        data.editFlags |= WebContextMenuData::CanCopy;
+    if (m_webView->focusedWebCoreFrame()->editor()->canPaste())
+        data.editFlags |= WebContextMenuData::CanPaste;
+    if (m_webView->focusedWebCoreFrame()->editor()->canDelete())
+        data.editFlags |= WebContextMenuData::CanDelete;
+    // We can always select all...
+    data.editFlags |= WebContextMenuData::CanSelectAll;
+    data.editFlags |= WebContextMenuData::CanTranslate;
+
     // Links, Images, Media tags, and Image/Media-Links take preference over
     // all else.
     data.linkURL = r.absoluteLinkURL();
@@ -182,6 +202,21 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
             data.mediaFlags |= WebContextMenuData::MediaHasVideo;
         if (mediaElement->controls())
             data.mediaFlags |= WebContextMenuData::MediaControls;
+    } else if (r.innerNonSharedNode()->hasTagName(HTMLNames::objectTag)
+               || r.innerNonSharedNode()->hasTagName(HTMLNames::embedTag)) {
+        RenderObject* object = r.innerNonSharedNode()->renderer();
+        if (object && object->isWidget()) {
+            Widget* widget = toRenderWidget(object)->widget();
+            if (widget) {
+                WebPluginContainerImpl* plugin = static_cast<WebPluginContainerImpl*>(widget);
+                WebString text = plugin->selectedText();
+                if (!text.isEmpty()) {
+                    data.selectedText = text;
+                    data.editFlags |= WebContextMenuData::CanCopy;
+                }
+                data.editFlags &= ~WebContextMenuData::CanTranslate;
+            }
+        }
     }
 
     data.isImageBlocked =
@@ -226,23 +261,6 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
     if (ds)
         data.securityInfo = ds->response().securityInfo();
 
-    // Compute edit flags.
-    data.editFlags = WebContextMenuData::CanDoNone;
-    if (m_webView->focusedWebCoreFrame()->editor()->canUndo())
-        data.editFlags |= WebContextMenuData::CanUndo;
-    if (m_webView->focusedWebCoreFrame()->editor()->canRedo())
-        data.editFlags |= WebContextMenuData::CanRedo;
-    if (m_webView->focusedWebCoreFrame()->editor()->canCut())
-        data.editFlags |= WebContextMenuData::CanCut;
-    if (m_webView->focusedWebCoreFrame()->editor()->canCopy())
-        data.editFlags |= WebContextMenuData::CanCopy;
-    if (m_webView->focusedWebCoreFrame()->editor()->canPaste())
-        data.editFlags |= WebContextMenuData::CanPaste;
-    if (m_webView->focusedWebCoreFrame()->editor()->canDelete())
-        data.editFlags |= WebContextMenuData::CanDelete;
-    // We can always select all...
-    data.editFlags |= WebContextMenuData::CanSelectAll;
-
     // Filter out custom menu elements and add them into the data.
     populateCustomMenuItems(defaultMenu, &data);
 
diff --git a/WebKit/chromium/src/EditorClientImpl.cpp b/WebKit/chromium/src/EditorClientImpl.cpp
index 2a40d78..864988a 100644
--- a/WebKit/chromium/src/EditorClientImpl.cpp
+++ b/WebKit/chromium/src/EditorClientImpl.cpp
@@ -658,7 +658,7 @@ void EditorClientImpl::textFieldDidEndEditing(Element* element)
     m_autofillTimer.stop();
 
     // Hide any showing popup.
-    m_webView->hideSuggestionsPopup();
+    m_webView->hideAutoFillPopup();
 
     if (!m_webView->client())
         return; // The page is getting closed, don't fill the password.
@@ -754,7 +754,7 @@ void EditorClientImpl::doAutofill(Timer<EditorClientImpl>* timer)
                        && inputElement->selectionEnd() == static_cast<int>(value.length());
 
     if ((!args->autofillOnEmptyValue && value.isEmpty()) || !isCaretAtEnd) {
-        m_webView->hideSuggestionsPopup();
+        m_webView->hideAutoFillPopup();
         return;
     }
 
@@ -796,11 +796,7 @@ void EditorClientImpl::onAutocompleteSuggestionAccepted(HTMLInputElement* textFi
     if (!webframe)
         return;
 
-    WebPasswordAutocompleteListener* listener = webframe->getPasswordListener(textField);
-    // Password listeners need to autocomplete other fields that depend on the
-    // input element with autofill suggestions.
-    if (listener)
-        listener->performInlineAutocomplete(textField->value(), false, false);
+    webframe->notifiyPasswordListenerOfAutocomplete(WebInputElement(textField));
 }
 
 bool EditorClientImpl::doTextFieldCommandFromEvent(Element* element,
@@ -921,13 +917,8 @@ void EditorClientImpl::getGuessesForWord(const String&,
 
 void EditorClientImpl::setInputMethodState(bool enabled)
 {
-    if (m_webView->client()) {
+    if (m_webView->client())
         m_webView->client()->resetInputMethod();
-
-        // Remove this line when WebViewClient::setInputMethodEnabled() gets
-        // removed.
-        m_webView->client()->setInputMethodEnabled(enabled);
-    }
 }
 
 } // namesace WebKit
diff --git a/WebKit/chromium/src/GraphicsContext3D.cpp b/WebKit/chromium/src/GraphicsContext3D.cpp
index 0681675..7ba0bce 100644
--- a/WebKit/chromium/src/GraphicsContext3D.cpp
+++ b/WebKit/chromium/src/GraphicsContext3D.cpp
@@ -35,6 +35,8 @@
 #include "GraphicsContext3D.h"
 
 #include "CachedImage.h"
+#include "Chrome.h"
+#include "ChromeClientImpl.h"
 #include "HTMLCanvasElement.h"
 #include "HTMLImageElement.h"
 #include "ImageBuffer.h"
@@ -50,10 +52,12 @@
 #include "WebGLShader.h"
 #include "WebGLTexture.h"
 #include "Uint8Array.h"
+#include "WebGLLayerChromium.h"
 #include "WebGraphicsContext3D.h"
 #include "WebGraphicsContext3DDefaultImpl.h"
 #include "WebKit.h"
 #include "WebKitClient.h"
+#include "WebViewImpl.h"
 
 #include <stdio.h>
 #include <wtf/FastMalloc.h>
@@ -97,7 +101,7 @@ public:
     GraphicsContext3DInternal();
     ~GraphicsContext3DInternal();
 
-    bool initialize(GraphicsContext3D::Attributes attrs);
+    bool initialize(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow);
 
     PlatformGraphicsContext3D platformGraphicsContext3D() const;
     Platform3DObject platformTexture() const;
@@ -111,6 +115,11 @@ public:
     void beginPaint(WebGLRenderingContext* context);
     void endPaint();
 
+    void prepareTexture();
+
+#if USE(ACCELERATED_COMPOSITING)
+    WebGLLayerChromium* platformLayer() const;
+#endif
     bool isGLES2Compliant() const;
 
     //----------------------------------------------------------------------
@@ -165,6 +174,8 @@ public:
     bool getActiveAttrib(WebGLProgram* program, unsigned long index, ActiveInfo&);
     bool getActiveUniform(WebGLProgram* program, unsigned long index, ActiveInfo&);
 
+    void getAttachedShaders(WebGLProgram* program, int maxCount, int* count, unsigned int* shaders);
+
     int  getAttribLocation(WebGLProgram*, const String& name);
 
     void getBooleanv(unsigned long pname, unsigned char* value);
@@ -297,6 +308,9 @@ public:
 
 private:
     OwnPtr<WebKit::WebGraphicsContext3D> m_impl;
+#if USE(ACCELERATED_COMPOSITING)
+    RefPtr<WebGLLayerChromium> m_compositingLayer;
+#endif
 #if PLATFORM(SKIA)
     // If the width and height of the Canvas's backing store don't
     // match those that we were given in the most recent call to
@@ -329,7 +343,8 @@ GraphicsContext3DInternal::~GraphicsContext3DInternal()
 #endif
 }
 
-bool GraphicsContext3DInternal::initialize(GraphicsContext3D::Attributes attrs)
+bool GraphicsContext3DInternal::initialize(GraphicsContext3D::Attributes attrs,
+                                           HostWindow* hostWindow)
 {
     WebKit::WebGraphicsContext3D::Attributes webAttributes;
     webAttributes.alpha = attrs.alpha;
@@ -340,23 +355,47 @@ bool GraphicsContext3DInternal::initialize(GraphicsContext3D::Attributes attrs)
     WebKit::WebGraphicsContext3D* webContext = WebKit::webKitClient()->createGraphicsContext3D();
     if (!webContext)
         return false;
-    if (!webContext->initialize(webAttributes)) {
+
+    Chrome* chrome = static_cast<Chrome*>(hostWindow);
+    WebKit::ChromeClientImpl* chromeClientImpl = static_cast<WebKit::ChromeClientImpl*>(chrome->client());
+
+    WebKit::WebViewImpl* webView = chromeClientImpl->webView();
+
+    if (!webView)
+        return false;
+    if (!webContext->initialize(webAttributes, webView)) {
         delete webContext;
         return false;
     }
     m_impl.set(webContext);
+
+#if USE(ACCELERATED_COMPOSITING)
+    m_compositingLayer = WebGLLayerChromium::create(0);
+#endif
     return true;
 }
 
 PlatformGraphicsContext3D GraphicsContext3DInternal::platformGraphicsContext3D() const
 {
-    return 0;
+    return m_impl.get();
 }
 
 Platform3DObject GraphicsContext3DInternal::platformTexture() const
 {
-    return 0;
+    return m_impl->getPlatformTextureId();
+}
+
+void GraphicsContext3DInternal::prepareTexture()
+{
+    m_impl->prepareTexture();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+WebGLLayerChromium* GraphicsContext3DInternal::platformLayer() const
+{
+    return m_compositingLayer.get();
 }
+#endif
 
 void GraphicsContext3DInternal::beginPaint(WebGLRenderingContext* context)
 {
@@ -556,6 +595,12 @@ void GraphicsContext3DInternal::name(t1 a1, t2 a2, t3 a3, t4 a4)  \
     m_impl->name(a1, a2, a3, a4);              \
 }
 
+#define DELEGATE_TO_IMPL_4_X1(name, t1, t2, t3, t4)    \
+void GraphicsContext3DInternal::name(t1 a1, t2 a2, t3 a3, t4 a4)  \
+{ \
+    m_impl->name(EXTRACT(a1), a2, a3, a4);     \
+}
+
 #define DELEGATE_TO_IMPL_4_X4(name, t1, t2, t3, t4)    \
 void GraphicsContext3DInternal::name(t1 a1, t2 a2, t3 a3, t4 a4)  \
 { \
@@ -734,6 +779,8 @@ bool GraphicsContext3DInternal::getActiveUniform(WebGLProgram* program, unsigned
     return true;
 }
 
+DELEGATE_TO_IMPL_4_X1(getAttachedShaders, WebGLProgram*, int, int*, unsigned int*)
+
 int GraphicsContext3DInternal::getAttribLocation(WebGLProgram* program, const String& name)
 {
     return m_impl->getAttribLocation(EXTRACT(program), name.utf8().data());
@@ -1066,7 +1113,7 @@ GraphicsContext3D::~GraphicsContext3D()
 PassOwnPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow)
 {
     GraphicsContext3DInternal* internal = new GraphicsContext3DInternal();
-    if (!internal->initialize(attrs)) {
+    if (!internal->initialize(attrs, hostWindow)) {
         delete internal;
         return 0;
     }
@@ -1085,6 +1132,20 @@ Platform3DObject GraphicsContext3D::platformTexture() const
     return m_internal->platformTexture();
 }
 
+void GraphicsContext3D::prepareTexture()
+{
+    return m_internal->prepareTexture();
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* GraphicsContext3D::platformLayer() const
+{
+    WebGLLayerChromium* webGLLayer = m_internal->platformLayer();
+    webGLLayer->setContext(this);
+    return webGLLayer;
+}
+#endif
+
 DELEGATE_TO_INTERNAL(makeContextCurrent)
 DELEGATE_TO_INTERNAL_1R(sizeInBytes, int, int)
 DELEGATE_TO_INTERNAL_2(reshape, int, int)
@@ -1139,6 +1200,8 @@ DELEGATE_TO_INTERNAL_1(generateMipmap, unsigned long)
 DELEGATE_TO_INTERNAL_3R(getActiveAttrib, WebGLProgram*, unsigned long, ActiveInfo&, bool)
 DELEGATE_TO_INTERNAL_3R(getActiveUniform, WebGLProgram*, unsigned long, ActiveInfo&, bool)
 
+DELEGATE_TO_INTERNAL_4(getAttachedShaders, WebGLProgram*, int, int*, unsigned int*)
+
 DELEGATE_TO_INTERNAL_2R(getAttribLocation, WebGLProgram*, const String&, int)
 
 DELEGATE_TO_INTERNAL_2(getBooleanv, unsigned long, unsigned char*)
diff --git a/WebKit/chromium/src/IDBCallbacksProxy.cpp b/WebKit/chromium/src/IDBCallbacksProxy.cpp
index 42be08d..7a6571a 100644
--- a/WebKit/chromium/src/IDBCallbacksProxy.cpp
+++ b/WebKit/chromium/src/IDBCallbacksProxy.cpp
@@ -80,6 +80,11 @@ void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBIndex> idbIndex)
     m_callbacks.clear();
 }
 
+void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBKey> idbKey)
+{
+    ASSERT_NOT_REACHED();
+}
+
 void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBObjectStore> idbObjectStore)
 {
     m_callbacks->onSuccess(new WebKit::WebIDBObjectStoreImpl(idbObjectStore));
diff --git a/WebKit/chromium/src/IDBCallbacksProxy.h b/WebKit/chromium/src/IDBCallbacksProxy.h
index 8f2da28..fc424f8 100644
--- a/WebKit/chromium/src/IDBCallbacksProxy.h
+++ b/WebKit/chromium/src/IDBCallbacksProxy.h
@@ -56,6 +56,7 @@ public:
     virtual void onSuccess(); // For "null".
     virtual void onSuccess(PassRefPtr<IDBDatabase>);
     virtual void onSuccess(PassRefPtr<IDBIndex>);
+    virtual void onSuccess(PassRefPtr<IDBKey>);
     virtual void onSuccess(PassRefPtr<IDBObjectStore>);
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
 
diff --git a/WebKit/chromium/src/SuggestionsPopupMenuClient.cpp b/WebKit/chromium/src/SuggestionsPopupMenuClient.cpp
deleted file mode 100644
index dd7d9b8..0000000
--- a/WebKit/chromium/src/SuggestionsPopupMenuClient.cpp
+++ /dev/null
@@ -1,184 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "SuggestionsPopupMenuClient.h"
-
-#include "CSSStyleSelector.h"
-#include "CSSValueKeywords.h"
-#include "Chrome.h"
-#include "FrameView.h"
-#include "HTMLInputElement.h"
-#include "RenderTheme.h"
-#include "WebViewImpl.h"
-
-using namespace WebCore;
-
-namespace WebKit {
-
-SuggestionsPopupMenuClient::SuggestionsPopupMenuClient()
-    : m_textField(0)
-    , m_selectedIndex(0)
-{
-}
-
-SuggestionsPopupMenuClient::~SuggestionsPopupMenuClient()
-{
-}
-
-// FIXME: Implement this per-derived class?
-void SuggestionsPopupMenuClient::valueChanged(unsigned listIndex, bool fireEvents)
-{
-    m_textField->setValue(getSuggestion(listIndex));
-
-    WebViewImpl* webView = getWebView();
-    if (!webView)
-        return;
-
-    EditorClientImpl* editor =
-        static_cast<EditorClientImpl*>(webView->page()->editorClient());
-    ASSERT(editor);
-    editor->onAutocompleteSuggestionAccepted(
-        static_cast<HTMLInputElement*>(m_textField.get()));
-}
-
-String SuggestionsPopupMenuClient::itemText(unsigned listIndex) const
-{
-    return getSuggestion(listIndex);
-}
-
-PopupMenuStyle SuggestionsPopupMenuClient::itemStyle(unsigned listIndex) const
-{
-    return *m_style;
-}
-
-PopupMenuStyle SuggestionsPopupMenuClient::menuStyle() const
-{
-    return *m_style;
-}
-
-int SuggestionsPopupMenuClient::clientPaddingLeft() const
-{
-    // Bug http://crbug.com/7708 seems to indicate the style can be 0.
-    RenderStyle* style = textFieldStyle();
-    if (!style)
-       return 0;
-
-    return RenderTheme::defaultTheme()->popupInternalPaddingLeft(style);
-}
-
-int SuggestionsPopupMenuClient::clientPaddingRight() const
-{
-    // Bug http://crbug.com/7708 seems to indicate the style can be 0.
-    RenderStyle* style = textFieldStyle();
-    if (!style)
-        return 0;
-
-    return RenderTheme::defaultTheme()->popupInternalPaddingRight(style);
-}
-
-void SuggestionsPopupMenuClient::popupDidHide()
-{
-    WebViewImpl* webView = getWebView();
-    if (webView)
-        webView->suggestionsPopupDidHide();
-}
-
-void SuggestionsPopupMenuClient::setTextFromItem(unsigned listIndex)
-{
-    m_textField->setValue(getSuggestion(listIndex));
-}
-
-FontSelector* SuggestionsPopupMenuClient::fontSelector() const
-{
-    return m_textField->document()->styleSelector()->fontSelector();
-}
-
-HostWindow* SuggestionsPopupMenuClient::hostWindow() const
-{
-    return m_textField->document()->view()->hostWindow();
-}
-
-PassRefPtr<Scrollbar> SuggestionsPopupMenuClient::createScrollbar(
-    ScrollbarClient* client,
-    ScrollbarOrientation orientation,
-    ScrollbarControlSize size)
-{
-    return Scrollbar::createNativeScrollbar(client, orientation, size);
-}
-
-RenderStyle* SuggestionsPopupMenuClient::textFieldStyle() const
-{
-    RenderStyle* style = m_textField->computedStyle();
-    if (!style) {
-        // It seems we can only have a 0 style in a TextField if the
-        // node is detached, in which case we the popup shoud not be
-        // showing.  Please report this in http://crbug.com/7708 and
-        // include the page you were visiting.
-        ASSERT_NOT_REACHED();
-    }
-    return style;
-}
-
-void SuggestionsPopupMenuClient::initialize(HTMLInputElement* textField,
-                                            int defaultSuggestionIndex)
-{
-    m_textField = textField;
-    m_selectedIndex = defaultSuggestionIndex;
-
-    FontDescription fontDescription;
-    RenderTheme::defaultTheme()->systemFont(CSSValueWebkitControl,
-                                            fontDescription);
-    RenderStyle* style = m_textField->computedStyle();
-    fontDescription.setComputedSize(style->fontDescription().computedSize());
-
-    Font font(fontDescription, 0, 0);
-    font.update(textField->document()->styleSelector()->fontSelector());
-    // The direction of text in popup menu is set the same as the direction of
-    // the input element: textField.
-    m_style.set(new PopupMenuStyle(Color::black, Color::white, font, true,
-                                   Length(WebCore::Fixed),
-                                   textField->renderer()->style()->direction()));
-}
-
-WebViewImpl* SuggestionsPopupMenuClient::getWebView() const
-{
-    Frame* frame = m_textField->document()->frame();
-    if (!frame)
-        return 0;
-
-    Page* page = frame->page();
-    if (!page)
-        return 0;
-
-    return static_cast<ChromeClientImpl*>(page->chrome()->client())->webView();
-}
-
-} // namespace WebKit
diff --git a/WebKit/chromium/src/SuggestionsPopupMenuClient.h b/WebKit/chromium/src/SuggestionsPopupMenuClient.h
deleted file mode 100644
index 7717593..0000000
--- a/WebKit/chromium/src/SuggestionsPopupMenuClient.h
+++ /dev/null
@@ -1,112 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "PopupMenuClient.h"
-
-#ifndef SuggestionsPopupMenuClient_h
-#define SuggestionsPopupMenuClient_h
-
-namespace WebCore {
-class HTMLInputElement;
-class PopupMenuStyle;
-class RenderStyle;
-}
-
-namespace WebKit {
-class WebString;
-class WebViewImpl;
-template <typename T> class WebVector;
-
-// The Suggestions popup menu client, used to display a list of suggestions.
-class SuggestionsPopupMenuClient : public WebCore::PopupMenuClient {
-public:
-    SuggestionsPopupMenuClient();
-    virtual ~SuggestionsPopupMenuClient();
-
-    // Returns the number of suggestions available.
-    virtual unsigned getSuggestionsCount() const = 0;
-
-    // Returns the suggestion at |listIndex|.
-    virtual WebString getSuggestion(unsigned listIndex) const = 0;
-
-    // Removes the suggestion at |listIndex| from the list of suggestions.
-    virtual void removeSuggestionAtIndex(unsigned listIndex) = 0;
-
-    // WebCore::PopupMenuClient methods:
-    virtual void valueChanged(unsigned listIndex, bool fireEvents = true);
-    virtual void selectionChanged(unsigned, bool) {}
-    virtual void selectionCleared() {}
-    virtual WebCore::String itemText(unsigned listIndex) const;
-    virtual WebCore::String itemToolTip(unsigned lastIndex) const { return WebCore::String(); }
-    virtual WebCore::String itemAccessibilityText(unsigned lastIndex) const { return WebCore::String(); }
-    virtual bool itemIsEnabled(unsigned listIndex) const { return true; }
-    virtual WebCore::PopupMenuStyle itemStyle(unsigned listIndex) const;
-    virtual WebCore::PopupMenuStyle menuStyle() const;
-    virtual int clientInsetLeft() const { return 0; }
-    virtual int clientInsetRight() const { return 0; }
-    virtual int clientPaddingLeft() const;
-    virtual int clientPaddingRight() const;
-    virtual int listSize() const { return getSuggestionsCount(); }
-    virtual int selectedIndex() const { return m_selectedIndex; }
-    virtual void popupDidHide();
-    virtual bool itemIsSeparator(unsigned listIndex) const { return false; }
-    virtual bool itemIsLabel(unsigned listIndex) const { return false; }
-    virtual bool itemIsSelected(unsigned listIndex) const { return false; }
-    virtual bool shouldPopOver() const { return false; }
-    virtual bool valueShouldChangeOnHotTrack() const { return false; }
-    virtual void setTextFromItem(unsigned listIndex);
-    virtual WebCore::FontSelector* fontSelector() const;
-    virtual WebCore::HostWindow* hostWindow() const;
-    virtual PassRefPtr<WebCore::Scrollbar> createScrollbar(
-        WebCore::ScrollbarClient* client,
-        WebCore::ScrollbarOrientation orientation,
-        WebCore::ScrollbarControlSize size);
-
-protected:
-    void initialize(WebCore::HTMLInputElement* textField,
-                    int defaultSuggestionIndex);
-
-    int getSelectedIndex() const { return m_selectedIndex; }
-    void setSelectedIndex(int index) { m_selectedIndex = index; }
-
-    WebViewImpl* getWebView() const;
-    WebCore::HTMLInputElement* getTextField() const { return m_textField.get(); }
-
-private:
-    WebCore::RenderStyle* textFieldStyle() const;
-
-    RefPtr<WebCore::HTMLInputElement> m_textField;
-    int m_selectedIndex;
-    OwnPtr<WebCore::PopupMenuStyle> m_style;
-};
-
-} // namespace WebKit
-
-#endif
diff --git a/WebKit/chromium/src/WebBindings.cpp b/WebKit/chromium/src/WebBindings.cpp
index 2b20c0a..3aaebfd 100644
--- a/WebKit/chromium/src/WebBindings.cpp
+++ b/WebKit/chromium/src/WebBindings.cpp
@@ -45,6 +45,7 @@
 #include "V8DOMWrapper.h"
 #include "V8Event.h"
 #include "V8Helpers.h"
+#include "V8HiddenPropertyName.h"
 #include "V8NPUtils.h"
 #include "V8Proxy.h"
 #include "V8Range.h"
@@ -208,8 +209,7 @@ void WebBindings::extractIdentifierData(const NPIdentifier& identifier, const NP
 
 static v8::Local<v8::Value> getEvent(const v8::Handle<v8::Context>& context)
 {
-    static v8::Persistent<v8::String> eventSymbol(v8::Persistent<v8::String>::New(v8::String::NewSymbol("event")));
-    return context->Global()->GetHiddenValue(eventSymbol);
+    return context->Global()->GetHiddenValue(V8HiddenPropertyName::event());
 }
 
 static bool getDragDataImpl(NPObject* npobj, int* eventId, WebDragData* data)
diff --git a/WebKit/chromium/src/WebDatabase.cpp b/WebKit/chromium/src/WebDatabase.cpp
index 376509d..89522f1 100644
--- a/WebKit/chromium/src/WebDatabase.cpp
+++ b/WebKit/chromium/src/WebDatabase.cpp
@@ -32,11 +32,7 @@
 #include "WebDatabase.h"
 
 #include "AbstractDatabase.h"
-#include "DatabaseTask.h"
-#include "DatabaseThread.h"
 #include "DatabaseTracker.h"
-#include "Document.h"
-#include "KURL.h"
 #include "QuotaTracker.h"
 #include "SecurityOrigin.h"
 #include "WebDatabaseObserver.h"
@@ -50,44 +46,28 @@ namespace WebKit {
 
 static WebDatabaseObserver* databaseObserver = 0;
 
-class WebDatabasePrivate : public AbstractDatabase {
-};
-
-void WebDatabase::reset()
-{
-    assign(0);
-}
-
-void WebDatabase::assign(const WebDatabase& other)
-{
-    WebDatabasePrivate* d = const_cast<WebDatabasePrivate*>(other.m_private);
-    if (d)
-        d->ref();
-    assign(d);
-}
-
 WebString WebDatabase::name() const
 {
-    ASSERT(m_private);
-    return m_private->stringIdentifier();
+    ASSERT(m_database);
+    return m_database->stringIdentifier();
 }
 
 WebString WebDatabase::displayName() const
 {
-    ASSERT(m_private);
-    return m_private->displayName();
+    ASSERT(m_database);
+    return m_database->displayName();
 }
 
 unsigned long WebDatabase::estimatedSize() const
 {
-    ASSERT(m_private);
-    return m_private->estimatedSize();
+    ASSERT(m_database);
+    return m_database->estimatedSize();
 }
 
 WebSecurityOrigin WebDatabase::securityOrigin() const
 {
-    ASSERT(m_private);
-    return WebSecurityOrigin(m_private->securityOrigin());
+    ASSERT(m_database);
+    return WebSecurityOrigin(m_database->securityOrigin());
 }
 
 void WebDatabase::setObserver(WebDatabaseObserver* observer)
@@ -117,28 +97,9 @@ void WebDatabase::closeDatabaseImmediately(const WebString& originIdentifier, co
         it->get()->closeImmediately();
 }
 
-WebDatabase::WebDatabase(const WTF::PassRefPtr<AbstractDatabase>& database)
-    : m_private(static_cast<WebDatabasePrivate*>(database.releaseRef()))
-{
-}
-
-WebDatabase& WebDatabase::operator=(const WTF::PassRefPtr<AbstractDatabase>& database)
-{
-    assign(static_cast<WebDatabasePrivate*>(database.releaseRef()));
-    return *this;
-}
-
-WebDatabase::operator WTF::PassRefPtr<AbstractDatabase>() const
-{
-    return PassRefPtr<AbstractDatabase>(const_cast<WebDatabasePrivate*>(m_private));
-}
-
-void WebDatabase::assign(WebDatabasePrivate* d)
+WebDatabase::WebDatabase(const AbstractDatabase* database)
+    : m_database(database)
 {
-    // d is already ref'd for us by the caller
-    if (m_private)
-        m_private->deref();
-    m_private = d;
 }
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index c0e9b44..20ab1d3 100644
--- a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -643,11 +643,6 @@ void WebDevToolsAgentImpl::setTimelineProfilingEnabled(bool enabled)
         ic->stopTimelineProfiler();
 }
 
-WebDevToolsAgent* WebDevToolsAgent::create(WebView* webview, WebDevToolsAgentClient* client)
-{
-    return new WebDevToolsAgentImpl(static_cast<WebViewImpl*>(webview), client);
-}
-
 void WebDevToolsAgent::executeDebuggerCommand(const WebString& command, int callerId)
 {
     DebuggerAgentManager::executeDebuggerCommand(command, callerId);
diff --git a/WebKit/chromium/src/WebFrameImpl.cpp b/WebKit/chromium/src/WebFrameImpl.cpp
index c5fa1fe..ff4883e 100644
--- a/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/WebKit/chromium/src/WebFrameImpl.cpp
@@ -962,7 +962,7 @@ WebHistoryItem WebFrameImpl::previousHistoryItem() const
 WebHistoryItem WebFrameImpl::currentHistoryItem() const
 {
     // If we are still loading, then we don't want to clobber the current
-    // history item as this could cause us to lose the scroll position and 
+    // history item as this could cause us to lose the scroll position and
     // document state.  However, it is OK for new navigations.
     if (m_frame->loader()->loadType() == FrameLoadTypeStandard
         || !m_frame->loader()->activeDocumentLoader()->isLoadingInAPISense())
@@ -1284,14 +1284,21 @@ bool WebFrameImpl::isPageBoxVisible(int pageIndex)
     return frame()->document()->isPageBoxVisible(pageIndex);
 }
 
-WebRect WebFrameImpl::pageAreaRectInPixels(int pageIndex)
+void WebFrameImpl::pageSizeAndMarginsInPixels(int pageIndex,
+                                              WebSize& pageSize,
+                                              int& marginTop,
+                                              int& marginRight,
+                                              int& marginBottom,
+                                              int& marginLeft)
 {
-    return frame()->document()->pageAreaRectInPixels(pageIndex);
-}
-
-WebSize WebFrameImpl::preferredPageSizeInPixels(int pageIndex)
-{
-    return frame()->document()->preferredPageSizeInPixels(pageIndex);
+    IntSize size(pageSize.width, pageSize.height);
+    frame()->document()->pageSizeAndMarginsInPixels(pageIndex,
+                                                    size,
+                                                    marginTop,
+                                                    marginRight,
+                                                    marginBottom,
+                                                    marginLeft);
+    pageSize = size;
 }
 
 bool WebFrameImpl::find(int identifier,
@@ -1961,6 +1968,17 @@ bool WebFrameImpl::registerPasswordListener(
     return true;
 }
 
+void WebFrameImpl::notifiyPasswordListenerOfAutocomplete(
+    const WebInputElement& inputElement)
+{
+    RefPtr<HTMLInputElement> element = inputElement.operator PassRefPtr<HTMLInputElement>();
+    WebPasswordAutocompleteListener* listener = getPasswordListener(element.get());
+    // Password listeners need to autocomplete other fields that depend on the
+    // input element with autofill suggestions.
+    if (listener)
+        listener->performInlineAutocomplete(element->value(), false, false);
+}
+
 WebPasswordAutocompleteListener* WebFrameImpl::getPasswordListener(
     HTMLInputElement* inputElement)
 {
diff --git a/WebKit/chromium/src/WebFrameImpl.h b/WebKit/chromium/src/WebFrameImpl.h
index c14ad9b..aa1edd6 100644
--- a/WebKit/chromium/src/WebFrameImpl.h
+++ b/WebKit/chromium/src/WebFrameImpl.h
@@ -150,8 +150,12 @@ public:
     virtual float getPrintPageShrink(int page);
     virtual void printEnd();
     virtual bool isPageBoxVisible(int pageIndex);
-    virtual WebRect pageAreaRectInPixels(int pageIndex);
-    virtual WebSize preferredPageSizeInPixels(int pageIndex);
+    virtual void pageSizeAndMarginsInPixels(int pageIndex,
+                                            WebSize& pageSize,
+                                            int& marginTop,
+                                            int& marginRight,
+                                            int& marginBottom,
+                                            int& marginLeft);
     virtual bool find(
         int identifier, const WebString& searchText, const WebFindOptions&,
         bool wrapWithinFrame, WebRect* selectionRect);
@@ -164,6 +168,8 @@ public:
     virtual void resetMatchCount();
     virtual bool registerPasswordListener(
         WebInputElement, WebPasswordAutocompleteListener*);
+    virtual void notifiyPasswordListenerOfAutocomplete(
+        const WebInputElement&);
 
     virtual WebString contentAsText(size_t maxChars) const;
     virtual WebString contentAsMarkup() const;
diff --git a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
index b23dc35..0863ec8 100644
--- a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
+++ b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
@@ -173,8 +173,8 @@ WebGraphicsContext3DDefaultImpl::~WebGraphicsContext3DDefaultImpl()
         glDeleteFramebuffersEXT(1, &m_fbo);
 #endif // !RENDER_TO_DEBUGGING_WINDOW
 #if OS(WINDOWS)
-        wglMakeCurrent(0, 0);
-        wglDeleteContext(m_contextObj);
+        wglewMakeCurrent(0, 0);
+        wglewDeleteContext(m_contextObj);
         ReleaseDC(m_canvasWindow, m_canvasDC);
         DestroyWindow(m_canvasWindow);
 #elif PLATFORM(CG)
@@ -194,9 +194,17 @@ WebGraphicsContext3DDefaultImpl::~WebGraphicsContext3DDefaultImpl()
     }
 }
 
-bool WebGraphicsContext3DDefaultImpl::initialize(WebGraphicsContext3D::Attributes attributes)
+bool WebGraphicsContext3DDefaultImpl::initialize(WebGraphicsContext3D::Attributes attributes, WebView* webView)
 {
 #if OS(WINDOWS)
+    if (!s_initializedGLEW) {
+        // Do this only the first time through.
+        if (!wglewInit()) {
+            printf("WebGraphicsContext3DDefaultImpl: wglewInit failed\n");
+            return false;
+        }
+    }
+
     WNDCLASS wc;
     if (!GetClassInfo(GetModuleHandle(0), L"CANVASGL", &wc)) {
         ZeroMemory(&wc, sizeof(WNDCLASS));
@@ -246,13 +254,13 @@ bool WebGraphicsContext3DDefaultImpl::initialize(WebGraphicsContext3D::Attribute
     }
 
     // create rendering context
-    m_contextObj = wglCreateContext(m_canvasDC);
+    m_contextObj = wglewCreateContext(m_canvasDC);
     if (!m_contextObj) {
         printf("WebGraphicsContext3DDefaultImpl: wglCreateContext failed\n");
         return false;
     }
 
-    if (!wglMakeCurrent(m_canvasDC, m_contextObj)) {
+    if (!wglewMakeCurrent(m_canvasDC, m_contextObj)) {
         printf("WebGraphicsContext3DDefaultImpl: wglMakeCurrent failed\n");
         return false;
     }
@@ -260,7 +268,7 @@ bool WebGraphicsContext3DDefaultImpl::initialize(WebGraphicsContext3D::Attribute
 #ifdef RENDER_TO_DEBUGGING_WINDOW
     typedef BOOL (WINAPI * PFNWGLSWAPINTERVALEXTPROC) (int interval);
     PFNWGLSWAPINTERVALEXTPROC setSwapInterval = 0;
-    setSwapInterval = (PFNWGLSWAPINTERVALEXTPROC) wglGetProcAddress("wglSwapIntervalEXT");
+    setSwapInterval = (PFNWGLSWAPINTERVALEXTPROC) wglewGetProcAddress("wglSwapIntervalEXT");
     if (setSwapInterval)
         setSwapInterval(1);
 #endif // RENDER_TO_DEBUGGING_WINDOW
@@ -416,8 +424,8 @@ void WebGraphicsContext3DDefaultImpl::validateAttributes()
 bool WebGraphicsContext3DDefaultImpl::makeContextCurrent()
 {
 #if OS(WINDOWS)
-    if (wglGetCurrentContext() != m_contextObj)
-        if (wglMakeCurrent(m_canvasDC, m_contextObj))
+    if (wglewGetCurrentContext() != m_contextObj)
+        if (wglewMakeCurrent(m_canvasDC, m_contextObj))
             return true;
 #elif PLATFORM(CG)
     if (CGLGetCurrentContext() != m_contextObj)
@@ -469,6 +477,17 @@ bool WebGraphicsContext3DDefaultImpl::isGLES2Compliant()
     return false;
 }
 
+unsigned int WebGraphicsContext3DDefaultImpl::getPlatformTextureId()
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+void WebGraphicsContext3DDefaultImpl::prepareTexture()
+{
+    ASSERT_NOT_REACHED();
+}
+
 static int createTextureObject(GLenum target)
 {
     GLuint texture = 0;
@@ -1059,6 +1078,8 @@ bool WebGraphicsContext3DDefaultImpl::getActiveUniform(WebGLId program, unsigned
     return true;
 }
 
+DELEGATE_TO_GL_4(getAttachedShaders, GetAttachedShaders, WebGLId, int, int*, unsigned int*)
+
 DELEGATE_TO_GL_2R(getAttribLocation, GetAttribLocation, WebGLId, const char*, int)
 
 DELEGATE_TO_GL_2(getBooleanv, GetBooleanv, unsigned long, unsigned char*)
diff --git a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
index 2518a37..e409bf5 100644
--- a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
+++ b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
@@ -42,6 +42,9 @@
 #endif
 
 #include "GL/glew.h"
+#if OS(WINDOWS)
+#include "GL/wglew.h"
+#endif
 
 #if PLATFORM(CG)
 #include <OpenGL/OpenGL.h>
@@ -67,7 +70,7 @@ public:
 
     //----------------------------------------------------------------------
     // WebGraphicsContext3D methods
-    virtual bool initialize(WebGraphicsContext3D::Attributes attributes);
+    virtual bool initialize(WebGraphicsContext3D::Attributes attributes, WebView*);
     virtual bool makeContextCurrent();
 
     virtual int width();
@@ -81,6 +84,9 @@ public:
 
     virtual bool readBackFramebuffer(unsigned char* pixels, size_t bufferSize);
 
+    virtual unsigned int getPlatformTextureId();
+    virtual void prepareTexture();
+
     virtual void synthesizeGLError(unsigned long error);
 
     virtual void activeTexture(unsigned long texture);
@@ -131,6 +137,8 @@ public:
     virtual bool getActiveAttrib(WebGLId program, unsigned long index, ActiveInfo&);
     virtual bool getActiveUniform(WebGLId program, unsigned long index, ActiveInfo&);
 
+    virtual void getAttachedShaders(WebGLId program, int maxCount, int* count, unsigned int* shaders);
+
     virtual int  getAttribLocation(WebGLId program, const char* name);
 
     virtual void getBooleanv(unsigned long pname, unsigned char* value);
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.cpp b/WebKit/chromium/src/WebPluginContainerImpl.cpp
index d099048..41758d2 100644
--- a/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -167,6 +167,11 @@ void WebPluginContainerImpl::handleEvent(Event* event)
         handleWheelEvent(static_cast<WheelEvent*>(event));
     else if (event->isKeyboardEvent())
         handleKeyboardEvent(static_cast<KeyboardEvent*>(event));
+
+    // FIXME: it would be cleaner if Widget::handleEvent returned true/false and
+    // HTMLPluginElement called setDefaultHandled or defaultEventHandler.
+    if (!event->defaultHandled())
+        m_element->Node::defaultEventHandler(event);
 }
 
 void WebPluginContainerImpl::frameRectsChanged()
@@ -241,6 +246,11 @@ void WebPluginContainerImpl::printEnd()
     return m_webPlugin->printEnd();
 }
 
+WebString WebPluginContainerImpl::selectedText()
+{
+    return m_webPlugin->selectedText();
+}
+
 WebElement WebPluginContainerImpl::element()
 {
     return WebElement(m_element);
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.h b/WebKit/chromium/src/WebPluginContainerImpl.h
index ad2fa95..dd0871a 100644
--- a/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -84,6 +84,10 @@ public:
     virtual WebString executeScriptURL(const WebURL&, bool popupsAllowed);
     virtual void loadFrameRequest(const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData);
 
+    // This cannot be null.
+    WebPlugin* plugin() { return m_webPlugin; }
+    void setPlugin(WebPlugin* plugin) { m_webPlugin = plugin; }
+
     // Printing interface. The plugin can support custom printing
     // (which means it controls the layout, number of pages etc).
     // Whether the plugin supports its own paginated print. The other print
@@ -98,6 +102,8 @@ public:
     // Ends the print operation.
     void printEnd();
 
+    WebString selectedText();
+
     // Resource load events for the plugin's source data:
     void didReceiveResponse(const WebCore::ResourceResponse&);
     void didReceiveData(const char *data, int dataLength);
@@ -106,9 +112,6 @@ public:
 
     NPObject* scriptableObject();
 
-    // This cannot be null.
-    WebPlugin* plugin() { return m_webPlugin; }
-
     void willDestroyPluginLoadObserver(WebPluginLoadObserver*);
 
 private:
diff --git a/WebKit/chromium/src/WebPopupMenuImpl.cpp b/WebKit/chromium/src/WebPopupMenuImpl.cpp
index 9ac4d34..dbf9183 100644
--- a/WebKit/chromium/src/WebPopupMenuImpl.cpp
+++ b/WebKit/chromium/src/WebPopupMenuImpl.cpp
@@ -230,14 +230,6 @@ void WebPopupMenuImpl::setFocus(bool enable)
 {
 }
 
-// DEPRECATED, will be removed later.
-bool WebPopupMenuImpl::handleCompositionEvent(
-    WebCompositionCommand command, int cursorPosition, int targetStart,
-    int targetEnd, const WebString& imeString)
-{
-    return false;
-}
-
 bool WebPopupMenuImpl::setComposition(
     const WebString& text, const WebVector<WebCompositionUnderline>& underlines,
     int selectionStart, int selectionEnd)
@@ -250,12 +242,6 @@ bool WebPopupMenuImpl::confirmComposition()
     return false;
 }
 
-// DEPRECATED, will be removed later.
-bool WebPopupMenuImpl::queryCompositionStatus(bool* enabled, WebRect* caretRect)
-{
-    return false;
-}
-
 WebTextInputType WebPopupMenuImpl::textInputType()
 {
     return WebTextInputTypeNone;
diff --git a/WebKit/chromium/src/WebPopupMenuImpl.h b/WebKit/chromium/src/WebPopupMenuImpl.h
index 95f776e..4f5c2de 100644
--- a/WebKit/chromium/src/WebPopupMenuImpl.h
+++ b/WebKit/chromium/src/WebPopupMenuImpl.h
@@ -66,19 +66,11 @@ public:
     virtual bool handleInputEvent(const WebInputEvent&);
     virtual void mouseCaptureLost();
     virtual void setFocus(bool enable);
-
-    // DEPRECATED, will be removed later.
-    virtual bool handleCompositionEvent(
-        WebCompositionCommand command, int cursorPosition,
-        int targetStart, int targetEnd, const WebString& text);
     virtual bool setComposition(
         const WebString& text,
         const WebVector<WebCompositionUnderline>& underlines,
         int selectionStart, int selectionEnd);
     virtual bool confirmComposition();
-
-    // DEPRECATED, will be removed later.
-    virtual bool queryCompositionStatus(bool* enabled, WebRect* caretRect);
     virtual WebTextInputType textInputType();
     virtual WebRect caretOrSelectionBounds();
     virtual void setTextDirection(WebTextDirection direction);
diff --git a/WebKit/chromium/src/WebViewImpl.cpp b/WebKit/chromium/src/WebViewImpl.cpp
index 257d646..45b9117 100644
--- a/WebKit/chromium/src/WebViewImpl.cpp
+++ b/WebKit/chromium/src/WebViewImpl.cpp
@@ -32,7 +32,6 @@
 #include "WebViewImpl.h"
 
 #include "AutoFillPopupMenuClient.h"
-#include "AutocompletePopupMenuClient.h"
 #include "AXObjectCache.h"
 #include "Chrome.h"
 #include "CompositionUnderlineVectorBuilder.h"
@@ -104,6 +103,7 @@
 #include "WebString.h"
 #include "WebVector.h"
 #include "WebViewClient.h"
+#include "wtf/OwnPtr.h"
 
 #if OS(WINDOWS)
 #include "RenderThemeChromiumWin.h"
@@ -153,7 +153,7 @@ COMPILE_ASSERT_MATCHING_ENUM(DragOperationMove);
 COMPILE_ASSERT_MATCHING_ENUM(DragOperationDelete);
 COMPILE_ASSERT_MATCHING_ENUM(DragOperationEvery);
 
-static const PopupContainerSettings suggestionsPopupSettings = {
+static const PopupContainerSettings autoFillPopupSettings = {
     false,  // setTextOnIndexChange
     false,  // acceptOnAbandon
     true,   // loopSelectionNavigation
@@ -239,9 +239,9 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     , m_dropEffect(DropEffectDefault)
     , m_operationsAllowed(WebDragOperationNone)
     , m_dragOperation(WebDragOperationNone)
-    , m_suggestionsPopupShowing(false)
-    , m_suggestionsPopupClient(0)
-    , m_suggestionsPopup(0)
+    , m_autoFillPopupShowing(false)
+    , m_autoFillPopupClient(0)
+    , m_autoFillPopup(0)
     , m_isTransparent(false)
     , m_tabsToLinks(false)
     , m_dragScrollTimer(new DragScrollTimer())
@@ -261,7 +261,7 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     m_lastMousePosition = WebPoint(-1, -1);
 
     if (devToolsClient)
-        m_devToolsAgent = static_cast<WebDevToolsAgentImpl*>(WebDevToolsAgent::create(this, devToolsClient));
+        m_devToolsAgent = new WebDevToolsAgentImpl(this, devToolsClient);
 
     m_page.set(new Page(&m_chromeClientImpl, &m_contextMenuClientImpl, &m_editorClientImpl, &m_dragClientImpl, &m_inspectorClientImpl, 0, 0, 0));
 
@@ -356,7 +356,7 @@ void WebViewImpl::mouseDown(const WebMouseEvent& event)
             m_mouseCaptureNode = hitNode;
 
         // If a text field that has focus is clicked again, we should display the
-        // suggestions popup.
+        // AutoFill popup.
         RefPtr<Node> focusedNode = focusedWebCoreNode();
         if (focusedNode.get() && toHTMLInputElement(focusedNode.get())) {
             if (hitNode == focusedNode) {
@@ -374,7 +374,7 @@ void WebViewImpl::mouseDown(const WebMouseEvent& event)
         PlatformMouseEventBuilder(mainFrameImpl()->frameView(), event));
 
     if (clickedNode.get() && clickedNode == focusedWebCoreNode()) {
-        // Focus has not changed, show the suggestions popup.
+        // Focus has not changed, show the AutoFill popup.
         static_cast<EditorClientImpl*>(m_page->editorClient())->
             showFormAutofillForNode(clickedNode.get());
     }
@@ -456,7 +456,7 @@ void WebViewImpl::mouseUp(const WebMouseEvent& event)
         IntPoint contentPoint = view->windowToContents(clickPoint);
         HitTestResult hitTestResult = focused->eventHandler()->hitTestResultAtPoint(contentPoint, false, false, ShouldHitTestScrollbars);
         // We don't want to send a paste when middle clicking a scroll bar or a
-        // link (which will navigate later in the code).  The main scrollbars 
+        // link (which will navigate later in the code).  The main scrollbars
         // have to be handled separately.
         if (!hitTestResult.scrollbar() && !hitTestResult.isLiveLink() && focused && !view->scrollbarAtPoint(clickPoint)) {
             Editor* editor = focused->editor();
@@ -557,13 +557,13 @@ bool WebViewImpl::selectPopupHandleKeyEvent(const WebKeyboardEvent& event)
 {
     if (!m_selectPopup)
         return false;
-    
+
     return m_selectPopup->handleKeyEvent(PlatformKeyboardEventBuilder(event));
 }
 
 bool WebViewImpl::autocompleteHandleKeyEvent(const WebKeyboardEvent& event)
 {
-    if (!m_suggestionsPopupShowing
+    if (!m_autoFillPopupShowing
         // Home and End should be left to the text field to process.
         || event.windowsKeyCode == VKEY_HOME
         || event.windowsKeyCode == VKEY_END)
@@ -571,7 +571,7 @@ bool WebViewImpl::autocompleteHandleKeyEvent(const WebKeyboardEvent& event)
 
     // Pressing delete triggers the removal of the selected suggestion from the DB.
     if (event.windowsKeyCode == VKEY_DELETE
-        && m_suggestionsPopup->selectedIndex() != -1) {
+        && m_autoFillPopup->selectedIndex() != -1) {
         Node* node = focusedWebCoreNode();
         if (!node || (node->nodeType() != Node::ELEMENT_NODE)) {
             ASSERT_NOT_REACHED();
@@ -583,22 +583,22 @@ bool WebViewImpl::autocompleteHandleKeyEvent(const WebKeyboardEvent& event)
             return false;
         }
 
-        int selectedIndex = m_suggestionsPopup->selectedIndex();
+        int selectedIndex = m_autoFillPopup->selectedIndex();
         HTMLInputElement* inputElement = static_cast<HTMLInputElement*>(element);
         WebString name = inputElement->name();
-        WebString value = m_suggestionsPopupClient->itemText(selectedIndex);
+        WebString value = m_autoFillPopupClient->itemText(selectedIndex);
         m_client->removeAutofillSuggestions(name, value);
         // Update the entries in the currently showing popup to reflect the
         // deletion.
-        m_suggestionsPopupClient->removeSuggestionAtIndex(selectedIndex);
-        refreshSuggestionsPopup();
+        m_autoFillPopupClient->removeSuggestionAtIndex(selectedIndex);
+        refreshAutoFillPopup();
         return false;
     }
 
-    if (!m_suggestionsPopup->isInterestedInEventForKey(event.windowsKeyCode))
+    if (!m_autoFillPopup->isInterestedInEventForKey(event.windowsKeyCode))
         return false;
 
-    if (m_suggestionsPopup->handleKeyEvent(PlatformKeyboardEventBuilder(event))) {
+    if (m_autoFillPopup->handleKeyEvent(PlatformKeyboardEventBuilder(event))) {
         // We need to ignore the next Char event after this otherwise pressing
         // enter when selecting an item in the menu will go to the page.
         if (WebInputEvent::RawKeyDown == event.type)
@@ -661,62 +661,10 @@ bool WebViewImpl::touchEvent(const WebTouchEvent& event)
 }
 #endif
 
-// The WebViewImpl::SendContextMenuEvent function is based on the Webkit
-// function
-// bool WebView::handleContextMenuEvent(WPARAM wParam, LPARAM lParam) in
-// webkit\webkit\win\WebView.cpp. The only significant change in this
-// function is the code to convert from a Keyboard event to the Right
-// Mouse button up event.
-//
-// This function is an ugly copy/paste and should be cleaned up when the
-// WebKitWin version is cleaned: https://bugs.webkit.org/show_bug.cgi?id=20438
 #if OS(WINDOWS) || OS(LINUX)
-// FIXME: implement on Mac
+// Mac has no way to open a context menu based on a keyboard event.
 bool WebViewImpl::sendContextMenuEvent(const WebKeyboardEvent& event)
 {
-    static const int kContextMenuMargin = 1;
-    Frame* mainFrameImpl = page()->mainFrame();
-    FrameView* view = mainFrameImpl->view();
-    if (!view)
-        return false;
-
-    IntPoint coords(-1, -1);
-#if OS(WINDOWS)
-    int rightAligned = ::GetSystemMetrics(SM_MENUDROPALIGNMENT);
-#else
-    int rightAligned = 0;
-#endif
-    IntPoint location;
-
-
-    Frame* focusedFrame = page()->focusController()->focusedOrMainFrame();
-    Node* focusedNode = focusedFrame->document()->focusedNode();
-    Position start = mainFrameImpl->selection()->selection().start();
-
-    if (start.node()) {
-        RenderObject* renderer = start.node()->renderer();
-        if (!renderer)
-            return false;
-
-        RefPtr<Range> selection = mainFrameImpl->selection()->toNormalizedRange();
-        IntRect firstRect = mainFrameImpl->firstRectForRange(selection.get());
-
-        int x = rightAligned ? firstRect.right() : firstRect.x();
-        location = IntPoint(x, firstRect.bottom());
-    } else if (focusedNode)
-        location = focusedNode->getRect().bottomLeft();
-    else {
-        location = IntPoint(
-            rightAligned ? view->contentsWidth() - kContextMenuMargin : kContextMenuMargin,
-            kContextMenuMargin);
-    }
-
-    location = view->contentsToWindow(location);
-    // FIXME: The IntSize(0, -1) is a hack to get the hit-testing to result in
-    // the selected element. Ideally we'd have the position of a context menu
-    // event be separate from its target node.
-    coords = location + IntSize(0, -1);
-
     // The contextMenuController() holds onto the last context menu that was
     // popped up on the page until a new one is created. We need to clear
     // this menu before propagating the event through the DOM so that we can
@@ -725,17 +673,9 @@ bool WebViewImpl::sendContextMenuEvent(const WebKeyboardEvent& event)
     // not run.
     page()->contextMenuController()->clearContextMenu();
 
-    focusedFrame->view()->setCursor(pointerCursor());
-    WebMouseEvent mouseEvent;
-    mouseEvent.button = WebMouseEvent::ButtonRight;
-    mouseEvent.x = coords.x();
-    mouseEvent.y = coords.y();
-    mouseEvent.type = WebInputEvent::MouseUp;
-
-    PlatformMouseEventBuilder platformEvent(view, mouseEvent);
-
     m_contextMenuAllowed = true;
-    bool handled = focusedFrame->eventHandler()->sendContextMenuEvent(platformEvent);
+    Frame* focusedFrame = page()->focusController()->focusedOrMainFrame();
+    bool handled = focusedFrame->eventHandler()->sendContextMenuEventForKey();
     m_contextMenuAllowed = false;
     return handled;
 }
@@ -880,11 +820,11 @@ void  WebViewImpl::popupClosed(WebCore::PopupContainer* popupContainer)
     }
 }
 
-void WebViewImpl::hideSuggestionsPopup()
+void WebViewImpl::hideAutoFillPopup()
 {
-    if (m_suggestionsPopupShowing) {
-        m_suggestionsPopup->hidePopup();
-        m_suggestionsPopupShowing = false;
+    if (m_autoFillPopupShowing) {
+        m_autoFillPopup->hidePopup();
+        m_autoFillPopupShowing = false;
     }
 }
 
@@ -1142,7 +1082,7 @@ void WebViewImpl::setFocus(bool enable)
         }
         m_imeAcceptEvents = true;
     } else {
-        hideSuggestionsPopup();
+        hideAutoFillPopup();
         hideSelectPopup();
 
         // Clear focus on the currently focused frame if any.
@@ -1164,48 +1104,6 @@ void WebViewImpl::setFocus(bool enable)
     }
 }
 
-// DEPRECATED, will be removed later.
-bool WebViewImpl::handleCompositionEvent(WebCompositionCommand command,
-                                         int cursorPosition,
-                                         int targetStart,
-                                         int targetEnd,
-                                         const WebString& imeString)
-{
-    if (command == WebKit::WebCompositionCommandSet) {
-        if (targetStart < 0)
-            targetStart = 0;
-        if (targetEnd < 0)
-            targetEnd = static_cast<int>(imeString.length());
-
-        // Create custom underlines.
-        // To emphasize the selection, the selected region uses a solid black
-        // for its underline while other regions uses a pale gray for theirs.
-        WebVector<WebCompositionUnderline> underlines(static_cast<size_t>(3));
-        underlines[0].startOffset = 0;
-        underlines[0].endOffset = targetStart;
-        underlines[0].thick = true;
-        underlines[0].color = 0xffd3d3d3;
-        underlines[1].startOffset = targetStart;
-        underlines[1].endOffset = targetEnd;
-        underlines[1].thick = true;
-        underlines[1].color = 0xff000000;
-        underlines[2].startOffset = targetEnd;
-        underlines[2].endOffset = static_cast<unsigned>(imeString.length());
-        underlines[2].thick = true;
-        underlines[2].color = 0xffd3d3d3;
-        return setComposition(imeString, underlines, cursorPosition, cursorPosition);
-    }
-
-    if (command == WebKit::WebCompositionCommandDiscard)
-        setComposition(WebString(), WebVector<WebCompositionUnderline>(), 0, 0);
-    else if (command == WebKit::WebCompositionCommandConfirm) {
-        setComposition(imeString, WebVector<WebCompositionUnderline>(), 0, 0);
-        confirmComposition();
-    }
-
-    return true;
-}
-
 bool WebViewImpl::setComposition(
     const WebString& text,
     const WebVector<WebCompositionUnderline>& underlines,
@@ -1284,41 +1182,6 @@ bool WebViewImpl::confirmComposition()
     return true;
 }
 
-// DEPRECATED, will be removed later.
-bool WebViewImpl::queryCompositionStatus(bool* enableIME, WebRect* caretRect)
-{
-    // Store whether the selected node needs IME and the caret rectangle.
-    // This process consists of the following four steps:
-    //  1. Retrieve the selection controller of the focused frame;
-    //  2. Retrieve the caret rectangle from the controller;
-    //  3. Convert the rectangle, which is relative to the parent view, to the
-    //     one relative to the client window, and;
-    //  4. Store the converted rectangle.
-    const Frame* focused = focusedWebCoreFrame();
-    if (!focused)
-        return false;
-
-    const Editor* editor = focused->editor();
-    if (!editor || !editor->canEdit())
-        return false;
-
-    SelectionController* controller = focused->selection();
-    if (!controller)
-        return false;
-
-    const Node* node = controller->start().node();
-    if (!node)
-        return false;
-
-    *enableIME = node->shouldUseInputMethod() && !controller->isInPasswordField();
-    const FrameView* view = node->document()->view();
-    if (!view)
-        return false;
-
-    *caretRect = view->contentsToWindow(controller->absoluteCaretBounds());
-    return true;
-}
-
 WebTextInputType WebViewImpl::textInputType()
 {
     WebTextInputType type = WebTextInputTypeNone;
@@ -1363,6 +1226,10 @@ WebRect WebViewImpl::caretOrSelectionBounds()
     if (!view)
         return rect;
 
+    const Node* node = controller->start().node();
+    if (!node || !node->renderer())
+        return rect;
+
     if (controller->isCaret())
         rect = view->contentsToWindow(controller->absoluteCaretBounds());
     else if (controller->isRange()) {
@@ -1832,12 +1699,6 @@ WebDevToolsAgent* WebViewImpl::devToolsAgent()
     return m_devToolsAgent.get();
 }
 
-void WebViewImpl::setDevToolsAgent(WebDevToolsAgent* devToolsAgent)
-{
-    ASSERT(!m_devToolsAgent.get()); // May only set once!
-    m_devToolsAgent.set(static_cast<WebDevToolsAgentPrivate*>(devToolsAgent));
-}
-
 WebAccessibilityObject WebViewImpl::accessibilityObject()
 {
     if (!mainFrameImpl())
@@ -1858,7 +1719,7 @@ void WebViewImpl::applyAutoFillSuggestions(
     ASSERT(separatorIndex < static_cast<int>(names.size()));
 
     if (names.isEmpty()) {
-        hideSuggestionsPopup();
+        hideAutoFillPopup();
         return;
     }
 
@@ -1867,7 +1728,7 @@ void WebViewImpl::applyAutoFillSuggestions(
     // focused node, then we have nothing to do.  FIXME: also check the
     // caret is at the end and that the text has not changed.
     if (!focusedNode || focusedNode != PassRefPtr<Node>(node)) {
-        hideSuggestionsPopup();
+        hideAutoFillPopup();
         return;
     }
 
@@ -1879,93 +1740,52 @@ void WebViewImpl::applyAutoFillSuggestions(
     if (!m_autoFillPopupClient.get())
         m_autoFillPopupClient.set(new AutoFillPopupMenuClient);
 
-    m_autoFillPopupClient->initialize(inputElem, names, labels,
-                                      separatorIndex);
-
-    if (m_suggestionsPopupClient != m_autoFillPopupClient.get()) {
-        hideSuggestionsPopup();
-        m_suggestionsPopupClient = m_autoFillPopupClient.get();
-    }
+    m_autoFillPopupClient->initialize(inputElem, names, labels, separatorIndex);
 
     if (!m_autoFillPopup.get()) {
-        m_autoFillPopup = PopupContainer::create(m_suggestionsPopupClient,
+        m_autoFillPopup = PopupContainer::create(m_autoFillPopupClient.get(),
                                                  PopupContainer::Suggestion,
-                                                 suggestionsPopupSettings);
+                                                 autoFillPopupSettings);
     }
 
-    if (m_suggestionsPopup != m_autoFillPopup.get())
-        m_suggestionsPopup = m_autoFillPopup.get();
-
-    if (m_suggestionsPopupShowing) {
+    if (m_autoFillPopupShowing) {
         m_autoFillPopupClient->setSuggestions(names, labels, separatorIndex);
-        refreshSuggestionsPopup();
+        refreshAutoFillPopup();
     } else {
-        m_suggestionsPopup->show(focusedNode->getRect(),
+        m_autoFillPopup->show(focusedNode->getRect(),
                                  focusedNode->ownerDocument()->view(), 0);
-        m_suggestionsPopupShowing = true;
+        m_autoFillPopupShowing = true;
     }
+
+    // DEPRECATED: This special mode will go away once AutoFill and Autocomplete
+    // merge is complete.
+    if (m_autoFillPopupClient)
+        m_autoFillPopupClient->setAutocompleteMode(false);
 }
 
+// DEPRECATED: replacing with applyAutoFillSuggestions.
 void WebViewImpl::applyAutocompleteSuggestions(
     const WebNode& node,
     const WebVector<WebString>& suggestions,
     int defaultSuggestionIndex)
 {
-    ASSERT(defaultSuggestionIndex < static_cast<int>(suggestions.size()));
-
-    if (!m_page.get() || suggestions.isEmpty()) {
-        hideSuggestionsPopup();
-        return;
-    }
+    WebVector<WebString> names(suggestions.size());
+    WebVector<WebString> labels(suggestions.size());
 
-    RefPtr<Node> focusedNode = focusedWebCoreNode();
-    // If the node for which we queried the Autocomplete suggestions is not the
-    // focused node, then we have nothing to do.  FIXME: also check the
-    // caret is at the end and that the text has not changed.
-    if (!focusedNode || focusedNode != PassRefPtr<Node>(node)) {
-        hideSuggestionsPopup();
-        return;
+    for (size_t i = 0; i < suggestions.size(); ++i) {
+        names[i] = suggestions[i];
+        labels[i] = WebString();
     }
 
-    HTMLInputElement* inputElem =
-        static_cast<HTMLInputElement*>(focusedNode.get());
-
-    // The first time the Autocomplete is shown we'll create the client and the
-    // popup.
-    if (!m_autocompletePopupClient.get())
-        m_autocompletePopupClient.set(new AutocompletePopupMenuClient);
-
-    m_autocompletePopupClient->initialize(inputElem, suggestions,
-                                          defaultSuggestionIndex);
-
-    if (m_suggestionsPopupClient != m_autocompletePopupClient.get()) {
-        hideSuggestionsPopup();
-        m_suggestionsPopupClient = m_autocompletePopupClient.get();
-    }
-
-    if (!m_autocompletePopup.get()) {
-        m_autocompletePopup = PopupContainer::create(m_suggestionsPopupClient,
-                                                     PopupContainer::Suggestion,
-                                                     suggestionsPopupSettings);
-    }
-
-    if (m_suggestionsPopup != m_autocompletePopup.get())
-        m_suggestionsPopup = m_autocompletePopup.get();
-
-    if (m_suggestionsPopupShowing) {
-        m_autocompletePopupClient->setSuggestions(suggestions);
-        refreshSuggestionsPopup();
-    } else {
-        m_suggestionsPopup->show(focusedNode->getRect(),
-                                 focusedNode->ownerDocument()->view(), 0);
-        m_suggestionsPopupShowing = true;
-    }
+    applyAutoFillSuggestions(node, names, labels, -1);
+    if (m_autoFillPopupClient)
+        m_autoFillPopupClient->setAutocompleteMode(true);
 }
 
 void WebViewImpl::hidePopups()
 {
     hideSelectPopup();
-    hideSuggestionsPopup();
+    hideAutoFillPopup();
 }
 
 void WebViewImpl::performCustomContextMenuAction(unsigned action)
@@ -2044,22 +1864,30 @@ void WebViewImpl::setSelectionColors(unsigned activeBackgroundColor,
 #endif
 }
 
-void WebViewImpl::addUserScript(const WebString& sourceCode, bool runAtStart)
+void WebView::addUserScript(const WebString& sourceCode, const WebVector<WebString>& patternsIn, bool runAtStart)
 {
+    OwnPtr<Vector<String> > patterns(new Vector<String>);
+    for (size_t i = 0; i < patternsIn.size(); ++i)
+        patterns->append(patternsIn[i]);
+
     PageGroup* pageGroup = PageGroup::pageGroup(pageGroupName);
     RefPtr<DOMWrapperWorld> world(DOMWrapperWorld::create());
-    pageGroup->addUserScriptToWorld(world.get(), sourceCode, WebURL(), 0, 0,
+    pageGroup->addUserScriptToWorld(world.get(), sourceCode, WebURL(), patterns.release(), 0,
                                     runAtStart ? InjectAtDocumentStart : InjectAtDocumentEnd);
 }
 
-void WebViewImpl::addUserStyleSheet(const WebString& sourceCode)
+void WebView::addUserStyleSheet(const WebString& sourceCode, const WebVector<WebString>& patternsIn)
 {
+    OwnPtr<Vector<String> > patterns(new Vector<String>);
+    for (size_t i = 0; i < patternsIn.size(); ++i)
+        patterns->append(patternsIn[i]);
+
     PageGroup* pageGroup = PageGroup::pageGroup(pageGroupName);
     RefPtr<DOMWrapperWorld> world(DOMWrapperWorld::create());
-    pageGroup->addUserStyleSheetToWorld(world.get(), sourceCode, WebURL(), 0, 0);
+    pageGroup->addUserStyleSheetToWorld(world.get(), sourceCode, WebURL(), patterns.release(), 0);
 }
 
-void WebViewImpl::removeAllUserContent()
+void WebView::removeAllUserContent()
 {
     PageGroup* pageGroup = PageGroup::pageGroup(pageGroupName);
     pageGroup->removeAllUserContent();
@@ -2151,24 +1979,25 @@ NotificationPresenterImpl* WebViewImpl::notificationPresenterImpl()
 }
 #endif
 
-void WebViewImpl::refreshSuggestionsPopup()
+void WebViewImpl::refreshAutoFillPopup()
 {
-    ASSERT(m_suggestionsPopupShowing);
+    ASSERT(m_autoFillPopupShowing);
 
     // Hide the popup if it has become empty.
-    if (!m_suggestionsPopupClient->listSize()) {
-        hideSuggestionsPopup();
+    if (!m_autoFillPopupClient->listSize()) {
+        hideAutoFillPopup();
         return;
     }
 
-    IntRect oldBounds = m_suggestionsPopup->boundsRect();
-    m_suggestionsPopup->refresh();
-    IntRect newBounds = m_suggestionsPopup->boundsRect();
+    IntRect oldBounds = m_autoFillPopup->boundsRect();
+    m_autoFillPopup->refresh();
+    IntRect newBounds = m_autoFillPopup->boundsRect();
     // Let's resize the backing window if necessary.
     if (oldBounds != newBounds) {
         WebPopupMenuImpl* popupMenu =
-            static_cast<WebPopupMenuImpl*>(m_suggestionsPopup->client());
-        popupMenu->client()->setWindowRect(newBounds);
+            static_cast<WebPopupMenuImpl*>(m_autoFillPopup->client());
+        if (popupMenu)
+            popupMenu->client()->setWindowRect(newBounds);
     }
 }
 
diff --git a/WebKit/chromium/src/WebViewImpl.h b/WebKit/chromium/src/WebViewImpl.h
index a6fa131..db2a1d2 100644
--- a/WebKit/chromium/src/WebViewImpl.h
+++ b/WebKit/chromium/src/WebViewImpl.h
@@ -70,7 +70,6 @@ class AutocompletePopupMenuClient;
 class AutoFillPopupMenuClient;
 class ContextMenuClientImpl;
 class DragScrollTimer;
-class SuggestionsPopupMenuClient;
 class WebAccessibilityObject;
 class WebDevToolsAgentClient;
 class WebDevToolsAgentPrivate;
@@ -93,22 +92,12 @@ public:
     virtual bool handleInputEvent(const WebInputEvent&);
     virtual void mouseCaptureLost();
     virtual void setFocus(bool enable);
-
-    // DEPRECATED, will be removed later.
-    virtual bool handleCompositionEvent(WebCompositionCommand command,
-                                        int cursorPosition,
-                                        int targetStart,
-                                        int targetEnd,
-                                        const WebString& text);
     virtual bool setComposition(
         const WebString& text,
         const WebVector<WebCompositionUnderline>& underlines,
         int selectionStart,
         int selectionEnd);
     virtual bool confirmComposition();
-
-    // DEPRECATED, will be removed later.
-    virtual bool queryCompositionStatus(bool* enabled, WebRect* caretRect);
     virtual WebTextInputType textInputType();
     virtual WebRect caretOrSelectionBounds();
     virtual void setTextDirection(WebTextDirection direction);
@@ -147,8 +136,8 @@ public:
         const WebPoint& screenPoint,
         WebDragOperation operation);
     virtual void dragSourceMovedTo(
-        const WebPoint& clientPoint, 
-        const WebPoint& screenPoint, 
+        const WebPoint& clientPoint,
+        const WebPoint& screenPoint,
         WebDragOperation operation);
     virtual void dragSourceSystemDragEnded();
     virtual WebDragOperation dragTargetDragEnter(
@@ -174,13 +163,13 @@ public:
     virtual void setInspectorSetting(const WebString& key,
                                      const WebString& value);
     virtual WebDevToolsAgent* devToolsAgent();
-    virtual void setDevToolsAgent(WebDevToolsAgent*);
     virtual WebAccessibilityObject accessibilityObject();
     virtual void applyAutoFillSuggestions(
         const WebNode&,
         const WebVector<WebString>& names,
         const WebVector<WebString>& labels,
         int separatorIndex);
+    // DEPRECATED: replacing with applyAutoFillSuggestions.
     virtual void applyAutocompleteSuggestions(
         const WebNode&,
         const WebVector<WebString>& suggestions,
@@ -194,10 +183,7 @@ public:
                                     unsigned inactiveBackgroundColor,
                                     unsigned inactiveForegroundColor);
     virtual void performCustomContextMenuAction(unsigned action);
-    virtual void addUserScript(const WebString& sourceCode,
-                               bool runAtStart);
-    virtual void addUserStyleSheet(const WebString& sourceCode);
-    virtual void removeAllUserContent();
+    virtual WebGLES2Context* gles2Context();
 
     // WebViewImpl
 
@@ -296,9 +282,9 @@ public:
         const WebImage& dragImage,
         const WebPoint& dragImageOffset);
 
-    void suggestionsPopupDidHide()
+    void autoFillPopupDidHide()
     {
-        m_suggestionsPopupShowing = false;
+        m_autoFillPopupShowing = false;
     }
 
 #if ENABLE(NOTIFICATIONS)
@@ -314,7 +300,7 @@ public:
     void popupOpened(WebCore::PopupContainer* popupContainer);
     void popupClosed(WebCore::PopupContainer* popupContainer);
 
-    void hideSuggestionsPopup();
+    void hideAutoFillPopup();
 
     // HACK: currentInputEvent() is for ChromeClientImpl::show(), until we can
     // fix WebKit to pass enough information up into ChromeClient::show() so we
@@ -336,10 +322,6 @@ public:
                                    WebCore::ScrollDirection* scrollDirection,
                                    WebCore::ScrollGranularity* scrollGranularity);
 
-    // Returns the GLES2Context associated with this WebView. One will be created
-    // if it doesn't already exist.
-    WebGLES2Context* gles2Context();
-
 private:
     friend class WebView;  // So WebView::Create can call our constructor
     friend class WTF::RefCounted<WebViewImpl>;
@@ -361,10 +343,10 @@ private:
     // Returns true if the autocomple has consumed the event.
     bool autocompleteHandleKeyEvent(const WebKeyboardEvent&);
 
-    // Repaints the suggestions popup. Should be called when the suggestions
-    // have changed. Note that this should only be called when the suggestions
+    // Repaints the AutoFill popup. Should be called when the suggestions
+    // have changed. Note that this should only be called when the AutoFill
     // popup is showing.
-    void refreshSuggestionsPopup();
+    void refreshAutoFillPopup();
 
     // Returns true if the view was scrolled.
     bool scrollViewWithKeyboard(int keyCode, int modifiers);
@@ -473,32 +455,18 @@ private:
     // current drop target in this WebView (the drop target can accept the drop).
     WebDragOperation m_dragOperation;
 
-    // Whether a suggestions popup is currently showing.
-    bool m_suggestionsPopupShowing;
-
-    // A pointer to the current suggestions popup menu client. This can be
-    // either an AutoFillPopupMenuClient or an AutocompletePopupMenuClient. We
-    // do not own this pointer.
-    SuggestionsPopupMenuClient* m_suggestionsPopupClient;
+    // Whether an AutoFill popup is currently showing.
+    bool m_autoFillPopupShowing;
 
     // The AutoFill popup client.
     OwnPtr<AutoFillPopupMenuClient> m_autoFillPopupClient;
 
-    // The Autocomplete popup client.
-    OwnPtr<AutocompletePopupMenuClient> m_autocompletePopupClient;
-
-    // A pointer to the current suggestions popup. We do not own this pointer.
-    WebCore::PopupContainer* m_suggestionsPopup;
+    // The AutoFill popup.
+    RefPtr<WebCore::PopupContainer> m_autoFillPopup;
 
     // The popup associated with a select element.
     RefPtr<WebCore::PopupContainer> m_selectPopup;
 
-    // The AutoFill suggestions popup.
-    RefPtr<WebCore::PopupContainer> m_autoFillPopup;
-
-    // The AutoComplete suggestions popup.
-    RefPtr<WebCore::PopupContainer> m_autocompletePopup;
-
     OwnPtr<WebDevToolsAgentPrivate> m_devToolsAgent;
 
     // Whether the webview is rendering transparently.
diff --git a/WebKit/chromium/src/WebWorkerBase.cpp b/WebKit/chromium/src/WebWorkerBase.cpp
index 244cceb..0ad0ccd 100644
--- a/WebKit/chromium/src/WebWorkerBase.cpp
+++ b/WebKit/chromium/src/WebWorkerBase.cpp
@@ -165,7 +165,7 @@ void WebWorkerBase::initializeLoader(const WebURL& url)
     // loading requests from the worker context to the rest of WebKit and Chromium
     // infrastructure.
     ASSERT(!m_webView);
-    m_webView = WebView::create(0);
+    m_webView = WebView::create(0, 0);
     m_webView->settings()->setOfflineWebApplicationCacheEnabled(WebRuntimeFeatures::isApplicationCacheEnabled());
     m_webView->initializeMainFrame(this);
 
diff --git a/WebKit/chromium/src/js/DebuggerScript.js b/WebKit/chromium/src/js/DebuggerScript.js
index baddb7d..25d1903 100644
--- a/WebKit/chromium/src/js/DebuggerScript.js
+++ b/WebKit/chromium/src/js/DebuggerScript.js
@@ -93,22 +93,19 @@ DebuggerScript._formatScript = function(script)
 DebuggerScript.setBreakpoint = function(execState, args)
 {
     args.lineNumber = DebuggerScript._webkitToV8LineNumber(args.lineNumber);
-    var key = args.scriptId + ":" + args.lineNumber;
-    var breakId = DebuggerScript._breakpoints[key];
-    if (breakId) {
-        if (args.enabled)
-            Debug.enableScriptBreakPoint(breakId);
-        else
-            Debug.disableScriptBreakPoint(breakId);
-        Debug.changeScriptBreakPointCondition(breakId, args.condition);
-        return breakId;
-    }
-
-    breakId = Debug.setScriptBreakPointById(args.scriptId, args.lineNumber, 0 /* column */, args.condition);
-    DebuggerScript._breakpoints[key] = breakId;
+    var breakId = Debug.setScriptBreakPointById(args.scriptId, args.lineNumber, 0 /* column */, args.condition);
     if (!args.enabled)
         Debug.disableScriptBreakPoint(breakId);
-    return breakId;
+
+    var actualLineNumber = args.lineNumber; // TODO: replace with real stuff after v8 roll.
+
+    var key = args.scriptId + ":" + actualLineNumber;
+    if (key in DebuggerScript._breakpoints) {
+        // Remove old breakpoint.
+        Debug.findBreakPoint(DebuggerScript._breakpoints[key], true);
+    }
+    DebuggerScript._breakpoints[key] = breakId;
+    return DebuggerScript._v8ToWebkitLineNumber(actualLineNumber);
 }
 
 DebuggerScript.removeBreakpoint = function(execState, args)
@@ -240,6 +237,9 @@ DebuggerScript._frameMirrorToJSCallFrame = function(frameMirror, callerFrame)
         var scopeObject = {};
         for (var j = 0; j < properties.length; j++)
             scopeObject[properties[j].name()] = properties[j].value_;
+        // Reset scope object prototype to null so that the proto properties
+        // don't appear in th local scope section.
+        scopeObject.__proto__ = null;
         scopeType.push(scopeMirror.scopeType());
         scopeChain.push(scopeObject);
     }
diff --git a/WebKit/chromium/src/js/DevToolsHostStub.js b/WebKit/chromium/src/js/DevToolsHostStub.js
index 806bf6a..bab73a9 100644
--- a/WebKit/chromium/src/js/DevToolsHostStub.js
+++ b/WebKit/chromium/src/js/DevToolsHostStub.js
@@ -37,5 +37,8 @@ if (!window["RemoteDebuggerAgent"]) {
     window["RemoteDebuggerAgent"] = { setDebuggerScriptSource: function() {} };
     window["RemoteDebuggerCommandExecutor"] = {};
     window["RemoteProfilerAgent"] = {};
-    window["RemoteToolsAgent"] = { dispatchOnInjectedScript: function() {} };
+    window["RemoteToolsAgent"] = {
+        dispatchOnInjectedScript: function() {},
+        dispatchOnInspectorController: function() {}
+    };
 }
diff --git a/WebKit/chromium/src/js/Tests.js b/WebKit/chromium/src/js/Tests.js
index 893bc56..cd4d9fb 100644
--- a/WebKit/chromium/src/js/Tests.js
+++ b/WebKit/chromium/src/js/Tests.js
@@ -1610,7 +1610,21 @@ TestSuite.prototype.testDebugIntrinsicProperties = function()
       if (window.v8ScriptDebugServerEnabled) {
       var scopeExpectations = [
           "a", "Child", [
-            "constructor", "function Child(n) {", null,
+            "__proto__", "Child", [
+                  "__proto__", "Parent", [
+                      "__proto__", "Object", null,
+                    "constructor", "function Parent(n) {", [
+                        "name", '"Parent"', null,
+                        "prototype", 'Parent', [
+                            "parentProtoField", "11", null,
+                        ]
+                    ],
+                    "parentProtoField", "11", null,
+                ],
+                "constructor", "function Child(n) {", null,
+                "childProtoField", "21", null,
+            ],
+
             "parentField", "10", null,
             "childField", "20", null,
           ]
@@ -1655,7 +1669,7 @@ TestSuite.prototype.testDebugIntrinsicProperties = function()
 
     var propQueue = [];
     var index = 0;
-    var expectedFinalIndex = (window.v8ScriptDebugServerEnabled ? 1 : 8);
+    var expectedFinalIndex = (window.v8ScriptDebugServerEnabled ? 5 : 8);
 
     function expandAndCheckNextProperty() {
         if (index === propQueue.length) {
diff --git a/WebKit/chromium/tests/PopupMenuTest.cpp b/WebKit/chromium/tests/PopupMenuTest.cpp
index 2756f9d..9a45dc2 100644
--- a/WebKit/chromium/tests/PopupMenuTest.cpp
+++ b/WebKit/chromium/tests/PopupMenuTest.cpp
@@ -122,12 +122,14 @@ public:
     virtual bool handleInputEvent(const WebInputEvent&) { return true; }
     virtual void mouseCaptureLost() { }
     virtual void setFocus(bool) { }
-    virtual bool handleCompositionEvent(WebCompositionCommand command,
-                                        int cursorPosition,
-                                        int targetStart,
-                                        int targetEnd,
-                                        const WebString& text) { return true; }
-    virtual bool queryCompositionStatus(bool* enabled, WebRect* caretBounds) { return true; }
+    virtual bool setComposition(
+        const WebString& text,
+        const WebVector<WebCompositionUnderline>& underlines,
+        int selectionStart,
+        int selectionEnd) { return true; }
+    virtual bool confirmComposition() { return true; }
+    virtual WebTextInputType textInputType() { return WebKit::WebTextInputTypeNone; }
+    virtual WebRect caretOrSelectionBounds() { return WebRect(); }
     virtual void setTextDirection(WebTextDirection) { }
 };
 
@@ -167,7 +169,7 @@ public:
 protected:
     virtual void SetUp()
     {
-        m_webView = static_cast<WebViewImpl*>(WebView::create(&m_webviewClient));
+        m_webView = static_cast<WebViewImpl*>(WebView::create(&m_webviewClient, 0));
         m_webView->initializeMainFrame(&m_webFrameClient);
         m_popupMenu = PopupMenu::create(&m_popupMenuClient);
     }
diff --git a/WebKit/efl/EWebLauncher/main.c b/WebKit/efl/EWebLauncher/main.c
index d36c807..6d484e4a 100644
--- a/WebKit/efl/EWebLauncher/main.c
+++ b/WebKit/efl/EWebLauncher/main.c
@@ -638,7 +638,7 @@ closeWindow(Ecore_Evas *ee)
     free(app);
 }
 
-static int
+static Eina_Bool
 main_signal_exit(void *data, int ev_type, void *ev)
 {
     ELauncher *app;
@@ -649,7 +649,7 @@ main_signal_exit(void *data, int ev_type, void *ev)
     }
     if (!eina_list_count(windows))
         ecore_main_loop_quit();
-    return 1;
+    return EINA_TRUE;
 }
 
 static char *
diff --git a/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp b/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
index 8ec65b9..5fef33e 100644
--- a/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
+++ b/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
@@ -49,9 +49,9 @@
 #include "PlatformString.h"
 #include "WindowFeatures.h"
 #include "ewk_private.h"
-#include <wtf/text/CString.h>
-
+#include <Ecore_Evas.h>
 #include <Evas.h>
+#include <wtf/text/CString.h>
 
 using namespace WebCore;
 
@@ -87,13 +87,28 @@ void ChromeClientEfl::focusedNodeChanged(Node*)
 
 FloatRect ChromeClientEfl::windowRect()
 {
-    notImplemented();
-    return FloatRect();
+    Ecore_Evas* ee = 0;
+    int x, y, w, h;
+
+    if (!m_view)
+        return FloatRect();
+
+    ee = ecore_evas_ecore_evas_get(evas_object_evas_get(m_view));
+    ecore_evas_geometry_get(ee, &x, &y, &w, &h);
+    return FloatRect(x, y, w, h);
 }
 
 void ChromeClientEfl::setWindowRect(const FloatRect& rect)
 {
-    notImplemented();
+    Ecore_Evas* ee = 0;
+    IntRect intrect = IntRect(rect);
+
+    if (!m_view)
+        return;
+
+    ee = ecore_evas_ecore_evas_get(evas_object_evas_get(m_view));
+    ecore_evas_move(ee, intrect.x(), intrect.y());
+    ecore_evas_resize(ee, intrect.width(), intrect.height());
 }
 
 FloatRect ChromeClientEfl::pageRect()
diff --git a/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp b/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
index 438d6a0..50356e9 100644
--- a/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
+++ b/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
@@ -749,9 +749,16 @@ void FrameLoaderClientEfl::dispatchDidFailLoad(const ResourceError& err)
                          m_loadError.failingURL().utf8().data());
 }
 
-void FrameLoaderClientEfl::download(ResourceHandle*, const ResourceRequest&, const ResourceRequest&, const ResourceResponse&)
+void FrameLoaderClientEfl::download(ResourceHandle*, const ResourceRequest& request, const ResourceRequest&, const ResourceResponse&)
 {
-    notImplemented();
+    if (!m_view)
+        return;
+
+    CString url = request.url().prettyURL().utf8();
+    Ewk_Download download;
+
+    download.url = url.data();
+    ewk_view_download_request(m_view, &download);
 }
 
 // copied from WebKit/Misc/WebKitErrors[Private].h
diff --git a/WebKit/efl/ewk/ewk_frame.cpp b/WebKit/efl/ewk/ewk_frame.cpp
index 6cbcefe..ec56221 100644
--- a/WebKit/efl/ewk/ewk_frame.cpp
+++ b/WebKit/efl/ewk/ewk_frame.cpp
@@ -43,6 +43,7 @@
 #include "ScriptValue.h"
 #include "SharedBuffer.h"
 #include "SubstituteData.h"
+#include "ZoomMode.h"
 #include "WindowsKeyboardCodes.h"
 #include "ewk_private.h"
 #include <wtf/text/CString.h>
@@ -68,7 +69,7 @@ struct Ewk_Frame_Smart_Data {
     struct {
         Evas_Coord w, h;
     } contents_size;
-    Eina_Bool zoom_text_only:1;
+    WebCore::ZoomMode zoom_mode;
     Eina_Bool editable:1;
 };
 
@@ -989,15 +990,10 @@ Eina_Bool ewk_frame_zoom_set(Evas_Object* o, float zoom)
 {
     EWK_FRAME_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
     EINA_SAFETY_ON_NULL_RETURN_VAL(sd->frame, EINA_FALSE);
-    WebCore::ZoomMode zoomMode;
-    if (sd->zoom_text_only)
-        zoomMode = WebCore::ZoomTextOnly;
-    else
-        zoomMode = WebCore::ZoomPage;
     WebCore::FrameView* view = sd->frame->view();
     if (!view)
         return EINA_FALSE;
-    view->setZoomFactor(zoom, zoomMode);
+    view->setZoomFactor(zoom, sd->zoom_mode);
     return EINA_TRUE;
 }
 
@@ -1011,7 +1007,7 @@ Eina_Bool ewk_frame_zoom_set(Evas_Object* o, float zoom)
 Eina_Bool ewk_frame_zoom_text_only_get(const Evas_Object* o)
 {
     EWK_FRAME_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
-    return sd->zoom_text_only;
+    return sd->zoom_mode == WebCore::ZoomTextOnly;
 }
 
 /**
@@ -1026,20 +1022,15 @@ Eina_Bool ewk_frame_zoom_text_only_set(Evas_Object* o, Eina_Bool setting)
 {
     EWK_FRAME_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
     EINA_SAFETY_ON_NULL_RETURN_VAL(sd->frame, EINA_FALSE);
-    setting = !!setting;
-    if (sd->zoom_text_only == setting)
+    WebCore::ZoomMode zm = setting ? WebCore::ZoomTextOnly : WebCore::ZoomPage;
+    if (sd->zoom_mode == zm)
         return EINA_TRUE;
 
-    sd->zoom_text_only = setting;
-    WebCore::ZoomMode zoomMode;
-    if (sd->zoom_text_only)
-        zoomMode = WebCore::ZoomTextOnly;
-    else
-        zoomMode = WebCore::ZoomPage;
+    sd->zoom_mode = zm;
     WebCore::FrameView* view = sd->frame->view();
     if (!view)
         return EINA_FALSE;
-    view->setZoomFactor(view->zoomFactor(), zoomMode);
+    view->setZoomFactor(view->zoomFactor(), sd->zoom_mode);
     return EINA_TRUE;
 }
 
diff --git a/WebKit/efl/ewk/ewk_private.h b/WebKit/efl/ewk/ewk_private.h
index facd6aa..83eef91 100644
--- a/WebKit/efl/ewk/ewk_private.h
+++ b/WebKit/efl/ewk/ewk_private.h
@@ -96,6 +96,8 @@ WTF::PassRefPtr<WebCore::Widget> ewk_view_plugin_create(Evas_Object* o, Evas_Obj
 
 void             ewk_view_popup_new(Evas_Object *o, WebCore::PopupMenuClient* client, int selected, const WebCore::IntRect& rect);
 
+void             ewk_view_download_request(Evas_Object *o, Ewk_Download *download);
+
 Ewk_History      *ewk_history_new(WebCore::BackForwardList *history);
 void              ewk_history_free(Ewk_History *history);
 
diff --git a/WebKit/efl/ewk/ewk_view.cpp b/WebKit/efl/ewk/ewk_view.cpp
index 8d66734..ca26f64 100644
--- a/WebKit/efl/ewk/ewk_view.cpp
+++ b/WebKit/efl/ewk/ewk_view.cpp
@@ -880,7 +880,7 @@ static float _ewk_view_zoom_animated_current(Ewk_View_Private_Data* priv)
             + priv->animated_zoom.zoom.start);
 }
 
-static int _ewk_view_zoom_animator_cb(void* data)
+static Eina_Bool _ewk_view_zoom_animator_cb(void* data)
 {
     Ewk_View_Smart_Data* sd = (Ewk_View_Smart_Data*)data;
     Evas_Coord cx, cy;
@@ -900,12 +900,12 @@ static int _ewk_view_zoom_animator_cb(void* data)
         || (now < priv->animated_zoom.time.start)) {
         _ewk_view_zoom_animated_finish(sd);
         ewk_view_zoom_set(sd->self, priv->animated_zoom.zoom.end, cx, cy);
-        return 0;
+        return EINA_FALSE;
     }
 
     sd->animated_zoom.zoom.current = _ewk_view_zoom_animated_current(priv);
     sd->api->zoom_weak_set(sd, sd->animated_zoom.zoom.current, cx, cy);
-    return 1;
+    return EINA_TRUE;
 }
 
 static void _ewk_view_zoom_animation_start(Ewk_View_Smart_Data* sd)
diff --git a/WebKit/gtk/ChangeLog b/WebKit/gtk/ChangeLog
index e13e9ce..a33506c 100644
--- a/WebKit/gtk/ChangeLog
+++ b/WebKit/gtk/ChangeLog
@@ -1,3 +1,245 @@
+2010-06-23  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Separate DerivedSources per-project
+        https://bugs.webkit.org/show_bug.cgi?id=41109
+
+        Separate WebKitGTK+ DerivedSources into per-project subdirectories to prepare
+        for properly building WebKit2.
+
+        * webkitmarshal.list: Touch this file to force a rebuild of the marshaling code.
+
+2010-07-01  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Stop using GdkRegion in 3.x mode
+        https://bugs.webkit.org/show_bug.cgi?id=41463
+
+        Make us compile without using GdkRegion, since it's gone from GTK+
+        3.x.
+
+        * WebCoreSupport/ChromeClientGtk.cpp:
+        (WebKit::ChromeClient::scroll):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_expose_event):
+
+2010-07-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Convert WebKitWebView's private draggingDataObjects member to a pointer
+        https://bugs.webkit.org/show_bug.cgi?id=40333
+
+        Convert draggingDataObjects to a pointer. The constructor and destructor of the
+        HashMap should be called explicitly. GObject memory allocation does not do this.
+
+        * WebCoreSupport/DragClientGtk.cpp:
+        (WebKit::DragClient::startDrag):
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_dispose):
+        (webkit_web_view_drag_end):
+        (webkit_web_view_drag_data_get):
+        (webkit_web_view_init):
+
+2010-06-30  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed, rolling out r62226.
+        http://trac.webkit.org/changeset/62226
+        https://bugs.webkit.org/show_bug.cgi?id=40333
+
+        This change caused 13 new crashers.
+
+        * WebCoreSupport/DragClientGtk.cpp:
+        (WebKit::DragClient::startDrag):
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_dispose):
+        (webkit_web_view_drag_end):
+        (webkit_web_view_drag_data_get):
+        (webkit_web_view_init):
+
+2010-06-30  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Convert WebKitWebView's private draggingDataObjects member to a pointer
+        https://bugs.webkit.org/show_bug.cgi?id=40333
+
+        Convert draggingDataObjects to a pointer. The constructor and destructor of the
+        HashMap should be called explicitly. GObject memory allocation does not do this.
+
+        * WebCoreSupport/DragClientGtk.cpp:
+        (WebKit::DragClient::startDrag):
+        * webkit/webkitprivate.h:
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_dispose):
+        (webkit_web_view_drag_end):
+        (webkit_web_view_drag_data_get):
+        (webkit_web_view_init):
+
+2010-06-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Unit test for DOM insertion methods
+        https://bugs.webkit.org/show_bug.cgi?id=40495
+
+        Add unit test for webkit_dom_node_remove_child.
+
+        * tests/testdomnode.c:
+        (test_dom_node_insertion):
+
+2010-06-30  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Unit test for DOM insertion methods
+        https://bugs.webkit.org/show_bug.cgi?id=40495
+
+        Add unit tests for node insertion and replacement methods.
+
+        * tests/testdomnode.c:
+        (test_dom_node_insertion):
+        (main):
+
+2010-06-30  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Random failure on 'testdownload' unit test
+        https://bugs.webkit.org/show_bug.cgi?id=38256
+
+        Make sure the set_filename function is called after handling the
+        'download-requested' signal for the asynchronous test. This change
+        is needed because it could happen, with the current code, that the
+        set_filename () function got called too early in the mainloop,
+        therefore screwing the tests because the 'theDownload' global
+        variable wouldn't be properly set yet.
+
+        With this modification we ensure the set_filename() function gets
+        called always after handling the download-requested signal,
+        therefore avoiding potentialproblems.
+
+        * tests/testdownload.c:
+        (set_filename):
+        (handle_download_requested_cb):
+        (download_requested_cb):
+        (download_requested_asynch_cb):
+        (test_webkit_download_perform):
+
+2010-06-30  José Millán Soto  <jmillan@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Text attributes not exposed
+        https://bugs.webkit.org/show_bug.cgi?id=25528
+
+        Added new tests for accessible text attributes
+
+        * tests/testatk.c:
+        (compAtkAttribute):
+        (compAtkAttributeName):
+        (atkAttributeSetAttributeHasValue):
+        (atkAttributeSetAreEqual):
+        (testWebkitAtkTextAttributes):
+        (main):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        Update for 1.3.2.
+
+        * NEWS:
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Does not compile with -DGSEAL_ENABLE
+        https://bugs.webkit.org/show_bug.cgi?id=37851
+
+        Fix build with GSEAL enabled.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::transitionToCommittedForNewPage):
+        * webkit/webkitsoupauthdialog.c:
+        (show_auth_dialog):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Add support for GTK+3
+        https://bugs.webkit.org/show_bug.cgi?id=41253
+
+        Adapt build system to 3.x support, allow the JSCore gir and webkit
+        pc files to be configurable at build time for different API
+        versions.
+
+        * JSCore-1.0.gir: Removed.
+        * JSCore.gir.in: Added.
+        * docs/GNUmakefile.am:
+        * webkit.pc.in:
+
+2010-06-25  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Implement atk_table_get_column_header
+        https://bugs.webkit.org/show_bug.cgi?id=30896
+
+        Replace g_timeout_add() with g_idle_add().
+
+        * tests/testatk.c:
+        (test_webkit_atk_get_text_at_offset_forms):
+        (test_webkit_atk_get_text_at_offset):
+        (test_webkit_atk_get_text_at_offset_newlines):
+        (test_webkit_atk_get_text_at_offset_textarea):
+        (test_webkit_atk_get_text_at_offset_text_input):
+        (testWebkitAtkGetTextInParagraphAndBodySimple):
+        (testWebkitAtkGetTextInParagraphAndBodyModerate):
+        (testWebkitAtkGetTextInTable):
+        (testWebkitAtkGetHeadersInTable):
+
+2010-06-25  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Implement atk_table_get_column_header
+        https://bugs.webkit.org/show_bug.cgi?id=30896
+
+        Added new test to check whether the implementation of
+        get_column_headers() and get_row_headers() works ok.
+
+        * tests/testatk.c:
+        (testWebkitAtkGetHeadersInTable):
+        (main):
+
+2010-06-25  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Pasteboard code does not take into account the nil character when getting and setting markup/netscape-url data
+        https://bugs.webkit.org/show_bug.cgi?id=41221
+
+        Add a test for this issue which simulates a paste keyboard event into an editable
+        body. The pasteboard should contain a markup portion containing a null terminator.
+
+        * tests/testcopyandpaste.c:
+        (test_info_new):
+        (test_info_destroy):
+        (load_status_cb):
+        (runPasteTestCallback):
+        (window_object_cleared_callback):
+        (pasting_test_get_data_callback):
+        (pasting_test_clear_data_callback):
+        (test_pasting_markup):
+        (main):
+
 2010-06-24  Martin Robinson  <mrobinson@igalia.com>
 
         Reviewed by Xan Lopez.
diff --git a/WebKit/gtk/JSCore-1.0.gir b/WebKit/gtk/JSCore.gir.in
index 2fb4d46..e979c33 100644
--- a/WebKit/gtk/JSCore-1.0.gir
+++ b/WebKit/gtk/JSCore.gir.in
@@ -1,8 +1,8 @@
 <?xml version="1.0"?>
-<repository version="1.0"
+<repository version="1.1"
             xmlns="http://www.gtk.org/introspection/core/1.0"
             xmlns:c="http://www.gtk.org/introspection/c/1.0">
-  <namespace name="JSCore" version="1.0" shared-library="webkit-1.0">
+  <namespace name="JSCore" version="@WEBKITGTK_API_VERSION@" shared-library="webkitgtk-@WEBKITGTK_API_VERSION@">
     <alias name="GlobalContextRef"
            target="none"
            c:type="JSGlobalContextRef"/>
diff --git a/WebKit/gtk/NEWS b/WebKit/gtk/NEWS
index fc87b35..eb6d8cc 100644
--- a/WebKit/gtk/NEWS
+++ b/WebKit/gtk/NEWS
@@ -1,4 +1,31 @@
 ================
+WebKitGTK+ 1.3.2
+================
+
+What's new in WebKitGTK+ 1.3.2?
+
+*** This release is an ABI break ***
+
+The library has been renamed to libwebkitgtk, so you'll need to
+recompile your applications when upgrading to 1.3.2.
+
+  - Add support for GTK+ 3.x. A new configure flag, --with-gtk, has
+    been added, which allows to control which GTK+ version you want to
+    build against. The default value is '2.0', for GTK+ 2.x
+    support. With '3.0' the library will be compiled against GTK+ 3.x
+    (2.90.4 or newer required). In the 3.x mode the .pc file has been
+    renamed from webkit-X.X.pc to webkitgtk-X.X.pc, so you'll need to
+    update your autotools setup accordingly.
+  - Many fixes for the DOM bindings, including support to dispatch
+    events to any Node through webkit_event_target_dispatch_event.
+  - Added a 'inner-node' property to WebKitHitTestResult, carrying the
+    DOM node where the hit test happened.
+  - Many DnD fixes, including a fix for the infamous hang-of-death
+    while dragging the mouse.
+  - Support for <input type="range">.
+  - Many other bugfixes.
+
+================
 WebKitGTK+ 1.3.1
 ================
 
diff --git a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
index fe5d9eb..bb469c5 100644
--- a/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp
@@ -372,6 +372,7 @@ void ChromeClient::scroll(const IntSize& delta, const IntRect& rectToScroll, con
     sourceRect.x -= delta.width();
     sourceRect.y -= delta.height();
 
+#ifdef GTK_API_VERSION_2
     GdkRegion* invalidRegion = gdk_region_rectangle(&area);
 
     if (gdk_rectangle_intersect(&area, &sourceRect, &moveRect)) {
@@ -384,6 +385,21 @@ void ChromeClient::scroll(const IntSize& delta, const IntRect& rectToScroll, con
 
     gdk_window_invalidate_region(window, invalidRegion, FALSE);
     gdk_region_destroy(invalidRegion);
+#else
+    cairo_region_t* invalidRegion = cairo_region_create_rectangle(&area);
+
+    if (gdk_rectangle_intersect(&area, &sourceRect, &moveRect)) {
+        cairo_region_t* moveRegion = cairo_region_create_rectangle(&moveRect);
+        gdk_window_move_region(window, moveRegion, delta.width(), delta.height());
+        cairo_region_translate(moveRegion, delta.width(), delta.height());
+        cairo_region_subtract(invalidRegion, moveRegion);
+        cairo_region_destroy(moveRegion);
+    }
+
+    gdk_window_invalidate_region(window, invalidRegion, FALSE);
+    cairo_region_destroy(invalidRegion);
+#endif
+
 }
 
 // FIXME: this does not take into account the WM decorations
diff --git a/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp b/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp
index 4bcc4c2..efce3dc 100644
--- a/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp
@@ -77,7 +77,7 @@ void DragClient::startDrag(DragImageRef image, const IntPoint& dragImageOrigin,
     GOwnPtr<GdkEvent> currentEvent(gtk_get_current_event());
 
     GdkDragContext* context = gtk_drag_begin(GTK_WIDGET(m_webView), targetList.get(), dragOperationToGdkDragActions(clipboard->sourceOperation()), 1, currentEvent.get());
-    webView->priv->draggingDataObjects.set(context, dataObject);
+    webView->priv->draggingDataObjects->set(context, dataObject);
 
     // A drag starting should prevent a double-click from happening. This might
     // happen if a drag is followed very quickly by another click (like in the DRT).
diff --git a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index 17a3cd5..340b789 100644
--- a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -1164,8 +1164,13 @@ void FrameLoaderClient::transitionToCommittedFromCachedFrame(CachedFrame* cached
 void FrameLoaderClient::transitionToCommittedForNewPage()
 {
     WebKitWebView* containingWindow = getViewFromFrame(m_frame);
-    IntSize size = IntSize(GTK_WIDGET(containingWindow)->allocation.width,
-                           GTK_WIDGET(containingWindow)->allocation.height);
+    GtkAllocation allocation;
+#if GTK_CHECK_VERSION(2, 18, 0)
+    gtk_widget_get_allocation(GTK_WIDGET(containingWindow), &allocation);
+#else
+    allocation = GTK_WIDGET(containingWindow)->allocation;
+#endif
+    IntSize size = IntSize(allocation.width, allocation.height);
     bool transparent = webkit_web_view_get_transparent(containingWindow);
     Color backgroundColor = transparent ? WebCore::Color::transparent : WebCore::Color::white;
     Frame* frame = core(m_frame);
diff --git a/WebKit/gtk/docs/GNUmakefile.am b/WebKit/gtk/docs/GNUmakefile.am
index 968b7f6..105e277 100644
--- a/WebKit/gtk/docs/GNUmakefile.am
+++ b/WebKit/gtk/docs/GNUmakefile.am
@@ -84,7 +84,7 @@ INCLUDES= \
 	$(GTK_CFLAGS) \
 	$(LIBSOUP_CFLAGS)
 GTKDOC_LIBS= \
-	$(top_builddir)/libwebkit-1.0.la \
+	$(top_builddir)/libwebkitgtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
 	$(GLIB_LIBS) \
 	$(GTK_LIBS) \
 	$(LIBSOUP_LIBS)
diff --git a/WebKit/gtk/tests/testatk.c b/WebKit/gtk/tests/testatk.c
index 1f1ab0c..8f13a95 100644
--- a/WebKit/gtk/tests/testatk.c
+++ b/WebKit/gtk/tests/testatk.c
@@ -40,6 +40,10 @@ static const char* contentsInParagraphAndBodyModerate = "<html><body><p>This is
 
 static const char* contentsInTable = "<html><body><table><tr><td>foo</td><td>bar</td></tr></table></body></html>";
 
+static const char* contentsInTableWithHeaders = "<html><body><table><tr><th>foo</th><th>bar</th><th colspan='2'>baz</th></tr><tr><th>qux</th><td>1</td><td>2</td><td>3</td></tr><tr><th rowspan='2'>quux</th><td>4</td><td>5</td><td>6</td></tr><tr><td>6</td><td>7</td><td>8</td></tr><tr><th>corge</th><td>9</td><td>10</td><td>11</td></tr></table><table><tr><td>1</td><td>2</td></tr><tr><td>3</td><td>4</td></tr></table></body></html>";
+
+static const char* textWithAttributes = "<html><head><style>.st1 {font-family: monospace; color:rgb(120,121,122);} .st2 {text-decoration:underline; background-color:rgb(80,81,82);}</style></head><body><p style=\"font-size:14; text-align:right;\">This is the <i>first</i><b> sentence of this text.</b></p><p class=\"st1\">This sentence should have an style applied <span class=\"st2\">and this part should have another one</span>.</p><p>x<sub>1</sub><sup>2</sup>=x<sub>2</sub><sup>3</sup></p><p style=\"text-align:center;\">This sentence is the <strike>last</strike> one.</p></body></html>";
+
 static gboolean bail_out(GMainLoop* loop)
 {
     if (g_main_loop_is_running(loop))
@@ -219,7 +223,7 @@ static void test_webkit_atk_get_text_at_offset_forms(void)
     webkit_web_view_load_string(webView, contents, NULL, NULL, NULL);
     loop = g_main_loop_new(NULL, TRUE);
 
-    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_idle_add((GSourceFunc)bail_out, loop);
     g_main_loop_run(loop);
 
     /* Get to the inner AtkText object */
@@ -250,7 +254,7 @@ static void test_webkit_atk_get_text_at_offset(void)
     webkit_web_view_load_string(webView, contents, NULL, NULL, NULL);
     loop = g_main_loop_new(NULL, TRUE);
 
-    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_idle_add((GSourceFunc)bail_out, loop);
     g_main_loop_run(loop);
 
     /* Get to the inner AtkText object */
@@ -281,7 +285,7 @@ static void test_webkit_atk_get_text_at_offset_newlines(void)
     webkit_web_view_load_string(webView, contentsWithNewlines, NULL, NULL, NULL);
     loop = g_main_loop_new(NULL, TRUE);
 
-    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_idle_add((GSourceFunc)bail_out, loop);
     g_main_loop_run(loop);
 
     /* Get to the inner AtkText object */
@@ -312,7 +316,7 @@ static void test_webkit_atk_get_text_at_offset_textarea(void)
     webkit_web_view_load_string(webView, contentsInTextarea, NULL, NULL, NULL);
     loop = g_main_loop_new(NULL, TRUE);
 
-    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_idle_add((GSourceFunc)bail_out, loop);
     g_main_loop_run(loop);
 
     /* Get to the inner AtkText object */
@@ -345,7 +349,7 @@ static void test_webkit_atk_get_text_at_offset_text_input(void)
     webkit_web_view_load_string(webView, contentsInTextInput, NULL, NULL, NULL);
     loop = g_main_loop_new(NULL, TRUE);
 
-    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_idle_add((GSourceFunc)bail_out, loop);
     g_main_loop_run(loop);
 
     /* Get to the inner AtkText object */
@@ -381,7 +385,7 @@ static void testWebkitAtkGetTextInParagraphAndBodySimple(void)
     webkit_web_view_load_string(webView, contentsInParagraphAndBodySimple, NULL, NULL, NULL);
     loop = g_main_loop_new(NULL, TRUE);
 
-    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_idle_add((GSourceFunc)bail_out, loop);
     g_main_loop_run(loop);
 
     /* Get to the inner AtkText object */
@@ -425,7 +429,7 @@ static void testWebkitAtkGetTextInParagraphAndBodyModerate(void)
     webkit_web_view_load_string(webView, contentsInParagraphAndBodyModerate, NULL, NULL, NULL);
     loop = g_main_loop_new(NULL, TRUE);
 
-    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_idle_add((GSourceFunc)bail_out, loop);
     g_main_loop_run(loop);
 
     /* Get to the inner AtkText object */
@@ -465,7 +469,7 @@ static void testWebkitAtkGetTextInTable(void)
     webkit_web_view_load_string(webView, contentsInTable, NULL, NULL, NULL);
     loop = g_main_loop_new(NULL, TRUE);
 
-    g_timeout_add(100, (GSourceFunc)bail_out, loop);
+    g_idle_add((GSourceFunc)bail_out, loop);
     g_main_loop_run(loop);
 
     obj = gtk_widget_get_accessible(GTK_WIDGET(webView));
@@ -480,6 +484,260 @@ static void testWebkitAtkGetTextInTable(void)
     g_object_unref(webView);
 }
 
+static void testWebkitAtkGetHeadersInTable(void)
+{
+    WebKitWebView* webView;
+    AtkObject* axWebView;
+    AtkObject* table;
+    AtkObject* colHeader;
+    AtkObject* rowHeader;
+    GMainLoop* loop;
+
+    webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(webView);
+    GtkAllocation alloc = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
+    webkit_web_view_load_string(webView, contentsInTableWithHeaders, NULL, NULL, NULL);
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_idle_add((GSourceFunc)bail_out, loop);
+    g_main_loop_run(loop);
+
+    axWebView = gtk_widget_get_accessible(GTK_WIDGET(webView));
+    g_assert(axWebView);
+
+    // Check table with both column and row headers
+    table = atk_object_ref_accessible_child(axWebView, 0);
+    g_assert(table);
+    g_assert(atk_object_get_role(table) == ATK_ROLE_TABLE);
+
+    colHeader = atk_table_get_column_header(ATK_TABLE(table), 0);
+    g_assert(colHeader);
+    g_assert(atk_object_get_role(colHeader) == ATK_ROLE_TABLE_CELL);
+    g_assert(atk_object_get_index_in_parent(colHeader) == 0);
+
+    colHeader = atk_table_get_column_header(ATK_TABLE(table), 1);
+    g_assert(colHeader);
+    g_assert(atk_object_get_role(colHeader) == ATK_ROLE_TABLE_CELL);
+    g_assert(atk_object_get_index_in_parent(colHeader) == 1);
+
+    colHeader = atk_table_get_column_header(ATK_TABLE(table), 2);
+    g_assert(colHeader);
+    g_assert(atk_object_get_role(colHeader) == ATK_ROLE_TABLE_CELL);
+    g_assert(atk_object_get_index_in_parent(colHeader) == 2);
+
+    colHeader = atk_table_get_column_header(ATK_TABLE(table), 3);
+    g_assert(colHeader);
+    g_assert(atk_object_get_role(colHeader) == ATK_ROLE_TABLE_CELL);
+    g_assert(atk_object_get_index_in_parent(colHeader) == 2);
+
+    rowHeader = atk_table_get_row_header(ATK_TABLE(table), 0);
+    g_assert(rowHeader);
+    g_assert(atk_object_get_role(rowHeader) == ATK_ROLE_TABLE_CELL);
+    g_assert(atk_object_get_index_in_parent(rowHeader) == 0);
+
+    rowHeader = atk_table_get_row_header(ATK_TABLE(table), 1);
+    g_assert(rowHeader);
+    g_assert(atk_object_get_role(rowHeader) == ATK_ROLE_TABLE_CELL);
+    g_assert(atk_object_get_index_in_parent(rowHeader) == 3);
+
+    rowHeader = atk_table_get_row_header(ATK_TABLE(table), 2);
+    g_assert(rowHeader);
+    g_assert(atk_object_get_role(rowHeader) == ATK_ROLE_TABLE_CELL);
+    g_assert(atk_object_get_index_in_parent(rowHeader) == 7);
+
+    rowHeader = atk_table_get_row_header(ATK_TABLE(table), 3);
+    g_assert(rowHeader);
+    g_assert(atk_object_get_role(rowHeader) == ATK_ROLE_TABLE_CELL);
+    g_assert(atk_object_get_index_in_parent(rowHeader) == 7);
+
+    g_object_unref(table);
+
+    // Check table with no headers at all
+    table = atk_object_ref_accessible_child(axWebView, 1);
+    g_assert(table);
+    g_assert(atk_object_get_role(table) == ATK_ROLE_TABLE);
+
+    colHeader = atk_table_get_column_header(ATK_TABLE(table), 0);
+    g_assert(colHeader == 0);
+
+    colHeader = atk_table_get_column_header(ATK_TABLE(table), 1);
+    g_assert(colHeader == 0);
+
+    rowHeader = atk_table_get_row_header(ATK_TABLE(table), 0);
+    g_assert(rowHeader == 0);
+
+    rowHeader = atk_table_get_row_header(ATK_TABLE(table), 1);
+    g_assert(rowHeader == 0);
+
+    g_object_unref(table);
+    g_object_unref(webView);
+}
+
+static gint compAtkAttribute(AtkAttribute* a1, AtkAttribute* a2)
+{
+    gint strcmpVal;
+    strcmpVal = g_strcmp0(a1->name, a2->name);
+    if (strcmpVal)
+        return strcmpVal;
+    return g_strcmp0(a1->value, a2->value);
+}
+
+static gint compAtkAttributeName(AtkAttribute* a1, AtkAttribute* a2)
+{
+    return g_strcmp0(a1->name, a2->name);
+}
+
+static gboolean atkAttributeSetAttributeHasValue(AtkAttributeSet* set, AtkTextAttribute attribute, const gchar* value)
+{
+    GSList *element;
+    AtkAttribute at;
+    gboolean result;
+    at.name = (gchar *)atk_text_attribute_get_name(attribute);
+    element = g_slist_find_custom(set, &at, (GCompareFunc)compAtkAttributeName);
+    result = element && !g_strcmp0(((AtkAttribute*)(element->data))->value, value);
+    return result;
+}
+
+static gboolean atkAttributeSetAreEqual(AtkAttributeSet* set1, AtkAttributeSet* set2)
+{
+    if (!set1)
+        return !set2;
+
+    set1 = g_slist_sort(set1, (GCompareFunc)compAtkAttribute);
+    set2 = g_slist_sort(set2, (GCompareFunc)compAtkAttribute);
+
+    while (set1) {
+        if (!set2 || compAtkAttribute(set1->data, set2->data))
+            return FALSE;
+
+        set1 = set1->next;
+        set2 = set2->next;
+    }
+
+    return (!set2);
+}
+
+static void testWebkitAtkTextAttributes(void)
+{
+    WebKitWebView* webView;
+    AtkObject* obj;
+    AtkObject* child;
+    GMainLoop* loop;
+    AtkText* childText;
+    AtkAttributeSet* set1;
+    AtkAttributeSet* set2;
+    AtkAttributeSet* set3;
+    AtkAttributeSet* set4;
+    gint startOffset, endOffset;
+
+    webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    g_object_ref_sink(webView);
+    GtkAllocation alloc = { 0, 0, 800, 600 };
+    gtk_widget_size_allocate(GTK_WIDGET(webView), &alloc);
+
+    webkit_web_view_load_string(webView, textWithAttributes, NULL, NULL, NULL);
+    loop = g_main_loop_new(NULL, TRUE);
+
+    g_idle_add((GSourceFunc)bail_out, loop);
+    g_main_loop_run(loop);
+
+    obj = gtk_widget_get_accessible(GTK_WIDGET(webView));
+    g_assert(obj);
+
+    child = atk_object_ref_accessible_child(obj, 0);
+    g_assert(child && ATK_IS_TEXT(child));
+    childText = ATK_TEXT(child);
+    set1 = atk_text_get_run_attributes(childText, 0, &startOffset, &endOffset);
+    g_assert_cmpint(startOffset, ==, 0);
+    g_assert_cmpint(endOffset, ==, 12);
+    g_assert(atkAttributeSetAreEqual(set1, NULL));
+
+    set2 = atk_text_get_run_attributes(childText, 15, &startOffset, &endOffset);
+    g_assert_cmpint(startOffset, ==, 12);
+    g_assert_cmpint(endOffset, ==, 17);
+    g_assert(atkAttributeSetAttributeHasValue(set2, ATK_TEXT_ATTR_STYLE, "italic"));
+
+    set3 = atk_text_get_run_attributes(childText, 17, &startOffset, &endOffset);
+    g_assert_cmpint(startOffset, ==, 17);
+    g_assert_cmpint(endOffset, ==, 40);
+    g_assert(atkAttributeSetAttributeHasValue(set3, ATK_TEXT_ATTR_WEIGHT, "700"));
+
+    set4 = atk_text_get_default_attributes(childText);
+    g_assert(atkAttributeSetAttributeHasValue(set4, ATK_TEXT_ATTR_STYLE, "normal"));
+    g_assert(atkAttributeSetAttributeHasValue(set4, ATK_TEXT_ATTR_JUSTIFICATION, "right"));
+    g_assert(atkAttributeSetAttributeHasValue(set4, ATK_TEXT_ATTR_SIZE, "14"));
+    atk_attribute_set_free(set1);
+    atk_attribute_set_free(set2);
+    atk_attribute_set_free(set3);
+    atk_attribute_set_free(set4);
+
+    child = atk_object_ref_accessible_child(obj, 1);
+    g_assert(child && ATK_IS_TEXT(child));
+    childText = ATK_TEXT(child);
+
+    set1 = atk_text_get_default_attributes(childText);
+    g_assert(atkAttributeSetAttributeHasValue(set1, ATK_TEXT_ATTR_FAMILY_NAME, "monospace"));
+    g_assert(atkAttributeSetAttributeHasValue(set1, ATK_TEXT_ATTR_STYLE, "normal"));
+    g_assert(atkAttributeSetAttributeHasValue(set1, ATK_TEXT_ATTR_STRIKETHROUGH, "false"));
+    g_assert(atkAttributeSetAttributeHasValue(set1, ATK_TEXT_ATTR_WEIGHT, "400"));
+    g_assert(atkAttributeSetAttributeHasValue(set1, ATK_TEXT_ATTR_FG_COLOR, "120,121,122"));
+
+    set2 = atk_text_get_run_attributes(childText, 43, &startOffset, &endOffset);
+    g_assert_cmpint(startOffset, ==, 43);
+    g_assert_cmpint(endOffset, ==, 80);
+    // Checks that default attributes of text are not returned when called to atk_text_get_run_attributes
+    g_assert(!atkAttributeSetAttributeHasValue(set2, ATK_TEXT_ATTR_FG_COLOR, "120,121,122"));
+    g_assert(atkAttributeSetAttributeHasValue(set2, ATK_TEXT_ATTR_UNDERLINE, "single"));
+    g_assert(atkAttributeSetAttributeHasValue(set2, ATK_TEXT_ATTR_BG_COLOR, "80,81,82"));
+    atk_attribute_set_free(set1);
+    atk_attribute_set_free(set2);
+
+    child = atk_object_ref_accessible_child(obj, 2);
+    g_assert(child && ATK_IS_TEXT(child));
+    childText = ATK_TEXT(child);
+
+    set1 = atk_text_get_run_attributes(childText, 0, &startOffset, &endOffset);
+    set2 = atk_text_get_run_attributes(childText, 3, &startOffset, &endOffset);
+    g_assert(atkAttributeSetAreEqual(set1, set2));
+    atk_attribute_set_free(set2);
+
+    set2 = atk_text_get_run_attributes(childText, 1, &startOffset, &endOffset);
+    set3 = atk_text_get_run_attributes(childText, 5, &startOffset, &endOffset);
+    g_assert(atkAttributeSetAreEqual(set2, set3));
+    g_assert(!atkAttributeSetAreEqual(set1, set2));
+    atk_attribute_set_free(set3);
+
+    set3 = atk_text_get_run_attributes(childText, 2, &startOffset, &endOffset);
+    set4 = atk_text_get_run_attributes(childText, 6, &startOffset, &endOffset);
+    g_assert(atkAttributeSetAreEqual(set3, set4));
+    g_assert(!atkAttributeSetAreEqual(set1, set3));
+    g_assert(!atkAttributeSetAreEqual(set2, set3));
+    atk_attribute_set_free(set1);
+    atk_attribute_set_free(set2);
+    atk_attribute_set_free(set3);
+    atk_attribute_set_free(set4);
+
+    child = atk_object_ref_accessible_child(obj, 3);
+    g_assert(child && ATK_IS_TEXT(child));
+    childText = ATK_TEXT(child);
+    set1 = atk_text_get_run_attributes(childText, 24, &startOffset, &endOffset);
+    g_assert_cmpint(startOffset, ==, 21);
+    g_assert_cmpint(endOffset, ==, 25);
+    g_assert(atkAttributeSetAttributeHasValue(set1, ATK_TEXT_ATTR_STRIKETHROUGH, "true"));
+
+    set2 = atk_text_get_run_attributes(childText, 25, &startOffset, &endOffset);
+    g_assert_cmpint(startOffset, ==, 25);
+    g_assert_cmpint(endOffset, ==, 30);
+    g_assert(atkAttributeSetAreEqual(set2, NULL));
+
+    set3 = atk_text_get_default_attributes(childText);
+    g_assert(atkAttributeSetAttributeHasValue(set3, ATK_TEXT_ATTR_JUSTIFICATION, "center"));
+    atk_attribute_set_free(set1);
+    atk_attribute_set_free(set2);
+    atk_attribute_set_free(set3);
+}
+
 int main(int argc, char** argv)
 {
     g_thread_init(NULL);
@@ -494,6 +752,8 @@ int main(int argc, char** argv)
     g_test_add_func("/webkit/atk/getTextInParagraphAndBodySimple", testWebkitAtkGetTextInParagraphAndBodySimple);
     g_test_add_func("/webkit/atk/getTextInParagraphAndBodyModerate", testWebkitAtkGetTextInParagraphAndBodyModerate);
     g_test_add_func("/webkit/atk/getTextInTable", testWebkitAtkGetTextInTable);
+    g_test_add_func("/webkit/atk/getHeadersInTable", testWebkitAtkGetHeadersInTable);
+    g_test_add_func("/webkit/atk/textAttributes", testWebkitAtkTextAttributes);
     return g_test_run ();
 }
 
diff --git a/WebKit/gtk/tests/testcopyandpaste.c b/WebKit/gtk/tests/testcopyandpaste.c
index 034a429..0ef91d1 100644
--- a/WebKit/gtk/tests/testcopyandpaste.c
+++ b/WebKit/gtk/tests/testcopyandpaste.c
@@ -30,7 +30,7 @@
 
 typedef struct {
     char* page;
-    char* expectedPlainText;
+    char* expectedContent;
 } TestInfo;
 
 typedef struct {
@@ -41,13 +41,13 @@ typedef struct {
 } CopyAndPasteFixture;
 
 TestInfo*
-test_info_new(const char* page, const char* expectedPlainText)
+test_info_new(const char* page, const char* expectedContent)
 {
     TestInfo* info;
     info = g_slice_new0(TestInfo);
     info->page = g_strdup(page);
-    if (expectedPlainText)
-        info->expectedPlainText = g_strdup(expectedPlainText);
+    if (expectedContent)
+        info->expectedContent = g_strdup(expectedContent);
     return info;
 }
 
@@ -55,7 +55,7 @@ void
 test_info_destroy(TestInfo* info)
 {
     g_free(info->page);
-    g_free(info->expectedPlainText);
+    g_free(info->expectedContent);
     g_slice_free(TestInfo, info);
 }
 
@@ -89,8 +89,8 @@ static void load_status_cb(WebKitWebView* webView, GParamSpec* spec, gpointer da
     webkit_web_view_copy_clipboard(webView);
 
     gchar* text = gtk_clipboard_wait_for_text(clipboard);
-    g_assert(text || !fixture->info->expectedPlainText);
-    g_assert(!text || !strcmp(text, fixture->info->expectedPlainText));
+    g_assert(text || !fixture->info->expectedContent);
+    g_assert(!text || !strcmp(text, fixture->info->expectedContent));
     g_free(text);
 
     g_assert(!gtk_clipboard_wait_is_uris_available(clipboard));
@@ -124,6 +124,92 @@ static void test_copy_and_paste(CopyAndPasteFixture* fixture, gconstpointer data
     g_main_loop_run(fixture->loop);
 }
 
+static CopyAndPasteFixture* currentFixture;
+static JSValueRef runPasteTestCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    // Simulate a paste keyboard sequence.
+    GdkEvent event;
+    memset(&event, 0, sizeof(event));
+    event.key.keyval = gdk_unicode_to_keyval('v');
+    event.key.state = GDK_CONTROL_MASK;
+    event.key.window = gtk_widget_get_window(GTK_WIDGET(currentFixture->webView));
+    GdkKeymapKey* keys;
+    gint n_keys;
+    if (gdk_keymap_get_entries_for_keyval(gdk_keymap_get_default(), event.key.keyval, &keys, &n_keys)) {
+        event.key.hardware_keycode = keys[0].keycode;
+        g_free(keys);
+    }
+    event.key.type = GDK_KEY_PRESS;
+    gtk_main_do_event(&event);
+    event.key.type = GDK_KEY_RELEASE;
+    gtk_main_do_event(&event);
+
+    JSStringRef scriptString = JSStringCreateWithUTF8CString("document.body.innerHTML;");
+    JSValueRef value = JSEvaluateScript(context, scriptString, 0, 0, 0, 0);
+    JSStringRelease(scriptString);
+
+    g_assert(JSValueIsString(context, value));
+    JSStringRef actual = JSValueToStringCopy(context, value, exception);
+    g_assert(!exception || !*exception);
+    g_assert(currentFixture->info->expectedContent);
+    JSStringRef expected = JSStringCreateWithUTF8CString(currentFixture->info->expectedContent);
+    g_assert(JSStringIsEqual(expected, actual));
+
+    JSStringRelease(expected);
+    JSStringRelease(actual);
+    g_main_loop_quit(currentFixture->loop);
+    return JSValueMakeUndefined(context);
+}
+
+static void window_object_cleared_callback(WebKitWebView* web_view, WebKitWebFrame* web_frame, JSGlobalContextRef context, JSObjectRef window_object, gpointer data)
+{
+    JSStringRef name = JSStringCreateWithUTF8CString("runTest");
+    JSObjectRef testComplete = JSObjectMakeFunctionWithCallback(context, name, runPasteTestCallback);
+    JSObjectSetProperty(context, window_object, name, testComplete, kJSPropertyAttributeNone, 0);
+    JSStringRelease(name);
+}
+
+static void pasting_test_get_data_callback(GtkClipboard* clipboard, GtkSelectionData* selection_data, guint info, gpointer data)
+{
+    gtk_selection_data_set(selection_data, gdk_atom_intern("text/html", FALSE), 8, (const guchar*) data, strlen((char*)data) + 1);
+}
+
+static void pasting_test_clear_data_callback(GtkClipboard* clipboard, gpointer data)
+{
+    g_free(data);
+}
+
+static void test_pasting_markup(CopyAndPasteFixture* fixture, gconstpointer data)
+{
+    fixture->info = (TestInfo*)data;
+    currentFixture = fixture;
+
+    GtkTargetList* targetList = gtk_target_list_new(0, 0);
+    gtk_target_list_add(targetList, gdk_atom_intern("text/html", FALSE), 0, 0);
+
+    int numberOfTargets = 1;
+    GtkTargetEntry* targetTable = gtk_target_table_new_from_list(targetList, &numberOfTargets);
+    gtk_clipboard_set_with_data(gtk_clipboard_get(GDK_SELECTION_CLIPBOARD),
+                                targetTable, numberOfTargets,
+                                pasting_test_get_data_callback,
+                                pasting_test_clear_data_callback,
+                                g_strdup(fixture->info->expectedContent));
+    gtk_target_list_unref(targetList);
+    gtk_target_table_free(targetTable, numberOfTargets);
+
+    g_signal_connect(fixture->window, "map-event",
+                     G_CALLBACK(map_event_cb), fixture);
+    g_signal_connect(fixture->webView, "window-object-cleared",
+                     G_CALLBACK(window_object_cleared_callback), fixture);
+
+    gtk_widget_show(fixture->window);
+    gtk_widget_show(GTK_WIDGET(fixture->webView));
+    gtk_window_present(GTK_WINDOW(fixture->window));
+
+    g_main_loop_run(fixture->loop);
+}
+
+
 int main(int argc, char** argv)
 {
     g_thread_init(NULL);
@@ -151,6 +237,15 @@ int main(int argc, char** argv)
                test_copy_and_paste,
                copy_and_paste_fixture_teardown);
 
+    const char* paste_test_html = "<html>"
+        "<body onLoad=\"document.body.focus(); runTest();\" contentEditable=\"true\">"
+        "</body></html>";
+    g_test_add("/webkit/copyandpaste/paste-markup", CopyAndPasteFixture,
+               test_info_new(paste_test_html, "bobby"),
+               copy_and_paste_fixture_setup,
+               test_pasting_markup,
+               copy_and_paste_fixture_teardown);
+
     return g_test_run();
 }
 
diff --git a/WebKit/gtk/tests/testdomnode.c b/WebKit/gtk/tests/testdomnode.c
index 1050587..b253d1d 100644
--- a/WebKit/gtk/tests/testdomnode.c
+++ b/WebKit/gtk/tests/testdomnode.c
@@ -27,6 +27,7 @@
 #if GLIB_CHECK_VERSION(2, 16, 0) && GTK_CHECK_VERSION(2, 14, 0)
 
 #define HTML_DOCUMENT_HIERARCHY_NAVIGATION "<html><head><title>This is the title</title></head><body><p>1</p><p>2</p><p>3</p></body></html>"
+#define HTML_DOCUMENT_NODE_INSERTION "<html><body></body></html>"
 
 typedef struct {
     GtkWidget* webView;
@@ -119,6 +120,53 @@ static void test_dom_node_hierarchy_navigation(DomNodeFixture* fixture, gconstpo
     g_assert_cmpint(i, ==, 3);
 }
 
+static void test_dom_node_insertion(DomNodeFixture* fixture, gconstpointer data)
+{
+    WebKitDOMDocument* document;
+    WebKitDOMHTMLElement* body;
+    WebKitDOMElement* p, *div;
+    WebKitDOMNodeList* list;
+    WebKitDOMNode* node;
+
+    document = webkit_web_view_get_dom_document(WEBKIT_WEB_VIEW(fixture->webView));
+    g_assert(document);
+    body = webkit_dom_document_get_body(document);
+    g_assert(body);
+    g_assert(WEBKIT_DOM_IS_HTML_ELEMENT(body));
+
+    /* Body shouldn't have any children at this point */
+    g_assert(webkit_dom_node_has_child_nodes(WEBKIT_DOM_NODE(body)) == FALSE);
+
+    /* Insert one P element */
+    p = webkit_dom_document_create_element(document, (char*)"P", NULL);
+    webkit_dom_node_append_child(WEBKIT_DOM_NODE(body), WEBKIT_DOM_NODE(p), NULL);
+
+    /* Now it should have one, the same that we inserted */
+    g_assert(webkit_dom_node_has_child_nodes(WEBKIT_DOM_NODE(body)));
+    list = webkit_dom_node_get_child_nodes(WEBKIT_DOM_NODE(body));
+    g_assert_cmpint(webkit_dom_node_list_get_length(list), ==, 1);
+    node = webkit_dom_node_list_item(list, 0);
+    g_assert(node);
+    g_assert(webkit_dom_node_is_same_node(WEBKIT_DOM_NODE(p), node));
+
+    /* Replace the P tag with a DIV tag */
+    div = webkit_dom_document_create_element(document, (char*)"DIV", NULL);
+    webkit_dom_node_replace_child(WEBKIT_DOM_NODE(body), WEBKIT_DOM_NODE(div), WEBKIT_DOM_NODE(p), NULL);
+    g_assert(webkit_dom_node_has_child_nodes(WEBKIT_DOM_NODE(body)));
+    list = webkit_dom_node_get_child_nodes(WEBKIT_DOM_NODE(body));
+    g_assert_cmpint(webkit_dom_node_list_get_length(list), ==, 1);
+    node = webkit_dom_node_list_item(list, 0);
+    g_assert(node);
+    g_assert(webkit_dom_node_is_same_node(WEBKIT_DOM_NODE(div), node));
+
+    /* Now remove the tag */
+    webkit_dom_node_remove_child(WEBKIT_DOM_NODE(body), node, NULL);
+    list = webkit_dom_node_get_child_nodes(WEBKIT_DOM_NODE(body));
+    g_assert_cmpint(webkit_dom_node_list_get_length(list), ==, 0);
+
+    /* TODO: insert_before, which does not seem to be working correctly */
+}
+
 int main(int argc, char** argv)
 {
     if (!g_thread_supported())
@@ -134,6 +182,12 @@ int main(int argc, char** argv)
                test_dom_node_hierarchy_navigation,
                dom_node_fixture_teardown);
 
+    g_test_add("/webkit/domnode/test_insertion",
+               DomNodeFixture, HTML_DOCUMENT_NODE_INSERTION,
+               dom_node_fixture_setup,
+               test_dom_node_insertion,
+               dom_node_fixture_teardown);
+
     return g_test_run();
 }
 
diff --git a/WebKit/gtk/tests/testdownload.c b/WebKit/gtk/tests/testdownload.c
index c7985d5..f6ae865 100644
--- a/WebKit/gtk/tests/testdownload.c
+++ b/WebKit/gtk/tests/testdownload.c
@@ -84,40 +84,63 @@ notify_status_cb(GObject* object, GParamSpec* pspec, gpointer data)
 }
 
 static gboolean
-download_requested_cb(WebKitWebView* web_view,
-                      WebKitDownload* download,
-                      gboolean* beenThere)
+set_filename(gchar* filename)
+{
+    gchar *uri = g_filename_to_uri(filename, NULL, NULL);
+
+    webkit_download_set_destination_uri(theDownload, uri);
+    g_free(uri);
+
+    webkit_download_start(theDownload);
+    return FALSE;
+}
+
+static void
+handle_download_requested_cb(WebKitDownload* download,
+                             gboolean* beenThere,
+                             gboolean asynch)
 {
     theDownload = download;
     *beenThere = TRUE;
+
     if (temporaryFilename) {
-        gchar *uri = g_filename_to_uri(temporaryFilename, NULL, NULL);
-        if (uri)
-            webkit_download_set_destination_uri(download, uri);
-        g_free(uri);
+        if (asynch) {
+            g_idle_add((GSourceFunc)set_filename, temporaryFilename);
+        } else {
+            gchar *uri = g_filename_to_uri(temporaryFilename, NULL, NULL);
+            if (uri)
+                webkit_download_set_destination_uri(download, uri);
+            g_free(uri);
+        }
     }
 
     g_signal_connect(download, "notify::status",
                      G_CALLBACK(notify_status_cb), NULL);
+}
 
+static gboolean
+download_requested_cb(WebKitWebView* web_view,
+                      WebKitDownload* download,
+                      gboolean* beenThere)
+{
+    handle_download_requested_cb(download, beenThere, FALSE);
     return TRUE;
 }
 
 static gboolean
-set_filename(gchar* filename)
+download_requested_asynch_cb(WebKitWebView* web_view,
+                             WebKitDownload* download,
+                             gboolean* beenThere)
 {
-    gchar *uri = g_filename_to_uri(filename, NULL, NULL);
-    webkit_download_set_destination_uri(theDownload, uri);
-    g_free(uri);
-    temporaryFilename = filename;
-    webkit_download_start(theDownload);
-    return FALSE;
+    handle_download_requested_cb(download, beenThere, TRUE);
+    return TRUE;
 }
 
 static void
 test_webkit_download_perform(gboolean asynch)
 {
     WebKitWebView* webView = WEBKIT_WEB_VIEW(webkit_web_view_new());
+    GCallback downloadRequestCallback = NULL;
 
     g_object_ref_sink(G_OBJECT(webView));
 
@@ -125,10 +148,14 @@ test_webkit_download_perform(gboolean asynch)
                      G_CALLBACK(navigation_policy_decision_requested_cb),
                      NULL);
 
+    if (asynch)
+        downloadRequestCallback = G_CALLBACK(download_requested_asynch_cb);
+    else
+        downloadRequestCallback = G_CALLBACK(download_requested_cb);
+
     gboolean beenThere = FALSE;
     g_signal_connect(webView, "download-requested",
-                     G_CALLBACK(download_requested_cb),
-                     &beenThere);
+                     downloadRequestCallback, &beenThere);
 
     /* Preparation; FIXME: we should move this code to a test
      * utilities file, because we have a very similar one in
@@ -144,12 +171,8 @@ test_webkit_download_perform(gboolean asynch)
     if (g_unlink(filename) == -1)
         g_critical("Failed to delete the temporary file: %s.", g_strerror(errno));
 
-    if (asynch)
-        g_idle_add((GSourceFunc)set_filename, filename);
-    else
-        temporaryFilename = filename;
-
     theDownload = NULL;
+    temporaryFilename = filename;
 
     loop = g_main_loop_new(NULL, TRUE);
     webkit_web_view_load_uri(webView, "http://gnome.org/");
@@ -161,6 +184,8 @@ test_webkit_download_perform(gboolean asynch)
 
     g_unlink(temporaryFilename);
     g_free(temporaryFilename);
+    temporaryFilename = NULL;
+
     g_main_loop_unref(loop);
     g_object_unref(webView);
 }
diff --git a/WebKit/gtk/webkit.pc.in b/WebKit/gtk/webkit.pc.in
index 895aa19..9bed0f3 100644
--- a/WebKit/gtk/webkit.pc.in
+++ b/WebKit/gtk/webkit.pc.in
@@ -6,6 +6,6 @@ includedir=@includedir@
 Name: WebKit
 Description: Web content engine for GTK+
 Version: @VERSION@
-Requires: glib-2.0 gtk+-2.0 libsoup-2.4
-Libs: -L${libdir} -lwebkit-1.0
-Cflags: -I${includedir}/webkit-1.0
+Requires: glib-2.0 gtk+-@GTK_API_VERSION@ libsoup-2.4
+Libs: -L${libdir} -lwebkitgtk-@WEBKITGTK_API_VERSION@
+Cflags: -I${includedir}/webkit-@WEBKITGTK_API_VERSION@
diff --git a/WebKit/gtk/webkit/webkitprivate.h b/WebKit/gtk/webkit/webkitprivate.h
index 556648d..fa74abc 100644
--- a/WebKit/gtk/webkit/webkitprivate.h
+++ b/WebKit/gtk/webkit/webkitprivate.h
@@ -158,7 +158,7 @@ extern "C" {
         guint previousClickButton;
         guint32 previousClickTime;
 
-        HashMap<GdkDragContext*, RefPtr<WebCore::DataObjectGtk> > draggingDataObjects;
+        HashMap<GdkDragContext*, RefPtr<WebCore::DataObjectGtk> >* draggingDataObjects;
     };
 
     #define WEBKIT_WEB_FRAME_GET_PRIVATE(obj)    (G_TYPE_INSTANCE_GET_PRIVATE((obj), WEBKIT_TYPE_WEB_FRAME, WebKitWebFramePrivate))
diff --git a/WebKit/gtk/webkit/webkitsoupauthdialog.c b/WebKit/gtk/webkit/webkitsoupauthdialog.c
index 15863b3..daecc73 100644
--- a/WebKit/gtk/webkit/webkitsoupauthdialog.c
+++ b/WebKit/gtk/webkit/webkitsoupauthdialog.c
@@ -25,6 +25,7 @@
 #include <gtk/gtk.h>
 #include <libsoup/soup.h>
 
+#include "GtkVersioning.h"
 #include "webkitmarshal.h"
 #include "webkitsoupauthdialog.h"
 
@@ -214,9 +215,9 @@ static void show_auth_dialog(WebKitAuthData* authData, const char* login, const
     /* Set the dialog up with HIG properties */
     gtk_dialog_set_has_separator(dialog, FALSE);
     gtk_container_set_border_width(GTK_CONTAINER(dialog), 5);
-    gtk_box_set_spacing(GTK_BOX(dialog->vbox), 2); /* 2 * 5 + 2 = 12 */
-    gtk_container_set_border_width(GTK_CONTAINER(dialog->action_area), 5);
-    gtk_box_set_spacing(GTK_BOX(dialog->action_area), 6);
+    gtk_box_set_spacing(GTK_BOX(gtk_dialog_get_content_area(dialog)), 2); /* 2 * 5 + 2 = 12 */
+    gtk_container_set_border_width(GTK_CONTAINER(gtk_dialog_get_action_area(dialog)), 5);
+    gtk_box_set_spacing(GTK_BOX(gtk_dialog_get_action_area(dialog)), 6);
 
     gtk_window_set_resizable(window, FALSE);
     gtk_window_set_title(window, "");
@@ -233,7 +234,7 @@ static void show_auth_dialog(WebKitAuthData* authData, const char* login, const
     /* Build contents */
     hbox = gtk_hbox_new(FALSE, 12);
     gtk_container_set_border_width(GTK_CONTAINER(hbox), 5);
-    gtk_box_pack_start(GTK_BOX(dialog->vbox), hbox, TRUE, TRUE, 0);
+    gtk_box_pack_start(GTK_BOX(gtk_dialog_get_content_area(dialog)), hbox, TRUE, TRUE, 0);
 
     icon = gtk_image_new_from_stock(GTK_STOCK_DIALOG_AUTHENTICATION,
                                     GTK_ICON_SIZE_DIALOG);
diff --git a/WebKit/gtk/webkit/webkitwebview.cpp b/WebKit/gtk/webkit/webkitwebview.cpp
index ce2bbc6..62997c5 100644
--- a/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/WebKit/gtk/webkit/webkitwebview.cpp
@@ -517,10 +517,16 @@ static gboolean webkit_web_view_expose_event(GtkWidget* widget, GdkEventExpose*
         cairo_destroy(cr);
         ctx.setGdkExposeEvent(event);
 
-        GOwnPtr<GdkRectangle> rects;
         int rectCount;
+#ifdef GTK_API_VERSION_2
+        GOwnPtr<GdkRectangle> rects;
         gdk_region_get_rectangles(event->region, &rects.outPtr(), &rectCount);
-
+#else
+        rectCount = cairo_region_num_rectangles(event->region);
+        GOwnPtr<GdkRectangle> rects(g_new(GdkRectangle, rectCount));
+        for (int i = 0; i < rectCount; i++)
+            cairo_region_get_rectangle(event->region, i, rects.get()+i);
+#endif
         // Avoid recursing into the render tree excessively
         bool coalesce = shouldCoalesce(event->area, rects.get(), rectCount);
 
@@ -1190,7 +1196,7 @@ static void webkit_web_view_dispose(GObject* object)
         priv->subResources = NULL;
     }
 
-    priv->draggingDataObjects.clear();
+    priv->draggingDataObjects->clear();
 
     G_OBJECT_CLASS(webkit_web_view_parent_class)->dispose(object);
 }
@@ -1207,6 +1213,7 @@ static void webkit_web_view_finalize(GObject* object)
     g_free(priv->iconURI);
 
     delete priv->previousClickPoint;
+    delete priv->draggingDataObjects;
 
     G_OBJECT_CLASS(webkit_web_view_parent_class)->finalize(object);
 }
@@ -1309,10 +1316,10 @@ static void webkit_web_view_drag_end(GtkWidget* widget, GdkDragContext* context)
 
     // This might happen if a drag is still in progress after a WebKitWebView
     // is disposed and before it is finalized.
-    if (!priv->draggingDataObjects.contains(context))
+    if (!priv->draggingDataObjects->contains(context))
         return;
 
-    priv->draggingDataObjects.remove(context);
+    priv->draggingDataObjects->remove(context);
 
     Frame* frame = core(webView)->focusController()->focusedOrMainFrame();
     if (!frame)
@@ -1347,10 +1354,10 @@ static void webkit_web_view_drag_data_get(GtkWidget* widget, GdkDragContext* con
 
     // This might happen if a drag is still in progress after a WebKitWebView
     // is diposed and before it is finalized.
-    if (!priv->draggingDataObjects.contains(context))
+    if (!priv->draggingDataObjects->contains(context))
         return;
 
-    pasteboardHelperInstance()->fillSelectionData(selectionData, info, priv->draggingDataObjects.get(context).get());
+    pasteboardHelperInstance()->fillSelectionData(selectionData, info, priv->draggingDataObjects->get(context).get());
 }
 
 #if GTK_CHECK_VERSION(2, 12, 0)
@@ -2928,6 +2935,8 @@ static void webkit_web_view_init(WebKitWebView* webView)
     priv->previousClickPoint = new IntPoint(0, 0);
     priv->previousClickButton = 0;
     priv->previousClickTime = 0;
+
+    priv->draggingDataObjects = new HashMap<GdkDragContext*, RefPtr<WebCore::DataObjectGtk> >();
 }
 
 GtkWidget* webkit_web_view_new(void)
diff --git a/WebKit/gtk/webkitmarshal.list b/WebKit/gtk/webkitmarshal.list
index d8caa4c..026a8af 100644
--- a/WebKit/gtk/webkitmarshal.list
+++ b/WebKit/gtk/webkitmarshal.list
@@ -19,3 +19,4 @@ VOID:OBJECT,POINTER,POINTER
 VOID:OBJECT,STRING
 VOID:STRING
 VOID:STRING,STRING
+
diff --git a/WebKit/mac/ChangeLog b/WebKit/mac/ChangeLog
index ea2393a..c59d8b4 100644
--- a/WebKit/mac/ChangeLog
+++ b/WebKit/mac/ChangeLog
@@ -1,3 +1,144 @@
+2010-06-23  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Eric Carlson.
+
+        [GStreamer] on Mac OS use a runloop observer to process the glib context iterations
+        https://bugs.webkit.org/show_bug.cgi?id=35747
+
+        If VIDEO and GSTREAMER are enabled, make the WebView start a
+        runloop observer that will trigger the glib main context
+        iterations. Those are needed by the GStreamer player only at the
+        moment but could later be used for other GLib-dependant components
+        if required.
+
+        * WebView/WebView.mm:
+        (-[WebView _commonInitializationWithFrameName:groupName:usesDocumentViews:]):
+        (-[WebView _close]):
+        (-[WebView _clearGlibLoopObserver]):
+        (glibContextIterationCallback):
+        (-[WebView _scheduleGlibContextIterations]):
+        * WebView/WebViewData.h:
+        * WebView/WebViewInternal.h:
+
+2010-07-03  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        The missing plug-in indicator should be clickable
+
+        https://bugs.webkit.org/show_bug.cgi?id=41550
+        <rdar://problem/8132162>
+
+        From an original patch by Kevin Decker.
+
+        Reviewed by Darin Adler.
+
+        * WebCoreSupport/WebChromeClient.h:
+        Declare an override of missingPluginButtonClicked().
+
+        * WebCoreSupport/WebChromeClient.mm:
+        (WebChromeClient::missingPluginButtonClicked):
+        Call the UIDelegate's method.
+
+        * WebView/WebUIDelegatePrivate.h:
+        Declare didPressMissingPluginButton.
+
+2010-07-01  Timothy Hatcher  <timothy@apple.com>
+
+        Provide a WebView preference to disable DNS prefetching.
+
+        https://bugs.webkit.org/show_bug.cgi?id=28825
+        rdar://problem/7181249
+
+        Reviewed by Darin Adler.
+
+        * WebView/WebPreferenceKeysPrivate.h: Added WebKitDNSPrefetchingEnabledPreferenceKey.
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]): Set WebKitDNSPrefetchingEnabledPreferenceKey to YES.
+        (-[WebPreferences isDNSPrefetchingEnabled]): Added. Return WebKitDNSPrefetchingEnabledPreferenceKey's value.
+        (-[WebPreferences setDNSPrefetchingEnabled:]): Added. Set WebKitDNSPrefetchingEnabledPreferenceKey's value.
+        * WebView/WebPreferencesPrivate.h: Added isDNSPrefetchingEnabled and setDNSPrefetchingEnabled:.
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]): Call WebCore::Settings::setDNSPrefetchingEnabled.
+
+2010-07-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        <rdar://problem/8148656> <https://bugs.webkit.org/show_bug.cgi?id=41431>
+        REGRESSION (r49411): Various crashes due to JavaScript execution during plug-in destruction
+
+        Strengthen m_inDestroy "swipe under the carpet" fix.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.h: Added a long comment about m_inDestroy, and
+        changed it to static.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::NetscapePluginInstanceProxy): m_inDestroy is now
+        static, so we don't initialize it in constructor.
+        (WebKit::NetscapePluginInstanceProxy::destroy): Assert that we aren't already destroying
+        some plug-in.
+        (WebKit::NetscapePluginInstanceProxy::evaluate): This function accidentally lacked an
+        m_inDestroy check in r42789.
+
+2010-06-29  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Add ConvolveMatrixElement to MigrateHeaders.make
+        https://bugs.webkit.org/show_bug.cgi?id=5861
+
+        * MigrateHeaders.make:
+
+2010-06-23  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Kent Tamura.
+
+        add ENABLE_DIRECTORY_UPLOAD build support
+        https://bugs.webkit.org/show_bug.cgi?id=41100
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-06-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make it possible to test the new HTML5 TreeBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=41276
+
+        Adam was concerned that someone might make their port
+        depend on this setting (I guess we had some trouble with that
+        with the HTML5Parser setting), so I littered the code with warnings.
+
+        test-html5-parser now tests this code path.
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        (-[WebPreferences html5TreeBuilderEnabled]):
+        (-[WebPreferences setHTML5TreeBuilderEnabled:]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2010-06-25  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Shinichiro Hamaji.
+
+        Improve default value handling for page format properties.
+        https://bugs.webkit.org/show_bug.cgi?id=41150
+
+        * Misc/WebCoreStatistics.h:
+        * Misc/WebCoreStatistics.mm:
+        (-[WebFrame pageSizeAndMarginsInPixels:pageNumber:width:height:marginTop:marginRight:marginBottom:]):
+
+2010-06-26  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add an ENABLE_WEB_TIMING option for enabling Web Timing support.
+        https://bugs.webkit.org/show_bug.cgi?id=38924
+
+        * Configurations/FeatureDefines.xcconfig:
+
 2010-06-24  Jer Noble  <jer.noble@apple.com>
 
         Reviewed by Eric Carlson.
diff --git a/WebKit/mac/Configurations/FeatureDefines.xcconfig b/WebKit/mac/Configurations/FeatureDefines.xcconfig
index 08d9ef9..8d2ff72 100644
--- a/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -48,6 +48,7 @@ ENABLE_DATABASE = ENABLE_DATABASE;
 ENABLE_DATAGRID = ;
 ENABLE_DATALIST = ENABLE_DATALIST;
 ENABLE_DEVICE_ORIENTATION = ;
+ENABLE_DIRECTORY_UPLOAD = ;
 ENABLE_DOM_STORAGE = ENABLE_DOM_STORAGE;
 ENABLE_EVENTSOURCE = ENABLE_EVENTSOURCE;
 ENABLE_FILTERS = ENABLE_FILTERS;
@@ -76,10 +77,11 @@ ENABLE_SVG_FOREIGN_OBJECT = ENABLE_SVG_FOREIGN_OBJECT;
 ENABLE_SVG_USE = ENABLE_SVG_USE;
 ENABLE_VIDEO = ENABLE_VIDEO;
 ENABLE_WEB_SOCKETS = ENABLE_WEB_SOCKETS;
+ENABLE_WEB_TIMING = ;
 ENABLE_WML = ;
 ENABLE_WORKERS = ENABLE_WORKERS;
 ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB_SLICE) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_READER) $(ENABLE_FILE_WRITER) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB_SLICE) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_READER) $(ENABLE_FILE_WRITER) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebKit/mac/Configurations/Version.xcconfig b/WebKit/mac/Configurations/Version.xcconfig
index f775a54..2749545 100644
--- a/WebKit/mac/Configurations/Version.xcconfig
+++ b/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 2;
+MINOR_VERSION = 3;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebKit/mac/MigrateHeaders.make b/WebKit/mac/MigrateHeaders.make
index 96c0a71..83e2e08 100644
--- a/WebKit/mac/MigrateHeaders.make
+++ b/WebKit/mac/MigrateHeaders.make
@@ -268,6 +268,8 @@ all : \
     $(INTERNAL_HEADERS_DIR)/DOMSVGFEComponentTransferElementInternal.h \
     $(PRIVATE_HEADERS_DIR)/DOMSVGFECompositeElement.h \
     $(INTERNAL_HEADERS_DIR)/DOMSVGFECompositeElementInternal.h \
+    $(PRIVATE_HEADERS_DIR)/DOMSVGFEConvolveMatrixElement.h \
+    $(INTERNAL_HEADERS_DIR)/DOMSVGFEConvolveMatrixElementInternal.h \
     $(PRIVATE_HEADERS_DIR)/DOMSVGFEDiffuseLightingElement.h \
     $(INTERNAL_HEADERS_DIR)/DOMSVGFEDiffuseLightingElementInternal.h \
     $(PRIVATE_HEADERS_DIR)/DOMSVGFEDisplacementMapElement.h \
diff --git a/WebKit/mac/Misc/WebCoreStatistics.h b/WebKit/mac/Misc/WebCoreStatistics.h
index e357b72..33e3e0f 100644
--- a/WebKit/mac/Misc/WebCoreStatistics.h
+++ b/WebKit/mac/Misc/WebCoreStatistics.h
@@ -89,6 +89,5 @@
 - (int)numberOfPages:(float)pageWidthInPixels:(float)pageHeightInPixels;
 - (NSString *)pageProperty:(const char*)propertyName:(int)pageNumber;
 - (bool)isPageBoxVisible:(int)pageNumber;
-- (NSString *)pageAreaRectInPixels:(int)pageNumber;
-- (NSString *)preferredPageSizeInPixels:(int)pageNumber;
+- (NSString *)pageSizeAndMarginsInPixels:(int)pageNumber:(int)width:(int)height:(int)marginTop:(int)marginRight:(int)marginBottom:(int)marginLeft;
 @end
diff --git a/WebKit/mac/Misc/WebCoreStatistics.mm b/WebKit/mac/Misc/WebCoreStatistics.mm
index 9112d21..bbe07d5 100644
--- a/WebKit/mac/Misc/WebCoreStatistics.mm
+++ b/WebKit/mac/Misc/WebCoreStatistics.mm
@@ -285,13 +285,8 @@ using namespace WebCore;
     return PrintContext::isPageBoxVisible(_private->coreFrame, pageNumber);
 }
 
-- (NSString *)pageAreaRectInPixels:(int)pageNumber
+- (NSString *)pageSizeAndMarginsInPixels:(int)pageNumber:(int)width:(int)height:(int)marginTop:(int)marginRight:(int)marginBottom:(int)marginLeft
 {
-    return PrintContext::pageAreaRectInPixels(_private->coreFrame, pageNumber);
-}
-
-- (NSString *)preferredPageSizeInPixels:(int)pageNumber;
-{
-    return PrintContext::preferredPageSizeInPixels(_private->coreFrame, pageNumber);
+    return PrintContext::pageSizeAndMarginsInPixels(_private->coreFrame, pageNumber, width, height, marginTop, marginRight, marginBottom, marginLeft);
 }
 @end
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
index 5900b02..9ca5b5a 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.h
@@ -342,7 +342,19 @@ private:
     unsigned m_pluginFunctionCallDepth;
     bool m_shouldStopSoon;
     uint32_t m_currentRequestID;
-    bool m_inDestroy;
+
+    // All NPRuntime functions will return false when destroying a plug-in. This is necessary because there may be unhandled messages waiting,
+    // and spinning in processRequests() will unexpectedly execute them from inside destroy(). That's not a good time to execute arbitrary JavaScript,
+    // since both loading and rendering data structures may be in inconsistent state.
+    // This suppresses calls from all plug-ins, even those in different pages, since JS might affect the frame with plug-in that's being stopped.
+    //
+    // FIXME: Plug-ins can execute arbitrary JS from destroy() in same process case, and other browsers also support that.
+    // A better fix may be to make sure that unrelated messages are postponed until after destroy() returns.
+    // Another possible fix may be to send destroy message at a time when internal structures are consistent.
+    //
+    // FIXME: We lack similar message suppression in other cases - resize() is also triggered by layout, so executing arbitrary JS is also problematic.
+    static bool m_inDestroy;
+
     bool m_pluginIsWaitingForDraw;
     
     RefPtr<HostedNetscapePluginStream> m_manualStream;
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
index ca012ee..8354c06 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
@@ -206,6 +206,8 @@ bool NetscapePluginInstanceProxy::LocalObjectMap::forget(uint32_t objectID)
 
 static uint32_t pluginIDCounter;
 
+bool NetscapePluginInstanceProxy::m_inDestroy;
+
 #ifndef NDEBUG
 static WTF::RefCountedLeakCounter netscapePluginInstanceProxyCounter("NetscapePluginInstanceProxy");
 #endif
@@ -222,7 +224,6 @@ NetscapePluginInstanceProxy::NetscapePluginInstanceProxy(NetscapePluginHostProxy
     , m_pluginFunctionCallDepth(0)
     , m_shouldStopSoon(false)
     , m_currentRequestID(0)
-    , m_inDestroy(false)
     , m_pluginIsWaitingForDraw(false)
 {
     ASSERT(m_pluginView);
@@ -321,7 +322,8 @@ void NetscapePluginInstanceProxy::invalidate()
 void NetscapePluginInstanceProxy::destroy()
 {
     uint32_t requestID = nextRequestID();
-    
+
+    ASSERT(!m_inDestroy);
     m_inDestroy = true;
     
     FrameLoadMap::iterator end = m_pendingFrameLoads.end();
@@ -848,6 +850,9 @@ bool NetscapePluginInstanceProxy::evaluate(uint32_t objectID, const String& scri
     resultData = 0;
     resultLength = 0;
 
+    if (m_inDestroy)
+        return false;
+
     if (!m_localObjects.contains(objectID)) {
         LOG_ERROR("NetscapePluginInstanceProxy::evaluate: local object %u doesn't exist.", objectID);
         return false;
diff --git a/WebKit/mac/WebCoreSupport/WebChromeClient.h b/WebKit/mac/WebCoreSupport/WebChromeClient.h
index 7deea79..5587a8d 100644
--- a/WebKit/mac/WebCoreSupport/WebChromeClient.h
+++ b/WebKit/mac/WebCoreSupport/WebChromeClient.h
@@ -105,6 +105,7 @@ public:
     virtual void setStatusbarText(const WebCore::String&);
 
     virtual void scrollbarsModeDidChange() const { }
+    virtual void missingPluginButtonClicked(WebCore::Element*) const;
     virtual void mouseDidMoveOverElement(const WebCore::HitTestResult&, unsigned modifierFlags);
 
     virtual void setToolTip(const WebCore::String&, WebCore::TextDirection);
diff --git a/WebKit/mac/WebCoreSupport/WebChromeClient.mm b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
index 0a52a9f..e426f05 100644
--- a/WebKit/mac/WebCoreSupport/WebChromeClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebChromeClient.mm
@@ -516,6 +516,11 @@ void WebChromeClient::scrollRectIntoView(const IntRect& r, const ScrollView*) co
 
 // End host window methods.
 
+void WebChromeClient::missingPluginButtonClicked(Element* element) const
+{
+    CallUIDelegate(m_webView, @selector(webView:didPressMissingPluginButton:), kit(element));
+}
+
 void WebChromeClient::mouseDidMoveOverElement(const HitTestResult& result, unsigned modifierFlags)
 {
     WebElementDictionary *element = [[WebElementDictionary alloc] initWithHitTestResult:result];
diff --git a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
index c38b395..a28be49 100644
--- a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
+++ b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
@@ -94,7 +94,9 @@
 #define WebKitPluginAllowedRunTimePreferenceKey @"WebKitPluginAllowedRunTime"
 #define WebKitFrameFlatteningEnabledPreferenceKey @"WebKitFrameFlatteningEnabled"
 #define WebKitHTML5ParserEnabledPreferenceKey @"WebKitHTML5ParserEnabled"
+#define WebKitHTML5TreeBuilderEnabledPreferenceKey @"WebKitHTML5TreeBuilderEnabled" // Temporary, do not use.
 #define WebKitPaginateDuringLayoutEnabledPreferenceKey @"WebKitPaginateDuringLayoutEnabled"
+#define WebKitDNSPrefetchingEnabledPreferenceKey @"WebKitDNSPrefetchingEnabled"
 
 // These are private both because callers should be using the cover methods and because the
 // cover methods themselves are private.
diff --git a/WebKit/mac/WebView/WebPreferences.mm b/WebKit/mac/WebView/WebPreferences.mm
index 0a192f9..a376458 100644
--- a/WebKit/mac/WebView/WebPreferences.mm
+++ b/WebKit/mac/WebView/WebPreferences.mm
@@ -360,7 +360,9 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:NO],   WebKitUsesProxiedOpenPanelPreferenceKey,
         [NSNumber numberWithUnsignedInt:4], WebKitPluginAllowedRunTimePreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitFrameFlatteningEnabledPreferenceKey,
-        [NSNumber numberWithBool:YES],   WebKitHTML5ParserEnabledPreferenceKey,
+        [NSNumber numberWithBool:YES],  WebKitHTML5ParserEnabledPreferenceKey,
+        [NSNumber numberWithBool:NO],   WebKitHTML5TreeBuilderEnabledPreferenceKey,
+        [NSNumber numberWithBool:YES],  WebKitDNSPrefetchingEnabledPreferenceKey,
         nil];
 
     // This value shouldn't ever change, which is assumed in the initialization of WebKitPDFDisplayModePreferenceKey above
@@ -755,6 +757,16 @@ static WebCacheModel cacheModelForMainBundle(void)
 
 @implementation WebPreferences (WebPrivate)
 
+- (BOOL)isDNSPrefetchingEnabled
+{
+    return [self _boolValueForKey:WebKitDNSPrefetchingEnabledPreferenceKey];
+}
+
+- (void)setDNSPrefetchingEnabled:(BOOL)flag
+{
+    [self _setBoolValue:flag forKey:WebKitDNSPrefetchingEnabledPreferenceKey];
+}
+
 - (BOOL)developerExtrasEnabled
 {
     NSUserDefaults *defaults = [NSUserDefaults standardUserDefaults];
@@ -1249,6 +1261,16 @@ static NSString *classIBCreatorID = nil;
     [self _setBoolValue:flag forKey:WebKitHTML5ParserEnabledPreferenceKey];
 }
 
+- (BOOL)html5TreeBuilderEnabled
+{
+    return [self _boolValueForKey:WebKitHTML5TreeBuilderEnabledPreferenceKey];
+}
+
+- (void)setHTML5TreeBuilderEnabled:(BOOL)flag
+{
+    [self _setBoolValue:flag forKey:WebKitHTML5TreeBuilderEnabledPreferenceKey];
+}
+
 - (BOOL)paginateDuringLayoutEnabled
 {
     return [self _boolValueForKey:WebKitPaginateDuringLayoutEnabledPreferenceKey];
diff --git a/WebKit/mac/WebView/WebPreferencesPrivate.h b/WebKit/mac/WebView/WebPreferencesPrivate.h
index c9a89ee..e94943f 100644
--- a/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -55,6 +55,9 @@ extern NSString *WebPreferencesRemovedNotification;
 
 // Preferences that might be public in a future release
 
+- (BOOL)isDNSPrefetchingEnabled;
+- (void)setDNSPrefetchingEnabled:(BOOL)flag;
+
 - (BOOL)developerExtrasEnabled;
 - (void)setDeveloperExtrasEnabled:(BOOL)flag;
 
@@ -178,6 +181,10 @@ extern NSString *WebPreferencesRemovedNotification;
 - (BOOL)html5ParserEnabled;
 - (void)setHTML5ParserEnabled:(BOOL)flag;
 
+// Will be deleted soon, do not use.
+- (BOOL)html5TreeBuilderEnabled;
+- (void)setHTML5TreeBuilderEnabled:(BOOL)flag;
+
 - (BOOL)paginateDuringLayoutEnabled;
 - (void)setPaginateDuringLayoutEnabled:(BOOL)flag;
 
diff --git a/WebKit/mac/WebView/WebUIDelegatePrivate.h b/WebKit/mac/WebView/WebUIDelegatePrivate.h
index 327a745..eccb10f 100644
--- a/WebKit/mac/WebView/WebUIDelegatePrivate.h
+++ b/WebKit/mac/WebView/WebUIDelegatePrivate.h
@@ -115,6 +115,7 @@ enum {
 - (void)webView:(WebView *)sender contextMenuItemSelected:(NSMenuItem *)item forElement:(NSDictionary *)element;
 - (void)webView:(WebView *)sender saveFrameView:(WebFrameView *)frameView showingPanel:(BOOL)showingPanel;
 - (BOOL)webView:(WebView *)sender shouldHaltPlugin:(DOMNode *)pluginNode isWindowed:(BOOL)isWindowed pluginName:(NSString *)pluginName;
+- (BOOL)webView:(WebView *)sender didPressMissingPluginButton:(DOMElement *)element;
 /*!
     @method webView:frame:exceededDatabaseQuotaForSecurityOrigin:database:
     @param sender The WebView sending the delegate method.
diff --git a/WebKit/mac/WebView/WebView.mm b/WebKit/mac/WebView/WebView.mm
index 631dd63..ada00b5 100644
--- a/WebKit/mac/WebView/WebView.mm
+++ b/WebKit/mac/WebView/WebView.mm
@@ -178,6 +178,10 @@
 #import <WebCore/GeolocationError.h>
 #endif
 
+#if ENABLE(VIDEO) && USE(GSTREAMER)
+#import <glib.h>
+#endif
+
 @interface NSSpellChecker (WebNSSpellCheckerDetails)
 - (void)_preflightChosenSpellServer;
 @end
@@ -369,6 +373,9 @@ static const char webViewIsOpen[] = "At least one WebView is still open.";
 #if USE(ACCELERATED_COMPOSITING)
 - (void)_clearLayerSyncLoopObserver;
 #endif
+#if ENABLE(VIDEO) && USE(GSTREAMER)
+- (void)_clearGlibLoopObserver;
+#endif
 @end
 
 static void patchMailRemoveAttributesMethod();
@@ -722,6 +729,11 @@ static bool shouldEnableLoadDeferring()
 
     if (!WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITHOUT_CONTENT_SNIFFING_FOR_FILE_URLS))
         ResourceHandle::forceContentSniffing();
+
+#if ENABLE(VIDEO) && USE(GSTREAMER)
+    [self _scheduleGlibContextIterations];
+#endif
+
 }
 
 - (id)_initWithFrame:(NSRect)f frameName:(NSString *)frameName groupName:(NSString *)groupName usesDocumentViews:(BOOL)usesDocumentViews
@@ -1119,6 +1131,10 @@ static bool fastDocumentTeardownEnabled()
     [self _clearLayerSyncLoopObserver];
 #endif
     
+#if ENABLE(VIDEO) && USE(GSTREAMER)
+    [self _clearGlibLoopObserver];
+#endif
+
     [[NSDistributedNotificationCenter defaultCenter] removeObserver:self];
     [[NSNotificationCenter defaultCenter] removeObserver:self];
 
@@ -1403,6 +1419,7 @@ static bool fastDocumentTeardownEnabled()
     settings->setJavaScriptCanAccessClipboard([preferences javaScriptCanAccessClipboard]);
     settings->setXSSAuditorEnabled([preferences isXSSAuditorEnabled]);
     settings->setEnforceCSSMIMETypeInStrictMode(!WKAppVersionCheckLessThan(@"com.apple.iWeb", -1, 2.1));
+    settings->setDNSPrefetchingEnabled([preferences isDNSPrefetchingEnabled]);
     
     // FIXME: Enabling accelerated compositing when WebGL is enabled causes tests to fail on Leopard which expect HW compositing to be disabled.
     // Until we fix that, I will comment out the test (CFM)
@@ -1414,6 +1431,7 @@ static bool fastDocumentTeardownEnabled()
     settings->setLoadDeferringEnabled(shouldEnableLoadDeferring());
     settings->setFrameFlatteningEnabled([preferences isFrameFlatteningEnabled]);
     settings->setHTML5ParserEnabled([preferences html5ParserEnabled]);
+    settings->setHTML5TreeBuilderEnabled_DO_NOT_USE([preferences html5TreeBuilderEnabled]);
     settings->setPaginateDuringLayoutEnabled([preferences paginateDuringLayoutEnabled]);
 }
 
@@ -5456,6 +5474,18 @@ static WebFrameView *containingFrameView(NSView *view)
     _private->layerSyncRunLoopObserver = 0;
 }
 #endif
+
+#if ENABLE(VIDEO) && USE(GSTREAMER)
+- (void)_clearGlibLoopObserver
+{
+    if (!_private->glibRunLoopObserver)
+        return;
+
+    CFRunLoopObserverInvalidate(_private->glibRunLoopObserver);
+    CFRelease(_private->glibRunLoopObserver);
+    _private->glibRunLoopObserver = 0;
+}
+#endif
 @end
 
 @implementation WebView (WebViewInternal)
@@ -5763,6 +5793,33 @@ static void layerSyncRunLoopObserverCallBack(CFRunLoopObserverRef, CFRunLoopActi
 
 #endif
 
+#if ENABLE(VIDEO) && USE(GSTREAMER)
+
+static void glibContextIterationCallback(CFRunLoopObserverRef, CFRunLoopActivity, void*)
+{
+    g_main_context_iteration(0, FALSE);
+}
+
+- (void)_scheduleGlibContextIterations
+{
+    if (_private->glibRunLoopObserver)
+        return;
+
+    NSRunLoop* myRunLoop = [NSRunLoop currentRunLoop];
+
+    // Create a run loop observer and attach it to the run loop.
+    CFRunLoopObserverContext context = {0, self, 0, 0, 0};
+    _private->glibRunLoopObserver = CFRunLoopObserverCreate(kCFAllocatorDefault, kCFRunLoopBeforeWaiting, YES, 0, &glibContextIterationCallback, &context);
+
+    if (_private->glibRunLoopObserver) {
+        CFRunLoopRef cfLoop = [myRunLoop getCFRunLoop];
+        CFRunLoopAddObserver(cfLoop, _private->glibRunLoopObserver, kCFRunLoopDefaultMode);
+    }
+
+}
+#endif
+
+
 @end
 
 @implementation WebView (WebViewGeolocation)
diff --git a/WebKit/mac/WebView/WebViewData.h b/WebKit/mac/WebView/WebViewData.h
index 2b51f3c..06fee4f 100644
--- a/WebKit/mac/WebView/WebViewData.h
+++ b/WebKit/mac/WebView/WebViewData.h
@@ -169,6 +169,9 @@ extern int pluginDatabaseClientCount;
     WebVideoFullscreenController *fullscreenController;
 #endif
 
+#if ENABLE(VIDEO) && USE(GSTREAMER)
+    CFRunLoopObserverRef glibRunLoopObserver;
+#endif
     id<WebGeolocationProvider> _geolocationProvider;
 }
 @end
diff --git a/WebKit/mac/WebView/WebViewInternal.h b/WebKit/mac/WebView/WebViewInternal.h
index 4643573..bf9b732 100644
--- a/WebKit/mac/WebView/WebViewInternal.h
+++ b/WebKit/mac/WebView/WebViewInternal.h
@@ -86,6 +86,10 @@ namespace WebCore {
 - (void)_scheduleCompositingLayerSync;
 #endif
 
+#if ENABLE(VIDEO) && USE(GSTREAMER)
+- (void)_scheduleGlibContextIterations;
+#endif
+
 @end
 
 #endif
diff --git a/WebKit/qt/Api/headers.pri b/WebKit/qt/Api/headers.pri
index e9fe28d..29bb125 100644
--- a/WebKit/qt/Api/headers.pri
+++ b/WebKit/qt/Api/headers.pri
@@ -12,5 +12,4 @@ WEBKIT_API_HEADERS = $$PWD/qwebframe.h \
                      $$PWD/qwebpluginfactory.h \
                      $$PWD/qwebhistory.h \
                      $$PWD/qwebinspector.h \
-                     $$PWD/qwebkitversion.h \
-                     $$PWD/qwebscriptworld.h
+                     $$PWD/qwebkitversion.h
diff --git a/WebKit/qt/Api/qgraphicswebview.cpp b/WebKit/qt/Api/qgraphicswebview.cpp
index 8361970..6d6acc5 100644
--- a/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/WebKit/qt/Api/qgraphicswebview.cpp
@@ -151,6 +151,8 @@ void QGraphicsWebViewPrivate::_q_contentsSizeChanged(const QSize& size)
 void QGraphicsWebViewPrivate::_q_scaleChanged()
 {
 #if ENABLE(TILED_BACKING_STORE)
+    if (!page)
+        return;
     static_cast<PageClientQGraphicsWidget*>(page->d->client)->updateTiledBackingStoreScale();
 #endif
 }
diff --git a/WebKit/qt/Api/qwebframe.cpp b/WebKit/qt/Api/qwebframe.cpp
index c42cfa3..c4cb597 100644
--- a/WebKit/qt/Api/qwebframe.cpp
+++ b/WebKit/qt/Api/qwebframe.cpp
@@ -1378,22 +1378,6 @@ QVariant QWebFrame::evaluateJavaScript(const QString& scriptSource)
     return rc;
 }
 
-QVariant QWebFrame::evaluateScriptInIsolatedWorld(QWebScriptWorld* scriptWorld, const QString& scriptSource)
-{
-    ScriptController *proxy = d->frame->script();
-    QVariant rc;
-
-    if (proxy) {
-        JSC::JSValue v = proxy->executeScriptInWorld(scriptWorld->world(), scriptSource, true).jsValue();
-        if (!d->frame) // In case the script removed our frame from the page.
-          return QString();
-        int distance = 0;
-        rc = JSC::Bindings::convertValueToQVariant(proxy->globalObject(mainThreadNormalWorld())->globalExec(), v, QMetaType::Void, &distance);
-    }
-    return rc;
-}
-
-
 /*!
     \since 4.5
 
diff --git a/WebKit/qt/Api/qwebframe.h b/WebKit/qt/Api/qwebframe.h
index 5f3dbd4..e78fb07 100644
--- a/WebKit/qt/Api/qwebframe.h
+++ b/WebKit/qt/Api/qwebframe.h
@@ -200,7 +200,6 @@ public:
 
 public Q_SLOTS:
     QVariant evaluateJavaScript(const QString& scriptSource);
-    QVariant evaluateScriptInIsolatedWorld(QWebScriptWorld* scriptWorld, const QString& scriptSource);
 #ifndef QT_NO_PRINTER
     void print(QPrinter *printer) const;
 #endif
diff --git a/WebKit/qt/Api/qwebscriptworld.cpp b/WebKit/qt/Api/qwebscriptworld.cpp
index 5d912cc..84b678d 100644
--- a/WebKit/qt/Api/qwebscriptworld.cpp
+++ b/WebKit/qt/Api/qwebscriptworld.cpp
@@ -35,6 +35,17 @@ QWebScriptWorld::QWebScriptWorld()
     d = new QWebScriptWorldPrivate(ScriptController::createWorld());
 }
 
+QWebScriptWorld::QWebScriptWorld(const QWebScriptWorld& other)
+    : d(other.d)
+{
+}
+
+QWebScriptWorld &QWebScriptWorld::operator=(const QWebScriptWorld& other)
+{
+    d = other.d;
+    return *this;
+}
+
 DOMWrapperWorld* QWebScriptWorld::world() const
 {
     return d->world.get();
diff --git a/WebKit/qt/Api/qwebscriptworld.h b/WebKit/qt/Api/qwebscriptworld.h
index 6e728ab..6a9d6e0 100644
--- a/WebKit/qt/Api/qwebscriptworld.h
+++ b/WebKit/qt/Api/qwebscriptworld.h
@@ -35,6 +35,8 @@ class QWebFrame;
 class QWEBKIT_EXPORT QWebScriptWorld {
 public:
     QWebScriptWorld();
+    QWebScriptWorld(const QWebScriptWorld&);
+    QWebScriptWorld &operator=(const QWebScriptWorld&);
     ~QWebScriptWorld();
 
     WebCore::DOMWrapperWorld* world() const;
diff --git a/WebKit/qt/Api/qwebsettings.cpp b/WebKit/qt/Api/qwebsettings.cpp
index b2766a7..ff7c101 100644
--- a/WebKit/qt/Api/qwebsettings.cpp
+++ b/WebKit/qt/Api/qwebsettings.cpp
@@ -90,6 +90,7 @@ static WebGraphicHash* graphics()
         hash->insert(QWebSettings::DefaultFrameIconGraphic, QPixmap(QLatin1String(":webkit/resources/urlIcon.png")));
         hash->insert(QWebSettings::TextAreaSizeGripCornerGraphic, QPixmap(QLatin1String(":webkit/resources/textAreaResizeCorner.png")));
         hash->insert(QWebSettings::DeleteButtonGraphic, QPixmap(QLatin1String(":webkit/resources/deleteButton.png")));
+        hash->insert(QWebSettings::InputSpeechButtonGraphic, QPixmap(QLatin1String(":webkit/resources/inputSpeech.png")));
     }
 
     return hash;
diff --git a/WebKit/qt/Api/qwebsettings.h b/WebKit/qt/Api/qwebsettings.h
index 38a2b3f..8967e7c 100644
--- a/WebKit/qt/Api/qwebsettings.h
+++ b/WebKit/qt/Api/qwebsettings.h
@@ -82,7 +82,8 @@ public:
         MissingPluginGraphic,
         DefaultFrameIconGraphic,
         TextAreaSizeGripCornerGraphic,
-        DeleteButtonGraphic
+        DeleteButtonGraphic,
+        InputSpeechButtonGraphic
     };
     enum FontSize {
         MinimumFontSize,
diff --git a/WebKit/qt/ChangeLog b/WebKit/qt/ChangeLog
index 2e565ae..2a649f6 100644
--- a/WebKit/qt/ChangeLog
+++ b/WebKit/qt/ChangeLog
@@ -1,3 +1,228 @@
+2010-07-03  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Return usable property names from DRT's computedStyleIncludingVisitedInfo()
+
+        Object property names such as 'background-color' need to be returned in camel
+        case, i.e. backgroundColor so that JS can reference them. Add support for this
+        to DumpRenderTreeSupportQt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40445
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (convertToPropertyName):
+        (DumpRenderTreeSupportQt::computedStyleIncludingVisitedInfo):
+
+2010-07-01  Robert Hogan <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] dump frames in ascending alphabetical order of title
+
+        https://bugs.webkit.org/show_bug.cgi?id=41261
+
+        Unskip:
+        http/tests/navigation/metaredirect-frames.html
+        http/tests/navigation/redirect302-frames.html
+        http/tests/navigation/redirect302-subframeload.html
+        http/tests/navigation/timerredirect-frames.html
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::getChildHistoryItems):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2010-07-01  Bea Lam  <bea.lam@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Doc improvements for QDeclarativeWebView
+
+        * declarative/qdeclarativewebview.cpp:
+
+2010-07-01  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Create QComboBoxes when clicked and destroy on hide.
+        https://bugs.webkit.org/show_bug.cgi?id=41451
+
+        Currently a QComboBox is created for each RenderMenuList and
+        it gets destroyed either when the RenderMenuList or the
+        QWebView (its Qt parent) is destroyed. This cause a crash
+        when the QWebView is destroyed before the render tree (which
+        is kept in cache).
+
+        This patch aim to destroy the QComboBox as soon as its popup
+        gets hidden, and likewise, create it only when the popup is
+        requested to be shown.
+        It also removes the unneeded reference to the QGraphicsProxyWidget,
+        destroying the QComboBox automatically destroys its bound
+        proxywidget.
+
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopupCombo::hidePopup):
+        (WebCore::QtFallbackWebPopup::QtFallbackWebPopup):
+        (WebCore::QtFallbackWebPopup::~QtFallbackWebPopup):
+        (WebCore::QtFallbackWebPopup::show):
+        (WebCore::QtFallbackWebPopup::hide):
+        (WebCore::QtFallbackWebPopup::destroyPopup):
+        (WebCore::QtFallbackWebPopup::populate):
+        * WebCoreSupport/QtFallbackWebPopup.h:
+
+2010-07-01  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Rendering the speech button in input elements.
+        https://bugs.webkit.org/show_bug.cgi?id=40984
+
+        * Api/qwebsettings.cpp:
+        (graphics):
+        * Api/qwebsettings.h:
+
+2010-06-30  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Make sure we catch closed QComboBox popups.
+        https://bugs.webkit.org/show_bug.cgi?id=39019
+
+        The way it works currently is using the QComboBox::show/hidePopup
+        virtual method to catch popup requests in the middle. There is
+        some cases however that the popup widget gets closed without
+        going through the hidePopup method.
+
+        This patch adds an event filter to the popup's view to know when
+        it gets closed and calls hidePopup to call our handling code.
+        This may get hidePopup called twice but this shouldn't have any
+        effect.
+
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopupCombo::QtFallbackWebPopupCombo):
+        (WebCore::QtFallbackWebPopupCombo::eventFilter):
+        * WebCoreSupport/QtFallbackWebPopup.h:
+
+2010-06-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed Symbian build fix.
+
+        [Qt] Update the def files to link DumpRenderTree.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-06-30  Samuel Nevala  <samuel.nevala@digia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Auto test wont compile from \3rdparty\webkit\WebKit\qt\tests
+        https://bugs.webkit.org/show_bug.cgi?id=38720
+        
+        Load qttest_p4.prf under QTDIR_build.
+
+        * tests/tests.pri:
+
+2010-06-29  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] support dumpResourceResponseMIMETypes
+        https://bugs.webkit.org/show_bug.cgi?id=41260
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::dumpResourceResponseMIMETypes):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::dispatchDidReceiveResponse):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2010-06-28  Laszlo Gombos  <laszlo.1.gombos@nokia.com>
+
+        Unreviewed Symbian build fix.
+
+        [Qt] Update the def file after r61879.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-06-28  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] QGraphicsWebView crash when calling setScale() before setUrl()
+        https://bugs.webkit.org/show_bug.cgi?id=40000
+
+        Check 'page' before dereference in _q_scaleChanged()
+        Autotest included.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::_q_scaleChanged):
+        * tests/qgraphicswebview/tst_qgraphicswebview.cpp:
+        (tst_QGraphicsWebView::crashOnSetScaleBeforeSetUrl):
+
+2010-06-26  Simon Hausmann  <hausmann@webkit.org>
+
+        [Qt] Prospective build fix for MSVC
+
+        In order for the forward declaration of QWebScriptWorldPrivate
+        to work with QExplicitlySharedDataPointer, then copy constructor
+        and assignment operators must not be compiler generated, to
+        avoid them ending up in places where the private class is not
+        declared.
+
+        * Api/qwebscriptworld.cpp:
+        (QWebScriptWorld::QWebScriptWorld):
+        (QWebScriptWorld::operator=):
+        * Api/qwebscriptworld.h:
+
+2010-06-26  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] DRT Support for setCustomPolicyDelegate
+
+        https://bugs.webkit.org/show_bug.cgi?id=39564
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::setCustomPolicyDelegate):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (drtDescriptionSuitableForTestResult):
+        (WebCore::navigationTypeToString):
+        (WebCore::FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction):
+        * WebCoreSupport/FrameLoaderClientQt.h:
+
+2010-06-25  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QtWebKit crashes if <select>'s render changes in its onchange event
+        https://bugs.webkit.org/show_bug.cgi?id=41164
+
+        QtWebKit crashes if <select>'s renderer changes in its onchange event.
+
+        * WebCoreSupport/QtFallbackWebPopup.cpp:
+        (WebCore::QtFallbackWebPopup::~QtFallbackWebPopup):
+
+2010-06-25  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Support evaluateScriptInIsolatedWorld()
+
+        https://bugs.webkit.org/show_bug.cgi?id=40079
+
+        Remove evaluateScriptInIsolatedWorld() from QtWebKit API.
+        Remove QWebScriptWorld from exported headers.
+        Confine support to DumpRenderTreeSupportQt so that the tests can pass.
+
+        * Api/headers.pri:
+        * Api/qwebframe.cpp:
+        * Api/qwebframe.h:
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::clearScriptWorlds):
+        (DumpRenderTreeSupportQt::evaluateScriptInIsolatedWorld):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
 2010-06-24  Simon Hausmann  <simon.hausmann@nokia.com>
 
         Unreviewed Symbian build fix.
diff --git a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index 0ae55d7..09dec71 100644
--- a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -49,6 +49,7 @@
 #include "PrintContext.h"
 #include "RenderListItem.h"
 #include "RenderTreeAsText.h"
+#include "ScriptController.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #if ENABLE(SVG)
@@ -65,11 +66,13 @@
 #include "qwebhistory_p.h"
 #include "qwebpage.h"
 #include "qwebpage_p.h"
+#include "qwebscriptworld.h"
 
 using namespace WebCore;
 
 CheckPermissionFunctionType* checkPermissionFunction = 0;
 RequestPermissionFunctionType* requestPermissionFunction = 0;
+QMap<int, QWebScriptWorld*> m_worldMap;
 
 DumpRenderTreeSupportQt::DumpRenderTreeSupportQt()
 {
@@ -392,6 +395,20 @@ QString DumpRenderTreeSupportQt::markerTextForListItem(const QWebElement& listIt
     return WebCore::markerTextForListItem(listItem.m_element);
 }
 
+static QString convertToPropertyName(const QString& name)
+{
+    QStringList parts = name.split('-');
+    QString camelCaseName;
+    for (int j = 0; j < parts.count(); ++j) {
+        QString part = parts.at(j);
+        if (j)
+            camelCaseName.append(part.replace(0, 1, part.left(1).toUpper()));
+        else
+            camelCaseName.append(part);
+    }
+    return camelCaseName;
+}
+
 QVariantMap DumpRenderTreeSupportQt::computedStyleIncludingVisitedInfo(const QWebElement& element)
 {
     QVariantMap res;
@@ -404,7 +421,7 @@ QVariantMap DumpRenderTreeSupportQt::computedStyleIncludingVisitedInfo(const QWe
     for (int i = 0; i < style->length(); i++) {
         QString name = style->item(i);
         QString value = (static_cast<WebCore::CSSStyleDeclaration*>(style.get()))->getPropertyValue(name);
-        res[name] = QVariant(value);
+        res[convertToPropertyName(name)] = QVariant(value);
     }
     return res;
 }
@@ -510,6 +527,11 @@ void DumpRenderTreeSupportQt::dumpResourceLoadCallbacksPath(const QString& path)
     FrameLoaderClientQt::dumpResourceLoadCallbacksPath = path;
 }
 
+void DumpRenderTreeSupportQt::dumpResourceResponseMIMETypes(bool b)
+{
+    FrameLoaderClientQt::dumpResourceResponseMIMETypes = b;
+}
+
 void DumpRenderTreeSupportQt::setWillSendRequestReturnsNullOnRedirect(bool b)
 {
     FrameLoaderClientQt::sendRequestReturnsNullOnRedirect = b;
@@ -525,6 +547,12 @@ void DumpRenderTreeSupportQt::setWillSendRequestClearHeaders(const QStringList&
     FrameLoaderClientQt::sendRequestClearHeaders = headers;
 }
 
+void DumpRenderTreeSupportQt::setCustomPolicyDelegate(bool enabled, bool permissive)
+{
+    FrameLoaderClientQt::policyDelegateEnabled = enabled;
+    FrameLoaderClientQt::policyDelegatePermissive = permissive;
+}
+
 void DumpRenderTreeSupportQt::dumpEditingCallbacks(bool b)
 {
     EditorClientQt::dumpEditingCallbacks = b;
@@ -596,17 +624,17 @@ QString DumpRenderTreeSupportQt::historyItemTarget(const QWebHistoryItem& histor
     return (QWebHistoryItemPrivate::core(&it)->target());
 }
 
-QList<QWebHistoryItem> DumpRenderTreeSupportQt::getChildHistoryItems(const QWebHistoryItem& historyItem)
+QMap<QString, QWebHistoryItem> DumpRenderTreeSupportQt::getChildHistoryItems(const QWebHistoryItem& historyItem)
 {
     QWebHistoryItem it = historyItem;
     HistoryItem* item = QWebHistoryItemPrivate::core(&it);
     const WebCore::HistoryItemVector& children = item->children();
 
     unsigned size = children.size();
-    QList<QWebHistoryItem> kids;
+    QMap<QString, QWebHistoryItem> kids;
     for (unsigned i = 0; i < size; ++i) {
         QWebHistoryItem kid(new QWebHistoryItemPrivate(children[i].get()));
-        kids.prepend(kid);
+        kids.insert(DumpRenderTreeSupportQt::historyItemTarget(kid), kid);
     }
     return kids;
 }
@@ -617,6 +645,30 @@ bool DumpRenderTreeSupportQt::shouldClose(QWebFrame* frame)
     return coreFrame->loader()->shouldClose();
 }
 
+void DumpRenderTreeSupportQt::clearScriptWorlds()
+{
+    m_worldMap.clear();
+}
+
+void DumpRenderTreeSupportQt::evaluateScriptInIsolatedWorld(QWebFrame* frame, int worldID, const QString& script)
+{
+    QWebScriptWorld* scriptWorld;
+    if (!worldID) {
+        scriptWorld = new QWebScriptWorld();
+    } else if (!m_worldMap.contains(worldID)) {
+        scriptWorld = new QWebScriptWorld();
+        m_worldMap.insert(worldID, scriptWorld);
+    } else
+        scriptWorld = m_worldMap.value(worldID);
+
+    WebCore::Frame* coreFrame = QWebFramePrivate::core(frame);
+
+    ScriptController* proxy = coreFrame->script();
+
+    if (proxy)
+        proxy->executeScriptInWorld(scriptWorld->world(), script, true);
+}
+
 // Provide a backward compatibility with previously exported private symbols as of QtWebKit 4.6 release
 
 void QWEBKIT_EXPORT qt_resumeActiveDOMObjects(QWebFrame* frame)
diff --git a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 0b94a03..304e65b 100644
--- a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -30,6 +30,7 @@ class QWebElement;
 class QWebFrame;
 class QWebPage;
 class QWebHistoryItem;
+class QWebScriptWorld;
 
 enum NotificationPermission {
     NotificationAllowed,
@@ -42,6 +43,7 @@ typedef void (RequestPermissionFunctionType) (QObject* receiver, const QString&)
 
 extern CheckPermissionFunctionType* checkPermissionFunction;
 extern RequestPermissionFunctionType* requestPermissionFunction;
+extern QMap<int, QWebScriptWorld*> m_worldMap;
 
 class QWEBKIT_EXPORT DumpRenderTreeSupportQt {
 
@@ -74,6 +76,8 @@ public:
     static void garbageCollectorCollectOnAlternateThread(bool waitUntilDone);
     static void setJavaScriptProfilingEnabled(QWebFrame*, bool enabled);
     static int javaScriptObjectsCount();
+    static void clearScriptWorlds();
+    static void evaluateScriptInIsolatedWorld(QWebFrame* frame, int worldID, const QString& script);
 
     static void setTimelineProfilingEnabled(QWebPage*, bool enabled);
     static void webInspectorExecuteScript(QWebPage* page, long callId, const QString& script);
@@ -106,6 +110,7 @@ public:
 
     static void dumpFrameLoader(bool b);
     static void dumpResourceLoadCallbacks(bool b);
+    static void dumpResourceResponseMIMETypes(bool b);
     static void dumpResourceLoadCallbacksPath(const QString& path);
     static void setWillSendRequestReturnsNullOnRedirect(bool b);
     static void setWillSendRequestReturnsNull(bool b);
@@ -115,6 +120,7 @@ public:
     static void dumpSetAcceptsEditing(bool b);
 
     static void dumpNotification(bool b);
+
     // These functions should eventually turn into public API
     // and the "receiver" concept would go away
     static void setNotificationsReceiver(QObject* receiver);
@@ -122,11 +128,13 @@ public:
     static void setCheckPermissionFunction(CheckPermissionFunctionType*);
     static void setRequestPermissionFunction(RequestPermissionFunctionType*);
 
-    static QList<QWebHistoryItem> getChildHistoryItems(const QWebHistoryItem& historyItem);
+    static QMap<QString, QWebHistoryItem> getChildHistoryItems(const QWebHistoryItem& historyItem);
     static bool isTargetItem(const QWebHistoryItem& historyItem);
     static QString historyItemTarget(const QWebHistoryItem& historyItem);
 
     static bool shouldClose(QWebFrame* frame);
+
+    static void setCustomPolicyDelegate(bool enabled, bool permissive);
 };
 
 #endif
diff --git a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 42b0c49..db731d8 100644
--- a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -38,7 +38,9 @@
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "DocumentLoader.h"
+#include "HitTestResult.h"
 #include "MIMETypeRegistry.h"
+#include "MouseEvent.h"
 #include "ResourceResponse.h"
 #include "Page.h"
 #include "PluginData.h"
@@ -127,6 +129,25 @@ static QString drtDescriptionSuitableForTestResult(const WebCore::ResourceRespon
     return QString::fromLatin1("<NSURLResponse %1, http status code %2>").arg(url).arg(httpStatusCode);
 }
 
+static QString drtDescriptionSuitableForTestResult(const RefPtr<WebCore::Node> node, int exception)
+{
+    QString result;
+    if (exception) {
+        result.append("ERROR");
+        return result;
+    }
+    if (!node) {
+        result.append("NULL");
+        return result;
+    }
+    result.append(node->nodeName());
+    RefPtr<WebCore::Node> parent = node->parentNode();
+    if (parent) {
+        result.append(" > ");
+        result.append(drtDescriptionSuitableForTestResult(parent, 0));
+    }
+    return result;
+}
 
 namespace WebCore
 {
@@ -135,8 +156,32 @@ bool FrameLoaderClientQt::dumpFrameLoaderCallbacks = false;
 bool FrameLoaderClientQt::dumpResourceLoadCallbacks = false;
 bool FrameLoaderClientQt::sendRequestReturnsNullOnRedirect = false;
 bool FrameLoaderClientQt::sendRequestReturnsNull = false;
+bool FrameLoaderClientQt::dumpResourceResponseMIMETypes = false;
+
 QStringList FrameLoaderClientQt::sendRequestClearHeaders;
 QString FrameLoaderClientQt::dumpResourceLoadCallbacksPath;
+bool FrameLoaderClientQt::policyDelegateEnabled = false;
+bool FrameLoaderClientQt::policyDelegatePermissive = false;
+
+// Taken from DumpRenderTree/chromium/WebViewHost.cpp
+static const char* navigationTypeToString(NavigationType type)
+{
+    switch (type) {
+    case NavigationTypeLinkClicked:
+        return "link clicked";
+    case NavigationTypeFormSubmitted:
+        return "form submitted";
+    case NavigationTypeBackForward:
+        return "back/forward";
+    case NavigationTypeReload:
+        return "reload";
+    case NavigationTypeFormResubmitted:
+        return "form resubmitted";
+    case NavigationTypeOther:
+        return "other";
+    }
+    return "illegal value";
+}
 
 FrameLoaderClientQt::FrameLoaderClientQt()
     : m_frame(0)
@@ -910,7 +955,12 @@ void FrameLoaderClientQt::dispatchDidReceiveResponse(WebCore::DocumentLoader*, u
         printf("%s - didReceiveResponse %s\n",
                qPrintable(dumpAssignedUrls[identifier]),
                qPrintable(drtDescriptionSuitableForTestResult(response)));
-    //qDebug() << "    got response from" << response.url().string();
+
+    if (dumpResourceResponseMIMETypes) {
+        printf("%s has MIME type %s\n",
+               qPrintable(QFileInfo(drtDescriptionSuitableForTestResult(response.url())).fileName()),
+               qPrintable(QString(response.mimeType())));
+    }
 }
 
 void FrameLoaderClientQt::dispatchDidReceiveContentLength(WebCore::DocumentLoader*, unsigned long, int)
@@ -1046,6 +1096,32 @@ void FrameLoaderClientQt::dispatchDecidePolicyForNavigationAction(FramePolicyFun
     Q_ASSERT(m_webFrame);
     QNetworkRequest r(request.toNetworkRequest(m_webFrame));
     QWebPage*page = m_webFrame->page();
+    PolicyAction result;
+
+    // Currently, this is only enabled by DRT
+    if (policyDelegateEnabled) {
+        RefPtr<Node> node;
+        for (const Event* event = action.event(); event; event = event->underlyingEvent()) {
+            if (event->isMouseEvent()) {
+                const MouseEvent* mouseEvent =  static_cast<const MouseEvent*>(event);
+                node = QWebFramePrivate::core(m_webFrame)->eventHandler()->hitTestResultAtPoint(
+                    mouseEvent->absoluteLocation(), false).innerNonSharedNode();
+                break;
+            }
+        }
+
+        printf("Policy delegate: attempt to load %s with navigation type '%s'%s\n",
+               qPrintable(drtDescriptionSuitableForTestResult(request.url())), navigationTypeToString(action.type()),
+               (node) ? qPrintable(" originating from " + drtDescriptionSuitableForTestResult(node, 0)) : "");
+
+        if (policyDelegatePermissive)
+            result = PolicyUse;
+        else
+            result = PolicyIgnore;
+
+        callPolicyFunction(function, result);
+        return;
+    }
 
     if (!page->d->acceptNavigationRequest(m_webFrame, r, QWebPage::NavigationType(action.type()))) {
         if (action.type() == NavigationTypeFormSubmitted || action.type() == NavigationTypeFormResubmitted)
diff --git a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
index d858589..b4a3c7e 100644
--- a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
+++ b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.h
@@ -214,10 +214,13 @@ public:
 
     static bool dumpFrameLoaderCallbacks;
     static bool dumpResourceLoadCallbacks;
+    static bool dumpResourceResponseMIMETypes;
     static QString dumpResourceLoadCallbacksPath;
     static bool sendRequestReturnsNullOnRedirect;
     static bool sendRequestReturnsNull;
     static QStringList sendRequestClearHeaders;
+    static bool policyDelegateEnabled;
+    static bool policyDelegatePermissive;
 
 private:
     Frame *m_frame;
diff --git a/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp b/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
index 26420e5..59ac87b 100644
--- a/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
+++ b/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.cpp
@@ -47,6 +47,10 @@ namespace WebCore {
 QtFallbackWebPopupCombo::QtFallbackWebPopupCombo(QtFallbackWebPopup& ownerPopup)
     : m_ownerPopup(ownerPopup)
 {
+    // Install an event filter on the view inside the combo box popup to make sure we know
+    // when the popup got closed. E.g. QComboBox::hidePopup() won't be called when the popup
+    // is closed by a mouse wheel event outside its window.
+    view()->installEventFilter(this);
 }
 
 void QtFallbackWebPopupCombo::showPopup()
@@ -71,14 +75,24 @@ void QtFallbackWebPopupCombo::hidePopup()
 
     QComboBox::hidePopup();
 
-    if (QGraphicsProxyWidget* proxy = graphicsProxyWidget())
-        proxy->setVisible(false);
-
     if (!m_ownerPopup.m_popupVisible)
         return;
 
     m_ownerPopup.m_popupVisible = false;
     m_ownerPopup.popupDidHide();
+    m_ownerPopup.destroyPopup();
+}
+
+bool QtFallbackWebPopupCombo::eventFilter(QObject* watched, QEvent* event)
+{
+    Q_ASSERT(watched == view());
+
+    if (event->type() == QEvent::Show && !m_ownerPopup.m_popupVisible)
+        showPopup();
+    else if (event->type() == QEvent::Hide && m_ownerPopup.m_popupVisible)
+        hidePopup();
+
+    return false;
 }
 
 // QtFallbackWebPopup
@@ -86,19 +100,13 @@ void QtFallbackWebPopupCombo::hidePopup()
 QtFallbackWebPopup::QtFallbackWebPopup()
     : QtAbstractWebPopup()
     , m_popupVisible(false)
-    , m_combo(new QtFallbackWebPopupCombo(*this))
-    , m_proxy(0)
+    , m_combo(0)
 {
-    connect(m_combo, SIGNAL(activated(int)),
-            SLOT(activeChanged(int)), Qt::QueuedConnection);
 }
 
 QtFallbackWebPopup::~QtFallbackWebPopup()
 {
-    // If we create a proxy, then the deletion of the proxy and the
-    // combo will be done by the proxy's parent (QGraphicsWebView)
-    if (!m_proxy)
-        delete m_combo;
+    destroyPopup();
 }
 
 void QtFallbackWebPopup::show()
@@ -109,17 +117,20 @@ void QtFallbackWebPopup::show()
 #if ENABLE(SYMBIAN_DIALOG_PROVIDERS)
     TRAP_IGNORE(showS60BrowserDialog());
 #else
+
+    destroyPopup();
+    m_combo = new QtFallbackWebPopupCombo(*this);
+    connect(m_combo, SIGNAL(activated(int)),
+            SLOT(activeChanged(int)), Qt::QueuedConnection);
+
     populate();
     m_combo->setCurrentIndex(currentIndex());
 
     QRect rect = geometry();
     if (QGraphicsWebView *webView = qobject_cast<QGraphicsWebView*>(pageClient()->pluginParent())) {
-        if (!m_proxy) {
-            m_proxy = new QGraphicsProxyWidget(webView);
-            m_proxy->setWidget(m_combo);
-        } else
-            m_proxy->setVisible(true);
-        m_proxy->setGeometry(rect);
+        QGraphicsProxyWidget* proxy = new QGraphicsProxyWidget(webView);
+        proxy->setWidget(m_combo);
+        proxy->setGeometry(rect);
     } else {
         m_combo->setParent(pageClient()->ownerWidget());
         m_combo->setGeometry(QRect(rect.left(), rect.top(),
@@ -188,13 +199,21 @@ void QtFallbackWebPopup::showS60BrowserDialog()
 
 void QtFallbackWebPopup::hide()
 {
-    m_combo->hidePopup();
+    // Destroying the QComboBox here cause problems if the popup is in the
+    // middle of its show animation. Instead we rely on the fact that the
+    // Qt::Popup window will hide itself on mouse events outside its window.
 }
 
-void QtFallbackWebPopup::populate()
+void QtFallbackWebPopup::destroyPopup()
 {
-    m_combo->clear();
+    if (m_combo) {
+        m_combo->deleteLater();
+        m_combo = 0;
+    }
+}
 
+void QtFallbackWebPopup::populate()
+{
     QStandardItemModel* model = qobject_cast<QStandardItemModel*>(m_combo->model());
     Q_ASSERT(model);
 
diff --git a/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h b/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h
index 6d2e1ff..e6c371f 100644
--- a/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h
+++ b/WebKit/qt/WebCoreSupport/QtFallbackWebPopup.h
@@ -42,6 +42,8 @@ public:
     virtual void show();
     virtual void hide();
 
+    void destroyPopup();
+
 private slots:
     void activeChanged(int);
 
@@ -49,7 +51,6 @@ private:
     friend class QtFallbackWebPopupCombo;
     bool m_popupVisible;
     QtFallbackWebPopupCombo* m_combo;
-    QGraphicsProxyWidget* m_proxy;
 
     void populate();
 #if ENABLE(SYMBIAN_DIALOG_PROVIDERS)
@@ -62,6 +63,7 @@ public:
     QtFallbackWebPopupCombo(QtFallbackWebPopup& ownerPopup);
     virtual void showPopup();
     virtual void hidePopup();
+    virtual bool eventFilter(QObject* watched, QEvent* event);
 
 private:
     QtFallbackWebPopup& m_ownerPopup;
diff --git a/WebKit/qt/declarative/qdeclarativewebview.cpp b/WebKit/qt/declarative/qdeclarativewebview.cpp
index a349bec..0342c9f 100644
--- a/WebKit/qt/declarative/qdeclarativewebview.cpp
+++ b/WebKit/qt/declarative/qdeclarativewebview.cpp
@@ -180,6 +180,8 @@ void GraphicsWebView::mouseMoveEvent(QGraphicsSceneMouseEvent* event)
 
     When this item has keyboard focus, all keyboard input will be sent directly to the
     web page within.
+
+    \sa {declarative/modelviews/webview}{WebView example}, {demos/declarative/webbrowser}{Web Browser demo}
 */
 
 /*!
diff --git a/WebKit/qt/symbian/eabi/QtWebKitu.def b/WebKit/qt/symbian/eabi/QtWebKitu.def
index 3fefb4d..548add1 100644
--- a/WebKit/qt/symbian/eabi/QtWebKitu.def
+++ b/WebKit/qt/symbian/eabi/QtWebKitu.def
@@ -760,7 +760,7 @@ EXPORTS
 	_ZN23DumpRenderTreeSupportQt27setTimelineProfilingEnabledEP8QWebPageb @759 NONAME
 	_ZN23DumpRenderTreeSupportQt28setDumpRenderTreeModeEnabledEb @760 NONAME
 	_ZN23DumpRenderTreeSupportQt29dumpResourceLoadCallbacksPathERK7QString @761 NONAME
-	_ZN23DumpRenderTreeSupportQt29evaluateScriptInIsolatedWorldEP9QWebFrameiRK7QString @762 NONAME ABSENT
+	_ZN23DumpRenderTreeSupportQt29evaluateScriptInIsolatedWorldEP9QWebFrameiRK7QString @762 NONAME
 	_ZN23DumpRenderTreeSupportQt29setJavaScriptProfilingEnabledEP9QWebFrameb @763 NONAME
 	_ZN23DumpRenderTreeSupportQt29setWillSendRequestReturnsNullEb @764 NONAME
 	_ZN23DumpRenderTreeSupportQt30setWillSendRequestClearHeadersERK11QStringList @765 NONAME
@@ -782,3 +782,20 @@ EXPORTS
 	_ZN23DumpRenderTreeSupportQt20getChildHistoryItemsERK15QWebHistoryItem @ 781 NONAME
 	_ZN23DumpRenderTreeSupportQt23setMockGeolocationErrorEiRK7QString @ 782 NONAME
 	_ZN23DumpRenderTreeSupportQt26setMockGeolocationPositionEddd @ 783 NONAME
+	_ZN23DumpRenderTreeSupportQt17clearScriptWorldsEv @ 784 NONAME
+	_ZN23DumpRenderTreeSupportQt23setCustomPolicyDelegateEbb @ 785 NONAME
+	_ZN15QWebScriptWorldC1ERKS_ @ 786 NONAME
+	_ZN15QWebScriptWorldC1Ev @ 787 NONAME
+	_ZN15QWebScriptWorldC2ERKS_ @ 788 NONAME
+	_ZN15QWebScriptWorldC2Ev @ 789 NONAME
+	_ZN15QWebScriptWorldD1Ev @ 790 NONAME
+	_ZN15QWebScriptWorldD2Ev @ 791 NONAME
+	_ZN15QWebScriptWorldaSERKS_ @ 792 NONAME
+	_ZN23DumpRenderTreeSupportQt29dumpResourceResponseMIMETypesEb @ 793 NONAME
+	_ZN23DumpRenderTreeSupportQtC1Ev @ 794 NONAME
+	_ZN23DumpRenderTreeSupportQtC2Ev @ 795 NONAME
+	_ZN23DumpRenderTreeSupportQtD1Ev @ 796 NONAME
+	_ZN23DumpRenderTreeSupportQtD2Ev @ 797 NONAME
+	_ZN8QWebPage23allowGeolocationRequestEP9QWebFrame @ 798 NONAME
+	_ZN8QWebPage23viewportChangeRequestedERKNS_13ViewportHintsE @ 799 NONAME
+	_ZNK15QWebScriptWorld5worldEv @ 800 NONAME
diff --git a/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp b/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
index e06524d..a04ff17 100644
--- a/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
+++ b/WebKit/qt/tests/qgraphicswebview/tst_qgraphicswebview.cpp
@@ -34,6 +34,7 @@ private slots:
     void crashOnViewlessWebPages();
     void microFocusCoordinates();
     void focusInputTypes();
+    void crashOnSetScaleBeforeSetUrl();
 };
 
 void tst_QGraphicsWebView::qgraphicswebview()
@@ -132,6 +133,13 @@ void tst_QGraphicsWebView::crashOnViewlessWebPages()
     delete page;
 }
 
+void tst_QGraphicsWebView::crashOnSetScaleBeforeSetUrl()
+{
+    QGraphicsWebView* webView = new QGraphicsWebView;
+    webView->setScale(2.0);
+    delete webView;
+}
+
 void tst_QGraphicsWebView::microFocusCoordinates()
 {
     QWebPage* page = new QWebPage;
diff --git a/WebKit/qt/tests/tests.pri b/WebKit/qt/tests/tests.pri
index 525e662..a795ff8 100644
--- a/WebKit/qt/tests/tests.pri
+++ b/WebKit/qt/tests/tests.pri
@@ -3,7 +3,8 @@ CONFIG -= app_bundle
 
 VPATH += $$_PRO_FILE_PWD_
 # Add the tst_ prefix, In QTDIR_build it's done by qttest_p4.prf
-!CONFIG(QTDIR_build):TARGET = tst_$$TARGET
+CONFIG(QTDIR_build) { load(qttest_p4) }
+ELSE { TARGET = tst_$$TARGET }
 SOURCES += $${TARGET}.cpp
 INCLUDEPATH += \
     $$PWD \
diff --git a/WebKit/win/ChangeLog b/WebKit/win/ChangeLog
index 18f2d73..d943cc6 100644
--- a/WebKit/win/ChangeLog
+++ b/WebKit/win/ChangeLog
@@ -1,3 +1,59 @@
+2010-07-03  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        The missing plug-in indicator should be clickable
+
+        https://bugs.webkit.org/show_bug.cgi?id=41550
+        <rdar://problem/8132162>
+
+        From an original patch by Kevin Decker.
+
+        Reviewed by Darin Adler.
+
+        * Interfaces/IWebUIDelegatePrivate.idl:
+        Added a new delegate interface, and declare a function
+        didPressMissingPluginButton().
+
+        * Interfaces/WebKit.idl:
+        Touch this file to force interfaces to be rebuilt.
+
+        * WebCoreSupport/WebChromeClient.cpp:
+        (WebChromeClient::missingPluginButtonClicked):
+        Get the UI delegate, and query it for IWebUIDelegatePrivate3. Call its
+        didPressMissingPluginButton() function.
+
+        * WebCoreSupport/WebChromeClient.h:
+        Declare an override of missingPluginButtonClicked().
+
+2010-07-03  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        Fix issue where a contextmenu event was reporting the wrong target
+        if the context menu was shown due to pressing the context menu key
+        (or Shift+F10).
+
+        * WebView.cpp:
+        (WebView::handleContextMenuEvent):
+
+2010-07-01  Steve Falkenburg  <sfalken@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Provide a WebView preference to disable DNS prefetching on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=41504
+        <rdar://problem/8151939>
+
+        * Interfaces/IWebPreferencesPrivate.idl: Added isDNSPrefetchingEnabled, setDNSPrefetchingEnabled.
+        * Interfaces/WebKit.idl: Touched to force IDL build.
+        * WebPreferenceKeysPrivate.h: Added WebKitDNSPrefetchingEnabledPreferenceKey.
+        * WebPreferences.cpp:
+        (WebPreferences::initializeDefaultSettings): Default prefetch to true.
+        (WebPreferences::setDNSPrefetchingEnabled): Added.
+        (WebPreferences::isDNSPrefetchingEnabled): Added.
+        * WebPreferences.h: Added isDNSPrefetchingEnabled, setDNSPrefetchingEnabled.
+        * WebView.cpp:
+        (WebView::notifyPreferencesChanged): Propagate prefetch pref into settings.
+
 2010-06-21  Nate Chapin  <japhet@chromium.org>
 
         Unreviewed, Windows build fix.
diff --git a/WebKit/win/Interfaces/IWebPreferencesPrivate.idl b/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
index 2cb4037..119c3ff 100644
--- a/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
+++ b/WebKit/win/Interfaces/IWebPreferencesPrivate.idl
@@ -112,4 +112,7 @@ interface IWebPreferencesPrivate : IUnknown
 
     HRESULT javaScriptCanAccessClipboard([out, retval] BOOL *enabled);
     HRESULT setJavaScriptCanAccessClipboard([in] BOOL enabled);
+
+    HRESULT isDNSPrefetchingEnabled([out, retval] BOOL *enabled);
+    HRESULT setDNSPrefetchingEnabled([in] BOOL enabled);
 }
diff --git a/WebKit/win/Interfaces/IWebUIDelegatePrivate.idl b/WebKit/win/Interfaces/IWebUIDelegatePrivate.idl
index 215c427..1431db2 100755
--- a/WebKit/win/Interfaces/IWebUIDelegatePrivate.idl
+++ b/WebKit/win/Interfaces/IWebUIDelegatePrivate.idl
@@ -99,3 +99,14 @@ interface IWebUIDelegatePrivate2 : IWebUIDelegatePrivate
 
     HRESULT decidePolicyForGeolocationRequest([in] IWebView* sender, [in] IWebFrame* frame, [in] IWebSecurityOrigin* origin, [in] IWebGeolocationPolicyListener* listener);
 }
+
+[
+    object,
+    oleautomation,
+    uuid(e9834891-233b-48a0-984b-8f8a19abdd0f),
+    pointer_default(unique)
+]
+interface IWebUIDelegatePrivate3 : IWebUIDelegatePrivate2
+{
+    HRESULT didPressMissingPluginButton([in] IDOMElement*);
+}
diff --git a/WebKit/win/Interfaces/WebKit.idl b/WebKit/win/Interfaces/WebKit.idl
index 98f5da8..8938501 100644
--- a/WebKit/win/Interfaces/WebKit.idl
+++ b/WebKit/win/Interfaces/WebKit.idl
@@ -20,7 +20,7 @@
  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
 cpp_quote("/*")
@@ -300,4 +300,3 @@ library WebKit
         [default] interface IWebUserContentURLPattern;
     }
 }
-
diff --git a/WebKit/win/WebCoreSupport/WebChromeClient.cpp b/WebKit/win/WebCoreSupport/WebChromeClient.cpp
index 587637f..d45e10c 100644
--- a/WebKit/win/WebCoreSupport/WebChromeClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebChromeClient.cpp
@@ -28,6 +28,7 @@
 
 #include "COMPropertyBag.h"
 #include "COMVariantSetter.h"
+#include "DOMCoreClasses.h"
 #include "WebElementPropertyBag.h"
 #include "WebFrame.h"
 #include "WebGeolocationPolicyListener.h"
@@ -534,6 +535,20 @@ void WebChromeClient::mouseDidMoveOverElement(const HitTestResult& result, unsig
     uiDelegate->mouseDidMoveOverElement(m_webView, element.get(), modifierFlags);
 }
 
+void WebChromeClient::missingPluginButtonClicked(Element* element) const
+{
+    COMPtr<IWebUIDelegate> uiDelegate;
+    if (FAILED(m_webView->uiDelegate(&uiDelegate)))
+        return;
+
+    COMPtr<IWebUIDelegatePrivate3> uiDelegatePrivate3(Query, uiDelegate);
+    if (!uiDelegatePrivate3)
+        return;
+
+    COMPtr<IDOMElement> e(AdoptCOM, DOMElement::createInstance(element));
+    uiDelegatePrivate3->didPressMissingPluginButton(e.get());
+}
+
 void WebChromeClient::setToolTip(const String& toolTip, TextDirection)
 {
     m_webView->setToolTip(toolTip);
diff --git a/WebKit/win/WebCoreSupport/WebChromeClient.h b/WebKit/win/WebCoreSupport/WebChromeClient.h
index 6954fde..c8a9451 100644
--- a/WebKit/win/WebCoreSupport/WebChromeClient.h
+++ b/WebKit/win/WebCoreSupport/WebChromeClient.h
@@ -105,6 +105,7 @@ public:
 
     virtual void scrollbarsModeDidChange() const { }
     virtual void mouseDidMoveOverElement(const WebCore::HitTestResult&, unsigned modifierFlags);
+    virtual void missingPluginButtonClicked(WebCore::Element*) const;
 
     virtual void setToolTip(const WebCore::String&, WebCore::TextDirection);
 
diff --git a/WebKit/win/WebPreferenceKeysPrivate.h b/WebKit/win/WebPreferenceKeysPrivate.h
index da63754..40c86c0 100644
--- a/WebKit/win/WebPreferenceKeysPrivate.h
+++ b/WebKit/win/WebPreferenceKeysPrivate.h
@@ -143,3 +143,5 @@
 #define WebKitShowRepaintCounterPreferenceKey "WebKitShowRepaintCounter"
 
 #define WebKitCustomDragCursorsEnabledPreferenceKey "WebKitCustomDragCursorsEnabled"
+
+#define WebKitDNSPrefetchingEnabledPreferenceKey "WebKitDNSPrefetchingEnabled"
diff --git a/WebKit/win/WebPreferences.cpp b/WebKit/win/WebPreferences.cpp
index e49bd20..12b0a72 100644
--- a/WebKit/win/WebPreferences.cpp
+++ b/WebKit/win/WebPreferences.cpp
@@ -261,6 +261,8 @@ void WebPreferences::initializeDefaultSettings()
     
     CFDictionaryAddValue(defaults, CFSTR(WebKitShowDebugBordersPreferenceKey), kCFBooleanFalse);
 
+    CFDictionaryAddValue(defaults, CFSTR(WebKitDNSPrefetchingEnabledPreferenceKey), kCFBooleanTrue);
+
     defaultSettings = defaults;
 }
 
@@ -1471,6 +1473,18 @@ HRESULT WebPreferences::customDragCursorsEnabled(BOOL* enabled)
     return S_OK;
 }
 
+HRESULT WebPreferences::setDNSPrefetchingEnabled(BOOL enabled)
+{
+    setBoolValue(CFSTR(WebKitDNSPrefetchingEnabledPreferenceKey), enabled);
+    return S_OK;
+}
+
+HRESULT WebPreferences::isDNSPrefetchingEnabled(BOOL* enabled)
+{
+    *enabled = boolValueForKey(CFSTR(WebKitDNSPrefetchingEnabledPreferenceKey));
+    return S_OK;
+}
+
 void WebPreferences::willAddToWebView()
 {
     ++m_numWebViews;
diff --git a/WebKit/win/WebPreferences.h b/WebKit/win/WebPreferences.h
index 1ea69c7..fc57241 100644
--- a/WebKit/win/WebPreferences.h
+++ b/WebKit/win/WebPreferences.h
@@ -420,7 +420,10 @@ public:
     virtual HRESULT STDMETHODCALLTYPE setShowRepaintCounter(BOOL);
     virtual HRESULT STDMETHODCALLTYPE showRepaintCounter(BOOL*);
 
-   // WebPreferences
+    virtual HRESULT STDMETHODCALLTYPE setDNSPrefetchingEnabled(BOOL);
+    virtual HRESULT STDMETHODCALLTYPE isDNSPrefetchingEnabled(BOOL*);
+
+    // WebPreferences
 
     // This method accesses a different preference key than developerExtrasEnabled.
     // See <rdar://5343767> for the justification.
diff --git a/WebKit/win/WebView.cpp b/WebKit/win/WebView.cpp
index a1aa5c2..441f0f2 100644
--- a/WebKit/win/WebView.cpp
+++ b/WebKit/win/WebView.cpp
@@ -1188,60 +1188,19 @@ Page* WebView::page()
 
 bool WebView::handleContextMenuEvent(WPARAM wParam, LPARAM lParam)
 {
-    static const int contextMenuMargin = 1;
-
     // Translate the screen coordinates into window coordinates
     POINT coords = { GET_X_LPARAM(lParam), GET_Y_LPARAM(lParam) };
     if (coords.x == -1 || coords.y == -1) {
-        FrameView* view = m_page->mainFrame()->view();
-        if (!view)
-            return false;
+        // The contextMenuController() holds onto the last context menu that was popped up on the
+        // page until a new one is created. We need to clear this menu before propagating the event
+        // through the DOM so that we can detect if we create a new menu for this event, since we
+        // won't create a new menu if the DOM swallows the event and the defaultEventHandler does
+        // not run.
+        m_page->contextMenuController()->clearContextMenu();
 
-        int rightAligned = ::GetSystemMetrics(SM_MENUDROPALIGNMENT);
-        IntPoint location;
-
-        // The context menu event was generated from the keyboard, so show the context menu by the current selection.
-        Position start = m_page->mainFrame()->selection()->selection().start();
-        Position end = m_page->mainFrame()->selection()->selection().end();
-
-        if (!start.node() || !end.node())
-            location = IntPoint(rightAligned ? view->contentsWidth() - contextMenuMargin : contextMenuMargin, contextMenuMargin);
-        else {
-            RenderObject* renderer = start.node()->renderer();
-            if (!renderer)
-                return false;
-
-            // Calculate the rect of the first line of the selection (cribbed from -[WebCoreFrameBridge firstRectForDOMRange:],
-            // now Frame::firstRectForRange(), which perhaps this should call).
-            int extraWidthToEndOfLine = 0;
-
-            InlineBox* startInlineBox;
-            int startCaretOffset;
-            start.getInlineBoxAndOffset(DOWNSTREAM, startInlineBox, startCaretOffset);
-            IntRect startCaretRect = renderer->localCaretRect(startInlineBox, startCaretOffset, &extraWidthToEndOfLine);
-            if (startCaretRect != IntRect())
-                startCaretRect = renderer->localToAbsoluteQuad(FloatRect(startCaretRect)).enclosingBoundingBox();
-
-            InlineBox* endInlineBox;
-            int endCaretOffset;
-            end.getInlineBoxAndOffset(UPSTREAM, endInlineBox, endCaretOffset);
-            IntRect endCaretRect = renderer->localCaretRect(endInlineBox, endCaretOffset);
-            if (endCaretRect != IntRect())
-                endCaretRect = renderer->localToAbsoluteQuad(FloatRect(endCaretRect)).enclosingBoundingBox();
-
-            IntRect firstRect;
-            if (startCaretRect.y() == endCaretRect.y())
-                firstRect = IntRect(min(startCaretRect.x(), endCaretRect.x()), startCaretRect.y(), abs(endCaretRect.x() - startCaretRect.x()), max(startCaretRect.height(), endCaretRect.height()));
-            else
-                firstRect = IntRect(startCaretRect.x(), startCaretRect.y(), startCaretRect.width() + extraWidthToEndOfLine, startCaretRect.height());
-
-            location = IntPoint(rightAligned ? firstRect.right() : firstRect.x(), firstRect.bottom());
-        }
+        Frame* focusedFrame = m_page->focusController()->focusedOrMainFrame();
+        return focusedFrame->eventHandler()->sendContextMenuEventForKey();
 
-        location = view->contentsToWindow(location);
-        // FIXME: The IntSize(0, -1) is a hack to get the hit-testing to result in the selected element.
-        // Ideally we'd have the position of a context menu event be separate from its target node.
-        coords = location + IntSize(0, -1);
     } else {
         if (!::ScreenToClient(m_viewWindow, &coords))
             return false;
@@ -1249,11 +1208,6 @@ bool WebView::handleContextMenuEvent(WPARAM wParam, LPARAM lParam)
 
     lParam = MAKELPARAM(coords.x, coords.y);
 
-    // The contextMenuController() holds onto the last context menu that was popped up on the
-    // page until a new one is created. We need to clear this menu before propagating the event
-    // through the DOM so that we can detect if we create a new menu for this event, since we
-    // won't create a new menu if the DOM swallows the event and the defaultEventHandler does
-    // not run.
     m_page->contextMenuController()->clearContextMenu();
 
     IntPoint documentPoint(m_page->mainFrame()->view()->windowToContents(coords));
@@ -4792,6 +4746,11 @@ HRESULT WebView::notifyPreferencesChanged(IWebNotification* notification)
     settings->setWebGLEnabled(true);
 #endif  // ENABLE(3D_CANVAS)
 
+    hr = prefsPrivate->isDNSPrefetchingEnabled(&enabled);
+    if (FAILED(hr))
+        return hr;
+    settings->setDNSPrefetchingEnabled(enabled);
+
     if (!m_closeWindowTimer)
         m_mainFrame->invalidate(); // FIXME
 
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index ed55485..68cd1c4 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,63 @@
+2010-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8154047>
+        
+        Update WebKitSystemInterface, making some functions used by
+        WebKit2 available in 32-bit (for reals this time).
+
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+        * libWebKitSystemInterfaceTiger.a:
+
+2010-07-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        <rdar://problem/8154047>
+        
+        Update WebKitSystemInterface, making some functions used by
+        WebKit2 available in 32-bit.
+
+        * WebKitSystemInterface.h:
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+        * libWebKitSystemInterfaceTiger.a:
+
+2010-06-23  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Kent Tamura.
+
+        add ENABLE_DIRECTORY_UPLOAD build support
+        https://bugs.webkit.org/show_bug.cgi?id=41100
+
+        * win/tools/vsprops/FeatureDefines.vsprops:
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops:
+
+2010-06-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows (Cairo) build fix.
+        Add missing ENABLE_WEB_TIMING feature define.
+
+        * win/tools/vsprops/FeatureDefinesCairo.vsprops:
+
+2010-06-27  Steve Falkenburg  <sfalken@apple.com>
+
+        Windows build fix.
+        Disable ENABLE_WEB_TIMING on Windows.
+
+        * win/tools/vsprops/FeatureDefines.vsprops:
+
+2010-06-26  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a VS macro for enabling Web Timing support.
+        https://bugs.webkit.org/show_bug.cgi?id=38924
+
+        * win/tools/vsprops/FeatureDefines.vsprops:
+
 2010-06-21  Sam Weinig  <sam@webkit.org>
 
         Reviewed by Anders Carlsson.
diff --git a/WebKitLibraries/WebKitSystemInterface.h b/WebKitLibraries/WebKitSystemInterface.h
index a753b63..4f46719 100644
--- a/WebKitLibraries/WebKitSystemInterface.h
+++ b/WebKitLibraries/WebKitSystemInterface.h
@@ -256,7 +256,7 @@ typedef enum {
     
 NSControl *WKCreateMediaUIControl(int controlType);
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && defined(__x86_64__)
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 mach_port_t WKInitializeRenderServer(void);
     
 @class CALayer;
@@ -277,6 +277,7 @@ uint32_t WKCARemoteLayerClientGetClientId(WKCARemoteLayerClientRef);
 void WKCARemoteLayerClientSetLayer(WKCARemoteLayerClientRef, CALayer *);
 CALayer *WKCARemoteLayerClientGetLayer(WKCARemoteLayerClientRef);
 
+#if defined(__x86_64__)
 #import <mach/mig.h>
 
 CFRunLoopSourceRef WKCreateMIGServerSource(mig_subsystem_t subsystem, mach_port_t serverPort);
@@ -284,8 +285,8 @@ CFRunLoopSourceRef WKCreateMIGServerSource(mig_subsystem_t subsystem, mach_port_
 NSUInteger WKGetInputPanelWindowStyle(void);
  
 UInt8 WKGetNSEventKeyChar(NSEvent *);
-    
-#endif
+#endif // defined(__x86_64__)
+#endif // !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
 
 @class CAPropertyAnimation;
 void WKSetCAAnimationValueFunction(CAPropertyAnimation*, NSString* function);
diff --git a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
index 7146bbe..3b4061c 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
index cc684cc..5d3106c 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceTiger.a b/WebKitLibraries/libWebKitSystemInterfaceTiger.a
index 53ba34b..a3743e4 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceTiger.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceTiger.a
diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
index e7a98e8..71bdc14 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefines.vsprops
@@ -9,7 +9,7 @@
 	>
   <Tool
 		Name="VCCLCompilerTool"
-		PreprocessorDefinitions="$(ENABLE_3D_CANVAS);$(ENABLE_3D_RENDERING);$(ENABLE_BLOB_SLICE);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CLIENT_BASED_GEOLOCATION);$(ENABLE_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DOM_STORAGE);$(ENABLE_EVENTSOURCE);$(ENABLE_FILTERS);$(ENABLE_FILE_READER);$(ENABLE_FILE_WRITER);$(ENABLE_GEOLOCATION);$(ENABLE_ICONDATABASE);$(ENABLE_IMAGE_RESIZER);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_SPEECH);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_MATHML);$(ENABLE_NOTIFICATIONS);$(ENABLE_OFFLINE_WEB_APPLICATIONS);$(ENABLE_RUBY);$(ENABLE_SANDBOX);$(ENABLE_SHARED_WORKERS);$(ENABLE_SVG);$(ENABLE_SVG_ANIMATION);$(ENABLE_SVG_AS_IMAGE);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_SVG_FOREIGN_OBJECT);$(ENABLE_SVG_USE);$(ENABLE_VIDEO);$(ENABLE_WEB_SOCKETS);$(ENABLE_WML);$(ENABLE_WORKERS);$(ENABLE_XHTMLMP);$(ENABLE_XPATH);$(ENABLE_XSLT)"
+		PreprocessorDefinitions="$(ENABLE_3D_CANVAS);$(ENABLE_3D_RENDERING);$(ENABLE_BLOB_SLICE);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CLIENT_BASED_GEOLOCATION);$(ENABLE_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DIRECTORY_UPLOAD);$(ENABLE_DOM_STORAGE);$(ENABLE_EVENTSOURCE);$(ENABLE_FILTERS);$(ENABLE_FILE_READER);$(ENABLE_FILE_WRITER);$(ENABLE_GEOLOCATION);$(ENABLE_ICONDATABASE);$(ENABLE_IMAGE_RESIZER);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_SPEECH);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_MATHML);$(ENABLE_NOTIFICATIONS);$(ENABLE_OFFLINE_WEB_APPLICATIONS);$(ENABLE_RUBY);$(ENABLE_SANDBOX);$(ENABLE_SHARED_WORKERS);$(ENABLE_SVG);$(ENABLE_SVG_ANIMATION);$(ENABLE_SVG_AS_IMAGE);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_SVG_FOREIGN_OBJECT);$(ENABLE_SVG_USE);$(ENABLE_VIDEO);$(ENABLE_WEB_SOCKETS);$(ENABLE_WEB_TIMING);$(ENABLE_WML);$(ENABLE_WORKERS);$(ENABLE_XHTMLMP);$(ENABLE_XPATH);$(ENABLE_XSLT)"
 	/>
   <UserMacro
 		Name="ENABLE_3D_CANVAS"
@@ -57,6 +57,11 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+                Name="ENABLE_DIRECTORY_UPLOAD"
+                Value=""
+                PerformEnvironmentSet="true"
+        />
+  <UserMacro
 		Name="ENABLE_DOM_STORAGE"
 		Value="ENABLE_DOM_STORAGE"
 		PerformEnvironmentSet="true"
@@ -187,6 +192,11 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_WEB_TIMING"
+		Value=""
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_WML"
 		Value=""
 		PerformEnvironmentSet="true"
diff --git a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
index 71b402a..1e5e107 100644
--- a/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/FeatureDefinesCairo.vsprops
@@ -9,7 +9,7 @@
 	>
   <Tool
 		Name="VCCLCompilerTool"
-		PreprocessorDefinitions="$(ENABLE_3D_CANVAS);$(ENABLE_3D_RENDERING);$(ENABLE_BLOB_SLICE);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CLIENT_BASED_GEOLOCATION);$(ENABLE_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DOM_STORAGE);$(ENABLE_EVENTSOURCE);$(ENABLE_FILTERS);$(ENABLE_FILE_READER);$(ENABLE_FILE_WRITER);$(ENABLE_GEOLOCATION);$(ENABLE_ICONDATABASE);$(ENABLE_IMAGE_RESIZER);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_SPEECH);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_MATHML);$(ENABLE_NOTIFICATIONS);$(ENABLE_OFFLINE_WEB_APPLICATIONS);$(ENABLE_SHARED_WORKERS);$(ENABLE_SVG);$(ENABLE_SVG_ANIMATION);$(ENABLE_SVG_AS_IMAGE);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_SVG_FOREIGN_OBJECT);$(ENABLE_SVG_USE);$(ENABLE_VIDEO);$(ENABLE_WEB_SOCKETS);$(ENABLE_WML);$(ENABLE_WORKERS);$(ENABLE_XHTMLMP);$(ENABLE_XPATH);$(ENABLE_XSLT)"
+		PreprocessorDefinitions="$(ENABLE_3D_CANVAS);$(ENABLE_3D_RENDERING);$(ENABLE_BLOB_SLICE);$(ENABLE_CHANNEL_MESSAGING);$(ENABLE_CLIENT_BASED_GEOLOCATION);$(ENABLE_DATABASE);$(ENABLE_DATAGRID);$(ENABLE_DATALIST);$(ENABLE_DEVICE_ORIENTATION);$(ENABLE_DIRECTORY_UPLOAD);$(ENABLE_DOM_STORAGE);$(ENABLE_EVENTSOURCE);$(ENABLE_FILTERS);$(ENABLE_FILE_READER);$(ENABLE_FILE_WRITER);$(ENABLE_GEOLOCATION);$(ENABLE_ICONDATABASE);$(ENABLE_IMAGE_RESIZER);$(ENABLE_INDEXED_DATABASE);$(ENABLE_INPUT_SPEECH);$(ENABLE_JAVASCRIPT_DEBUGGER);$(ENABLE_MATHML);$(ENABLE_NOTIFICATIONS);$(ENABLE_OFFLINE_WEB_APPLICATIONS);$(ENABLE_SHARED_WORKERS);$(ENABLE_SVG);$(ENABLE_SVG_ANIMATION);$(ENABLE_SVG_AS_IMAGE);$(ENABLE_SVG_DOM_OBJC_BINDINGS);$(ENABLE_SVG_FONTS);$(ENABLE_SVG_FOREIGN_OBJECT);$(ENABLE_SVG_USE);$(ENABLE_VIDEO);$(ENABLE_WEB_SOCKETS);$(ENABLE_WEB_TIMING);$(ENABLE_WML);$(ENABLE_WORKERS);$(ENABLE_XHTMLMP);$(ENABLE_XPATH);$(ENABLE_XSLT)"
 	/>
   <UserMacro
 		Name="ENABLE_3D_CANVAS"
@@ -57,6 +57,11 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+                Name="ENABLE_DIRECTORY_UPLOAD"
+                Value=""
+                PerformEnvironmentSet="true"
+        />
+  <UserMacro
 		Name="ENABLE_DOM_STORAGE"
 		Value="ENABLE_DOM_STORAGE"
 		PerformEnvironmentSet="true"
@@ -177,6 +182,11 @@
 		PerformEnvironmentSet="true"
 	/>
   <UserMacro
+		Name="ENABLE_WEB_TIMING"
+		Value=""
+		PerformEnvironmentSet="true"
+	/>
+  <UserMacro
 		Name="ENABLE_WML"
 		Value=""
 		PerformEnvironmentSet="true"
diff --git a/WebKitTools/ChangeLog b/WebKitTools/ChangeLog
index e7d06cd..553962a 100644
--- a/WebKitTools/ChangeLog
+++ b/WebKitTools/ChangeLog
@@ -1,6 +1,841 @@
+2010-07-05  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Oliver Hunt.
+
+        The style checker exempts gtk2drawing.h when it should exempt gtkdrawing.h
+        https://bugs.webkit.org/show_bug.cgi?id=41017
+
+        * Scripts/webkitpy/style/checker.py: Exempt gtkdrawing.h instead of gtk2drawing.h
+        * Scripts/webkitpy/style/checker_unittest.py: Update the unit test to reflect the change.
+
+2010-07-04  MORITA Hajime  <morrita@google.com>
+
+        rebaseline-chromium-webkit-tests: UnicodeDecodeError
+        https://bugs.webkit.org/show_bug.cgi?id=41589
+
+        * run() method can result non-utf-8 bytes, that causes utf-8
+          decoding fail.  Fixed to disable decoding.
+        * Fixed Git.find_checkout_root() to make a test pass.
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+        * Scripts/webkitpy/common/checkout/scm_unittest.py:
+
+2010-07-03  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix DumpRenderTree userStyleSheet handling.
+        https://bugs.webkit.org/show_bug.cgi?id=41570
+
+        DumpRenderTree did only set the userStyleSheet at
+        layoutTestController.setUserStyleSheetEnabled().
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::reset):
+        (LayoutTestController::setUserStyleSheetLocation):
+        (LayoutTestController::setUserStyleSheetEnabled):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
+2010-07-03  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] support dumpChildFrameScrollPositions
+
+        https://bugs.webkit.org/show_bug.cgi?id=41088
+
+        Unskip:
+
+        http/tests/navigation/anchor-subframeload.html
+        http/tests/navigation/relativeanchor-frames.html
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::dumpFrameScrollPosition):
+        (WebCore::DumpRenderTree::dump):
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::reset):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        (LayoutTestController::shouldDumpChildFrameScrollPositions):
+        (LayoutTestController::dumpChildFrameScrollPositions):
+
+2010-07-02  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Rename new scripts so that they don't make autocompleting run-webkit-tests annoying.
+
+        * Scripts/debug-test-runner: Copied from Scripts/debug-webkittestrunner.
+        * Scripts/debug-webkittestrunner: Removed.
+        * Scripts/run-test-runner: Copied from Scripts/run-webkittestrunner.
+        * Scripts/run-webkittestrunner: Removed.
+
+2010-07-02  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Some http tests fail on Windows with Cygwin 1.7
+        https://bugs.webkit.org/show_bug.cgi?id=41537
+        
+        With Cygwin 1.7, the registry key at SOFTWARE\\Cygnus Solutions\\Cygwin\\mounts v2\\/
+        doesn't exist anymore, because the mount points are stored in /etc/fstab. However, we
+        just need root mount point, which is defined in SOFTWARE\\Cygwin\\setup.
+
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (resolveCygwinPath): Fall back to SOFTWARE\\Cygwin\\setup if 
+            SOFTWARE\\Cygnus Solutions\\Cygwin\\mounts v2\\/ doesn't work.
+
+2010-06-23  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Separate DerivedSources per-project
+        https://bugs.webkit.org/show_bug.cgi?id=41109
+
+        The JavaScriptCore cppflags used to include the top-level DerivedSources directory
+        allowing the tools to build as a side-effect. Now that the top-level directory
+        is no longer in the list of JavaScriptCore includes, include it explicitly.
+
+        * GNUmakefile.am:
+
+2010-07-01  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Make context menus show up in the right place in QTestBrowser
+
+        Context menus were shown at scene-relative coordinates for
+        QGraphicsWebView while QMenu expects them to be global. The
+        change to the QWidget case was to get rid of the mapToGlobal.
+
+        * QtTestBrowser/webview.cpp:
+
+2010-07-01  Robert Hogan <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] dump frames in ascending alphabetical order of title
+
+        https://bugs.webkit.org/show_bug.cgi?id=41261
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::dumpHistoryItem):
+
+2010-07-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed. 
+
+        Fix the GTK+ build after r62278.
+
+        * Scripts/webkitdirs.pm: If the make arguments have already been specified,
+        let them override the automatic CPU detection for autotools builds.
+
+2010-07-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Unreviewed.
+
+        Fix the Windows build after r62278.
+
+        * Scripts/num-cpus: Use FindBin to add the Scripts directory to the list of library directories.
+
+2010-07-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] build-webkit does not detect the number of CPUs
+        https://bugs.webkit.org/show_bug.cgi?id=41469
+
+        Pass the appropriate -j<#> flag to make when building autotools builds.
+        This causes make to spawn that many number of child processes for doing
+        parallel builds.
+
+        * Scripts/num-cpus: Use the newly abstracted numberOfCPUs to return the number
+        of CPUs. This makes the script work across more platforms.
+        * Scripts/webkitdirs.pm: Create a numberOfCPUs/determineNumberOfCPUs to determine the
+        number of CPUs across several platforms. Use this new function to determine the appropriate
+        arguments to pass to make for doing parallel builds with autotools build files.
+
+2010-07-01  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Laszlo Gombos.
+
+        [Qt][Symbian] Bumped up the maximum heap size to 96MB
+
+        * QtTestBrowser/QtTestBrowser.pro: Removed explicit heap size declaration
+        and use the one from WebKit.pri instead.
+
+2010-07-01  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Promote webkit-patch land-safely to main help
+        https://bugs.webkit.org/show_bug.cgi?id=41446
+
+        I've been using this command a bunch and recommending it to folks.  We
+        should show it in main help as it's past the experimental phase.
+
+        * Scripts/webkitpy/tool/commands/upload.py:
+
+2010-06-28  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Shinichiro Hamaji.
+
+        rebaseline-chromium-webkit-tests doesn't do diffs right with a Git checkout of WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=38775
+
+        - Introduced SCM.show_head() and SCM.diff_for_file().
+        - Replaced direct svn invocations with newly implement SCM methods.
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+        * Scripts/webkitpy/common/checkout/scm_unittest.py:
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+
+2010-06-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Allow MiniBrowser to open local files
+        https://bugs.webkit.org/show_bug.cgi?id=41104
+
+        Wire up the openDocument: message with an NSOpenPanel, so we can open
+        local files.
+        
+        Also change the xib so that the window remembers its size.
+        
+        * MiniBrowser/mac/AppDelegate.m:
+        (-[BrowserAppDelegate frontmostBrowserWindowController]):
+        (-[BrowserAppDelegate openDocument:]):
+        (-[BrowserAppDelegate openPanelDidEnd:returnCode:contextInfo:]):
+        * MiniBrowser/mac/English.lproj/BrowserWindow.xib:
+
+2010-06-30  Sam Weinig  <sam@webkit.org>
+
+        Rubber-stamped by Anders Carlsson.
+
+        Add debug-webkittestrunner and cleanup related scripts.
+
+        * Scripts/debug-webkittestrunner: Added.
+        * Scripts/run-webkittestrunner:
+        * Scripts/webkitdirs.pm:
+
+2010-06-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] Build fix after recent changes to LayoutTestController.
+
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::pageSizeAndMarginsInPixels):
+
+2010-06-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41389
+        Make WebKitTestRunner work with more than one test at a time.
+
+        This converts WebKitTestRunner to a similar model as DumpRenderTree,
+        where there is a single WKView and each test is run it, rather than
+        the design I was using where each test got its own WKView.
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::didRecieveMessage):
+        (WTR::InjectedBundle::reset):
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.h:
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::initialize):
+        (WTR::TestController::runTest):
+        (WTR::TestController::_didRecieveMessageFromInjectedBundle):
+        (WTR::TestController::didRecieveMessageFromInjectedBundle):
+        * WebKitTestRunner/TestController.h:
+        (WTR::TestController::mainWebView):
+        (WTR::TestController::pageNamespace):
+        (WTR::TestController::context):
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::TestInvocation::TestInvocation):
+        (WTR::TestInvocation::~TestInvocation):
+        (WTR::TestInvocation::invoke):
+        (WTR::TestInvocation::didRecieveMessageFromInjectedBundle):
+        * WebKitTestRunner/TestInvocation.h:
+
+2010-06-30  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt][Symbian] Only 10 websites can be loaded consecutively when using QtWebkit 2.0
+        https://bugs.webkit.org/show_bug.cgi?id=40446
+
+        We quickly run out of memory on Symbian when loading web pages. This is
+        caused by the default heap size, which is not suited for a web browser.
+
+        This change bumps the max heap size to 32MB.
+
+        * QtTestBrowser/QtTestBrowser.pro:
+
+2010-06-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        webkit-patch land allow the user to continue even if the builders are red
+        https://bugs.webkit.org/show_bug.cgi?id=41395
+
+        I don't think it's good that we've been teaching people
+        to always pass --ignore-builders.  At least land is now
+        useable w/o --ignore-builders.
+
+        * Scripts/webkitpy/tool/steps/ensurebuildersaregreen.py:
+
+2010-06-29  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] support dumpResourceResponseMIMETypes
+        https://bugs.webkit.org/show_bug.cgi?id=41260
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::reset):
+        (LayoutTestController::dumpResourceResponseMIMETypes):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
+2010-06-29  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Resize scene when Qt DRT WebPage receives a geometry change request
+        https://bugs.webkit.org/show_bug.cgi?id=41173
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::WebPage::setViewGeometry):
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+
+2010-06-29  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Deal with postEvent in case of graphics based DRT
+        https://bugs.webkit.org/show_bug.cgi?id=41174
+
+        QGraphicsScene does not have a postEvent method, so make scene
+        send the event, in case of graphics based DRT, and delete it after that.
+
+        * DumpRenderTree/qt/EventSenderQt.cpp:
+        (EventSender::scheduleAsynchronousClick):
+        (EventSender::replaySavedEvents):
+        (EventSender::postEvent):
+        * DumpRenderTree/qt/EventSenderQt.h:
+
+2010-06-29  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Make switchFocus() method works with QGraphicsWebView in Qt DRT
+        https://bugs.webkit.org/show_bug.cgi?id=41172
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::switchFocus):
+
+2010-06-29  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Make DRT more coherent with other ports to allow reusing more tests
+        https://bugs.webkit.org/show_bug.cgi?id=40009
+
+        Make sure "AXRole: ", "AXTitle: " and "AXDescription: " prefixes
+        are used when returning those values, for coherency with other ports.
+
+        * DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp:
+        (AccessibilityUIElement::role):
+        (AccessibilityUIElement::title):
+        (AccessibilityUIElement::description):
+
+2010-06-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r62106.
+        http://trac.webkit.org/changeset/62106
+        https://bugs.webkit.org/show_bug.cgi?id=41346
+
+        "Broke editing tests" (Requested by xan_ on #webkit).
+
+        * Scripts/old-run-webkit-tests:
+
+2010-06-29  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Ensure DRT loads GAIL (Gtk+ module), for a11y tests
+        https://bugs.webkit.org/show_bug.cgi?id=38648
+
+        Add the GTK_MODULES envvar (set to "gail") to the clean
+        environment when running DRT for the Gtk+ port
+
+        * Scripts/old-run-webkit-tests:
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Switch test-html5-parser back to using runner.html.
+
+        * Scripts/test-html5-parser:
+
+2010-06-28  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Restore webkit-runner.html for use with new tree builder
+        https://bugs.webkit.org/show_bug.cgi?id=41317
+
+        For now, we just want to run webkit-runner when we test-html5-parser.
+
+        * Scripts/test-html5-parser:
+
+2010-06-23  John Gregg  <johnnyg@google.com>
+
+        Reviewed by Kent Tamura.
+
+        add ENABLE_DIRECTORY_UPLOAD build support
+        https://bugs.webkit.org/show_bug.cgi?id=41100
+
+        * Scripts/build-webkit:
+
+2010-06-28  Gustavo Noronha Silva  <gns@gnome.org>
+
+        Rubber-stamped by Xan Lopez.
+
+        Update webkitdirs's knowledge of our library's name.
+
+        * Scripts/webkitdirs.pm:
+
+2010-06-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41299
+        Build up WebKitTestRunner output in the InjectedBundle
+
+        Simplify WebKitTestRunner by building up the output in the InjectedBundle
+        and sending it over postMessage when done, instead of using the async
+        WKPageRenderTreeExternalRepresentation.
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::done):
+        (WTR::InjectedBundle::didRecieveMessage):
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.h:
+        (WTR::InjectedBundle::os):
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::WKStringToUTF8):
+        (WTR::InjectedBundlePage::didFinishLoadForFrame):
+        (WTR::InjectedBundlePage::didFailLoadWithErrorForFrame):
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::WKStringToUTF8):
+        (WTR::TestInvocation::TestInvocation):
+        (WTR::TestInvocation::invoke):
+        (WTR::TestInvocation::initializeMainWebView):
+        (WTR::TestInvocation::_didRecieveMessageFromInjectedBundle):
+        (WTR::TestInvocation::didRecieveMessageFromInjectedBundle):
+        * WebKitTestRunner/TestInvocation.h:
+
+2010-06-28  Robert Hogan  <robert@webkit.org>
+
+        Unreviewed, rolling out r62021.
+        http://trac.webkit.org/changeset/62021
+        https://bugs.webkit.org/show_bug.cgi?id=41261
+
+        Broke http/navigation tests among other
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::dumpFramesAsText):
+
+2010-06-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add run-webkittestrunner to run WebKitTestRunner with the appropriate
+        environment.
+
+        * Scripts/run-webkittestrunner: Added.
+        * Scripts/webkitdirs.pm:
+
+2010-06-28  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] dump frames in ascending alphabetical order of title
+
+        https://bugs.webkit.org/show_bug.cgi?id=41261
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::dumpFramesAsText):
+
+2010-06-28  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] dump bf history of child windows
+
+        https://bugs.webkit.org/show_bug.cgi?id=41266
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::dumpBackForwardList):
+        (WebCore::DumpRenderTree::dump):
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+
+2010-06-28  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41288
+        WebKit2: Add frame API for InjectedBundle code
+
+        * MiniBrowser/mac/WebBundle/WebBundleMain.m:
+        (_didClearWindowForFrame):
+
+2010-06-28  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QtTestBrowser does not have a "Load" button ; therefore, unable to load pages on touch only symbian devices (portrait mode).
+        https://bugs.webkit.org/show_bug.cgi?id=38597
+
+        Fix behavior so reload button really acts as a load and a reload button.
+
+        * QtTestBrowser/mainwindow.cpp:
+        (MainWindow::changeLocation):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Does not compile with -DGSEAL_ENABLE
+        https://bugs.webkit.org/show_bug.cgi?id=37851
+
+        Fix build with GSEAL enabled.
+
+        * DumpRenderTree/gtk/EventSender.cpp:
+        (gtk_widget_get_window):
+        (prepareMouseButtonEvent):
+        (mouseMoveToCallback):
+        (mouseWheelToCallback):
+        (keyDownCallback):
+
+2010-06-28  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Add support for GTK+3
+        https://bugs.webkit.org/show_bug.cgi?id=41253
+
+        Adapt build system for 3.x support.
+
+        * GNUmakefile.am:
+
+2010-06-10  Mahesh Kulkarni  <mahesh.kulkarni@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [QT][S60] build-webkit scripts picks wrong make spec for windows build
+        https://bugs.webkit.org/show_bug.cgi?id=41198
+
+        Instead of checking for existence of %EPOCROOT% on windows, mandatory use of --symbian flag for symbian builds. 
+
+        * Scripts/webkitdirs.pm:
+        (determineIsSymbian): remove check for %EPOCROOT% as one can build for windows port of QT as well
+
+2010-06-28  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make it possible to test the new HTML5 TreeBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=41276
+
+        Adam was concerned that someone might make their port
+        depend on this setting (I guess we had some trouble with that
+        with the HTML5Parser setting), so I littered the code with warnings.
+
+        test-html5-parser now tests this code path.
+
+        * DumpRenderTree/mac/DumpRenderTree.mm:
+        (resetDefaultsToConsistentValues):
+        (initializeGlobalsFromCommandLineOptions):
+        * Scripts/test-html5-parser:
+
+2010-06-27  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed. 
+        
+        Some never-called @staticmethods touched self. 
+        Fixed it to replace these self with a class.
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+
+2010-06-27  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed.
+        
+        Fixed exception raising syntax that is pointed out at
+        https://bugs.webkit.org/show_bug.cgi?id=41153
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+        * Scripts/webkitpy/common/checkout/scm_unittest.py: 
+          Removed a bad line that I accidentally checked-in at last revision.
+
+2010-06-24  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Eric Seidel.
+
+        rebaseline-chromium-webkit-tests should add or remove files to local git repository
+        https://bugs.webkit.org/show_bug.cgi?id=41153
+
+        - Added SCM.add() and SCM.remove()
+        - Replaced "svn add" and "svn remove"
+          rebaseline_chromium_webkit_tests.py: in with SCM method equivalents.
+        - add "-U" and "-q" options to rebaseline_chromium_webkit_tests.py
+          for debugging purpose.
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+        * Scripts/webkitpy/common/checkout/scm_unittest.py:
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+
+2010-06-25  Yuzo Fujishima  <yuzo@google.com>
+
+        Reviewed by Shinichiro Hamaji.
+
+        Improve default value handling for page format properties.
+        https://bugs.webkit.org/show_bug.cgi?id=41150
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (parsePageNumber):
+        (parsePageNumberSizeMarings):
+        (pageSizeAndMarginsInPixelsCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::pageSizeAndMarginsInPixels):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::pageSizeAndMarginsInPixels):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::pageSizeAndMarginsInPixels):
+
+2010-06-21  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] DRT Support for setCustomPolicyDelegate
+
+        https://bugs.webkit.org/show_bug.cgi?id=39564
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::setCustomPolicyDelegate):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
+2010-06-26  Robert Hogan  <robert@webkit.org>
+
+        Unreviewed, Qt build fix following http://trac.webkit.org/changeset/61879
+        
+        Remove qwebscriptworld.h from LayoutTestControllerQt.cpp - it is no longer
+        exported.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+
+2010-06-26  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add a build-webkit option for enabling Web Timing support.
+        https://bugs.webkit.org/show_bug.cgi?id=38924
+
+        * Scripts/build-webkit:
+
+2010-06-25  Jesus Sanchez-Palencia  <jesus.palencia@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] QtTestBrowser does not have a "Load" button ; therefore, unable to load pages on touch only symbian devices (portrait mode).
+        https://bugs.webkit.org/show_bug.cgi?id=38597
+
+        Make the reload button act as a load button as well.
+
+        * QtTestBrowser/mainwindow.cpp:
+        (MainWindow::buildUI):
+        (MainWindow::changeLocation):
+
+2010-06-25  Prasad Tammana  <prasadt@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Add empty abortModal() method to all platforms.
+        https://bugs.webkit.org/show_bug.cgi?id=40864
+
+        Add an empty abortModal() stub to LayoutTestController on all platforms to get rid of platform specific #ifs in
+        platform independent LayoutTestController code.  Without this change, layout tests using LayoutTestController tests
+        that use abortModal will become mac specific which is not desirable.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (abortModalCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::abortModal):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::abortModal):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        (LayoutTestController::abortModal):
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::abortModal):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::abortModal):
+
+2010-06-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Patch for https://bugs.webkit.org/show_bug.cgi?id=41226
+        Flesh out injected bundle code for WebKitTestRunner and add basic LayoutTestController.
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp: Added.
+        (WTR::InjectedBundle::shared):
+        (WTR::InjectedBundle::InjectedBundle):
+        (WTR::InjectedBundle::_didCreatePage):
+        (WTR::InjectedBundle::_willDestroyPage):
+        (WTR::InjectedBundle::_didRecieveMessage):
+        (WTR::InjectedBundle::initialize):
+        (WTR::InjectedBundle::didCreatePage):
+        (WTR::InjectedBundle::willDestroyPage):
+        (WTR::InjectedBundle::didRecieveMessage):
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.h: Added.
+        (WTR::InjectedBundle::layoutTestController):
+        * WebKitTestRunner/InjectedBundle/InjectedBundleMain.cpp:
+        (WKBundleInitialize):
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp: Added.
+        (WTR::InjectedBundlePage::InjectedBundlePage):
+        (WTR::InjectedBundlePage::~InjectedBundlePage):
+        (WTR::InjectedBundlePage::_didStartProvisionalLoadForFrame):
+        (WTR::InjectedBundlePage::_didReceiveServerRedirectForProvisionalLoadForFrame):
+        (WTR::InjectedBundlePage::_didFailProvisionalLoadWithErrorForFrame):
+        (WTR::InjectedBundlePage::_didCommitLoadForFrame):
+        (WTR::InjectedBundlePage::_didFinishLoadForFrame):
+        (WTR::InjectedBundlePage::_didFailLoadWithErrorForFrame):
+        (WTR::InjectedBundlePage::_didReceiveTitleForFrame):
+        (WTR::InjectedBundlePage::_didClearWindowForFrame):
+        (WTR::InjectedBundlePage::didStartProvisionalLoadForFrame):
+        (WTR::InjectedBundlePage::didReceiveServerRedirectForProvisionalLoadForFrame):
+        (WTR::InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame):
+        (WTR::InjectedBundlePage::didCommitLoadForFrame):
+        (WTR::InjectedBundlePage::didFinishLoadForFrame):
+        (WTR::InjectedBundlePage::didFailLoadWithErrorForFrame):
+        (WTR::InjectedBundlePage::didReceiveTitleForFrame):
+        (WTR::InjectedBundlePage::didClearWindowForFrame):
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.h: Added.
+        (WTR::InjectedBundlePage::page):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.cpp: Added.
+        (WTR::LayoutTestController::create):
+        (WTR::LayoutTestController::LayoutTestController):
+        (WTR::LayoutTestController::~LayoutTestController):
+        (WTR::dumpAsTextCallback):
+        (WTR::layoutTestControllerObjectFinalize):
+        (WTR::LayoutTestController::makeWindowObject):
+        (WTR::LayoutTestController::getJSClass):
+        (WTR::LayoutTestController::staticFunctions):
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h: Added.
+        (WTR::LayoutTestController::dumpAsText):
+        (WTR::LayoutTestController::setDumpAsText):
+        * WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj:
+
+2010-06-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Make WebKitTestRunner really work with run-webkit-tests. 
+
+        - Add Forwarding headers to allow some cleanup.
+
+        * WebKitTestRunner/ForwardingHeaders: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/ASCIICType.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/Assertions.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/Atomics.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/FastMalloc.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/HashMap.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/HashSet.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/HashTraits.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/Locker.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/MainThread.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/MathExtras.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/Noncopyable.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/OwnPtr.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/OwnPtrCommon.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/PassOwnPtr.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/PassRefPtr.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/Platform.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/RefCounted.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/RefPtr.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/RetainPtr.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/StringExtras.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/ThreadSafeShared.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/Threading.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/ThreadingPrimitives.h: Added.
+        * WebKitTestRunner/ForwardingHeaders/wtf/Vector.h: Added.
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::TestInvocation::dump): Dump the right number of #EOFs.
+        * WebKitTestRunner/TestInvocation.h:
+
+2010-06-25  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add support for WebKitTestRunner to old-run-webkit-tests
+
+        - Also adds a script to build WebKitTestRunner for old-run-webkit-tests to use.
+
+        * Scripts/build-webkittestrunner: Added.
+        * Scripts/old-run-webkit-tests:
+
+2010-06-25  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        Incremental build failed on Chromium ews
+        https://bugs.webkit.org/show_bug.cgi?id=41011
+
+        The division of responsibility between update-webkit --chromium and
+        build-webkit --chromium is slightly unclear.  In this patch, we make
+        build-webkit --chromium also update DEPS and re-run GYP in case the
+        developer has changed either since they updated.
+
+        This change is also helpful for the EWS, which wants to update DEPS and
+        re-run GYP after applying patches, but the EWS doesn't want to run
+        update-webkit --chromium because it has a dirty working copy.
+
+        * Scripts/webkitdirs.pm:
+
+2010-06-25  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Support evaluateScriptInIsolatedWorld()
+
+        https://bugs.webkit.org/show_bug.cgi?id=40079
+
+        Remove evaluateScriptInIsolatedWorld() from QtWebKit API.
+        Remove QWebScriptWorld from exported headers.
+        Confine support to DumpRenderTreeSupportQt so that the tests can pass.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::reset):
+        (LayoutTestController::evaluateScriptInIsolatedWorld):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+
 2010-06-25  Anders Carlsson  <andersca@apple.com>
 
-        Reviewed by Dan Bernstein.
+        Revert accidental part and add a newline.
+
+        * MiniBrowser/mac/AppDelegate.m:
+        * MiniBrowser/mac/MiniBrowser_Prefix.pch:
+
+2010-06-25  Anders Carlsson  <andersca@apple.com>
+
+        Rubber-stamped by Dan Bernstein.
 
         Add a LOG macro that expands to a no-op by default.
 
diff --git a/WebKitTools/DumpRenderTree/LayoutTestController.cpp b/WebKitTools/DumpRenderTree/LayoutTestController.cpp
index 02c77a4..edab29e 100644
--- a/WebKitTools/DumpRenderTree/LayoutTestController.cpp
+++ b/WebKitTools/DumpRenderTree/LayoutTestController.cpp
@@ -555,10 +555,65 @@ static bool parsePagePropertyParameters(JSContextRef context, int argumentCount,
 static bool parsePageNumber(JSContextRef context, int argumentCount, const JSValueRef* arguments, JSValueRef* exception, int& pageNumber)
 {
     pageNumber = 0;
-    if (argumentCount != 1)
+    switch (argumentCount) {
+    case 1:
+        pageNumber = static_cast<int>(JSValueToNumber(context, arguments[0], exception));
+        if (*exception)
+            return false;
+        // Fall through.
+    case 0:
+        return true;
+    default:
+        return false;
+    }
+}
+
+static bool parsePageNumberSizeMarings(JSContextRef context, int argumentCount, const JSValueRef* arguments, JSValueRef* exception, int& pageNumber, int& width, int& height, int& marginTop, int& marginRight, int& marginBottom, int& marginLeft)
+{
+    pageNumber = 0;
+    width = height = 0;
+    marginTop = marginRight = marginBottom = marginLeft = 0;
+
+    switch (argumentCount) {
+    case 7:
+        marginLeft = static_cast<int>(JSValueToNumber(context, arguments[6], exception));
+        if (*exception)
+            return false;
+        // Fall through.
+    case 6:
+        marginBottom = static_cast<int>(JSValueToNumber(context, arguments[5], exception));
+        if (*exception)
+            return false;
+        // Fall through.
+    case 5:
+        marginRight = static_cast<int>(JSValueToNumber(context, arguments[4], exception));
+        if (*exception)
+            return false;
+        // Fall through.
+    case 4:
+        marginTop = static_cast<int>(JSValueToNumber(context, arguments[3], exception));
+        if (*exception)
+            return false;
+        // Fall through.
+    case 3:
+        height = static_cast<int>(JSValueToNumber(context, arguments[2], exception));
+        if (*exception)
+            return false;
+        // Fall through.
+    case 2:
+        width = static_cast<int>(JSValueToNumber(context, arguments[1], exception));
+        if (*exception)
+            return false;
+        // Fall through.
+    case 1:
+        pageNumber = static_cast<int>(JSValueToNumber(context, arguments[0], exception));
+        if (*exception)
+            return false;
+        // Fall through.
+        return true;
+    default:
         return false;
-    pageNumber = static_cast<int>(JSValueToNumber(context, arguments[0], exception));
-    return !*exception;
+    }
 }
 
 static JSValueRef pageNumberForElementByIdCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
@@ -612,24 +667,16 @@ static JSValueRef isPageBoxVisibleCallback(JSContextRef context, JSObjectRef fun
     return JSValueMakeBoolean(context, controller->isPageBoxVisible(pageNumber));
 }
 
-static JSValueRef pageAreaRectInPixelsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
-{
-    int pageNumber = 0;
-    if (!parsePageNumber(context, argumentCount, arguments, exception, pageNumber))
-        return JSValueMakeUndefined(context);
-
-    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
-    return JSValueMakeString(context, controller->pageAreaRectInPixels(pageNumber).get());
-}
-
-static JSValueRef preferredPageSizeInPixelsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+static JSValueRef pageSizeAndMarginsInPixelsCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     int pageNumber = 0;
-    if (!parsePageNumber(context, argumentCount, arguments, exception, pageNumber))
+    int width = 0, height = 0;
+    int marginTop = 0, marginRight = 0, marginBottom = 0, marginLeft = 0;
+    if (!parsePageNumberSizeMarings(context, argumentCount, arguments, exception, pageNumber, width, height, marginTop, marginRight, marginBottom, marginLeft))
         return JSValueMakeUndefined(context);
 
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
-    return JSValueMakeString(context, controller->preferredPageSizeInPixels(pageNumber).get());
+    return JSValueMakeString(context, controller->pageSizeAndMarginsInPixels(pageNumber, width, height, marginTop, marginRight, marginBottom, marginLeft).get());
 }
 
 static JSValueRef queueBackNavigationCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
@@ -1513,14 +1560,12 @@ static JSValueRef setWebViewEditableCallback(JSContextRef context, JSObjectRef f
 }
 
 
-#if PLATFORM(MAC)
 static JSValueRef abortModalCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
     controller->abortModal();
     return JSValueMakeUndefined(context);
 }
-#endif
 
 static JSValueRef markerTextForListItemCallback(JSContextRef context, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
@@ -1648,9 +1693,7 @@ JSStaticValue* LayoutTestController::staticValues()
 JSStaticFunction* LayoutTestController::staticFunctions()
 {
     static JSStaticFunction staticFunctions[] = {
-#if PLATFORM(MAC)
         { "abortModal", abortModalCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
-#endif
         { "addDisallowedURL", addDisallowedURLCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "addUserScript", addUserScriptCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "addUserStyleSheet", addUserStyleSheetCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
@@ -1699,12 +1742,11 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "numberOfActiveAnimations", numberOfActiveAnimationsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "overridePreference", overridePreferenceCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pageNumberForElementById", pageNumberForElementByIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
-        { "pageAreaRectInPixels", pageAreaRectInPixelsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "pageSizeAndMarginsInPixels", pageSizeAndMarginsInPixelsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pageProperty", pagePropertyCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pathToLocalResource", pathToLocalResourceCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pauseAnimationAtTimeOnElementWithId", pauseAnimationAtTimeOnElementWithIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "pauseTransitionAtTimeOnElementWithId", pauseTransitionAtTimeOnElementWithIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
-        { "preferredPageSizeInPixels", preferredPageSizeInPixelsCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "sampleSVGAnimationForElementAtTime", sampleSVGAnimationForElementAtTimeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "printToPDF", dumpAsPDFCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "queueBackNavigation", queueBackNavigationCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
diff --git a/WebKitTools/DumpRenderTree/LayoutTestController.h b/WebKitTools/DumpRenderTree/LayoutTestController.h
index 6af2c57..be79473 100644
--- a/WebKitTools/DumpRenderTree/LayoutTestController.h
+++ b/WebKitTools/DumpRenderTree/LayoutTestController.h
@@ -64,9 +64,8 @@ public:
     void overridePreference(JSStringRef key, JSStringRef value);
     int pageNumberForElementById(JSStringRef id, float pageWidthInPixels, float pageHeightInPixels);
     JSRetainPtr<JSStringRef> pageProperty(const char* propertyName, int pageNumber) const;
+    JSRetainPtr<JSStringRef> pageSizeAndMarginsInPixels(int pageNumber, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft) const;
     bool isPageBoxVisible(int pageNumber) const;
-    JSRetainPtr<JSStringRef> pageAreaRectInPixels(int pageNumber) const;
-    JSRetainPtr<JSStringRef> preferredPageSizeInPixels(int pageNumber) const;
     JSStringRef pathToLocalResource(JSContextRef, JSStringRef url);
     void queueBackNavigation(int howFarBackward);
     void queueForwardNavigation(int howFarForward);
@@ -260,10 +259,7 @@ public:
 
     void setWebViewEditable(bool);
 
-
-#if PLATFORM(MAC)
     void abortModal();
-#endif
 
     // The following API test functions should probably be moved to platform-specific 
     // unit tests outside of DRT once they exist.
diff --git a/WebKitTools/DumpRenderTree/chromium/LayoutTestController.cpp b/WebKitTools/DumpRenderTree/chromium/LayoutTestController.cpp
index 89e16e0..9ba6421 100644
--- a/WebKitTools/DumpRenderTree/chromium/LayoutTestController.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/LayoutTestController.cpp
@@ -165,6 +165,7 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("setGeolocationPermission", &LayoutTestController::setGeolocationPermission);
     bindMethod("setMockGeolocationPosition", &LayoutTestController::setMockGeolocationPosition);
     bindMethod("setMockGeolocationError", &LayoutTestController::setMockGeolocationError);
+    bindMethod("abortModal", &LayoutTestController::abortModal);
 
     // The fallback method is called when an unknown method is invoked.
     bindFallbackMethod(&LayoutTestController::fallbackMethod);
@@ -1312,3 +1313,8 @@ void LayoutTestController::setMockGeolocationError(const CppArgumentList& argume
         return;
     WebGeolocationServiceMock::setMockGeolocationError(arguments[0].toInt32(), cppVariantToWebString(arguments[1]));
 }
+
+void LayoutTestController::abortModal(const CppArgumentList& arguments, CppVariant* result)
+{
+    result->setNull();
+}
diff --git a/WebKitTools/DumpRenderTree/chromium/LayoutTestController.h b/WebKitTools/DumpRenderTree/chromium/LayoutTestController.h
index 0e66087..22741d5 100644
--- a/WebKitTools/DumpRenderTree/chromium/LayoutTestController.h
+++ b/WebKitTools/DumpRenderTree/chromium/LayoutTestController.h
@@ -286,6 +286,9 @@ public:
     void setMockGeolocationPosition(const CppArgumentList&, CppVariant*);
     void setMockGeolocationError(const CppArgumentList&, CppVariant*);
 
+    // Empty stub method to keep parity with object model exposed by global LayoutTestController.
+    void abortModal(const CppArgumentList&, CppVariant*);
+
 public:
     // The following methods are not exposed to JavaScript.
     void setWorkQueueFrozen(bool frozen) { m_workQueue.setFrozen(frozen); }
diff --git a/WebKitTools/DumpRenderTree/chromium/TestShell.cpp b/WebKitTools/DumpRenderTree/chromium/TestShell.cpp
index 610248a..52f1e7d 100644
--- a/WebKitTools/DumpRenderTree/chromium/TestShell.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/TestShell.cpp
@@ -586,7 +586,7 @@ WebViewHost* TestShell::createWebView()
 WebViewHost* TestShell::createNewWindow(const WebURL& url)
 {
     WebViewHost* host = new WebViewHost(this);
-    WebView* view = WebView::create(host);
+    WebView* view = WebView::create(host, 0);
     host->setWebWidget(view);
     resetWebSettings(*view);
     view->initializeMainFrame(host);
diff --git a/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp b/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
index d186ffa..fbdbd23 100644
--- a/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/AccessibilityUIElementGtk.cpp
@@ -26,6 +26,7 @@
 
 #include "config.h"
 #include "AccessibilityUIElement.h"
+#include "GOwnPtr.h"
 #include "GRefPtr.h"
 
 #include <JavaScriptCore/JSStringRef.h>
@@ -198,7 +199,10 @@ JSStringRef AccessibilityUIElement::role()
     if (!role)
         return JSStringCreateWithCharacters(0, 0);
 
-    return JSStringCreateWithUTF8CString(atk_role_get_name(role));
+    const gchar* roleName = atk_role_get_name(role);
+    GOwnPtr<gchar> axRole(g_strdup_printf("AXRole: %s", roleName));
+
+    return JSStringCreateWithUTF8CString(axRole.get());
 }
 
 JSStringRef AccessibilityUIElement::subrole()
@@ -218,7 +222,9 @@ JSStringRef AccessibilityUIElement::title()
     if (!name)
         return JSStringCreateWithCharacters(0, 0);
 
-    return JSStringCreateWithUTF8CString(name);
+    GOwnPtr<gchar> axTitle(g_strdup_printf("AXTitle: %s", name));
+
+    return JSStringCreateWithUTF8CString(axTitle.get());
 }
 
 JSStringRef AccessibilityUIElement::description()
@@ -228,7 +234,9 @@ JSStringRef AccessibilityUIElement::description()
     if (!description)
         return JSStringCreateWithCharacters(0, 0);
 
-    return JSStringCreateWithUTF8CString(description);
+    GOwnPtr<gchar> axDesc(g_strdup_printf("AXDescription: %s", description));
+
+    return JSStringCreateWithUTF8CString(axDesc.get());
 }
 
 JSStringRef AccessibilityUIElement::stringValue()
diff --git a/WebKitTools/DumpRenderTree/gtk/EventSender.cpp b/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
index 7836ff0..4936fe5 100644
--- a/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/EventSender.cpp
@@ -96,6 +96,14 @@ static void gdk_window_get_root_coords(GdkWindow* window, gint x, gint y, gint*
 }
 #endif
 
+#if !GTK_CHECK_VERSION(2, 14, 0)
+static GdkWindow* gtk_widget_get_window(GtkWidget* widget)
+{
+    g_return_val_if_fail(GTK_IS_WIDGET(widget), 0);
+    return widget->window;
+}
+#endif
+
 static JSValueRef getDragModeCallback(JSContextRef context, JSObjectRef object, JSStringRef propertyName, JSValueRef* exception)
 {
     return JSValueMakeBoolean(context, dragMode);
@@ -139,13 +147,13 @@ bool prepareMouseButtonEvent(GdkEvent* event, int eventSenderButtonNumber)
     event->button.button = gdkButtonNumber;
     event->button.x = lastMousePositionX;
     event->button.y = lastMousePositionY;
-    event->button.window = GTK_WIDGET(view)->window;
+    event->button.window = gtk_widget_get_window(GTK_WIDGET(view));
     event->button.device = gdk_device_get_core_pointer();
     event->button.state = getStateFlags();
     event->button.time = GDK_CURRENT_TIME;
 
     int xRoot, yRoot;
-    gdk_window_get_root_coords(GTK_WIDGET(view)->window, lastMousePositionX, lastMousePositionY, &xRoot, &yRoot);
+    gdk_window_get_root_coords(gtk_widget_get_window(GTK_WIDGET(view)), lastMousePositionX, lastMousePositionY, &xRoot, &yRoot);
     event->button.x_root = xRoot;
     event->button.y_root = yRoot;
 
@@ -266,12 +274,12 @@ static JSValueRef mouseMoveToCallback(JSContextRef context, JSObjectRef function
     event.motion.y = lastMousePositionY;
 
     event.motion.time = GDK_CURRENT_TIME;
-    event.motion.window = GTK_WIDGET(view)->window;
+    event.motion.window = gtk_widget_get_window(GTK_WIDGET(view));
     event.motion.device = gdk_device_get_core_pointer();
     event.motion.state = getStateFlags();
 
     int xRoot, yRoot;
-    gdk_window_get_root_coords(GTK_WIDGET(view)->window, lastMousePositionX, lastMousePositionY, &xRoot, &yRoot);
+    gdk_window_get_root_coords(gtk_widget_get_window(GTK_WIDGET(view)), lastMousePositionX, lastMousePositionY, &xRoot, &yRoot);
     event.motion.x_root = xRoot;
     event.motion.y_root = yRoot;
 
@@ -301,7 +309,7 @@ static JSValueRef mouseWheelToCallback(JSContextRef context, JSObjectRef functio
     event.scroll.x = lastMousePositionX;
     event.scroll.y = lastMousePositionY;
     event.scroll.time = GDK_CURRENT_TIME;
-    event.scroll.window = GTK_WIDGET(view)->window;
+    event.scroll.window = gtk_widget_get_window(GTK_WIDGET(view));
 
     if (horizontal < 0)
         event.scroll.direction = GDK_SCROLL_LEFT;
@@ -499,7 +507,7 @@ static JSValueRef keyDownCallback(JSContextRef context, JSObjectRef function, JS
     memset(&event, 0, sizeof(event));
     event.key.keyval = gdkKeySym;
     event.key.state = state;
-    event.key.window = GTK_WIDGET(view)->window;
+    event.key.window = gtk_widget_get_window(GTK_WIDGET(view));
 
     // When synthesizing an event, an invalid hardware_keycode value
     // can cause it to be badly processed by Gtk+.
diff --git a/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp b/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
index 6f8e637..1814933 100644
--- a/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
@@ -183,13 +183,7 @@ bool LayoutTestController::isPageBoxVisible(int pageNumber) const
     return false;
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::pageAreaRectInPixels(int pageNumber) const
-{
-    // FIXME: implement
-    return JSRetainPtr<JSStringRef>();
-}
-
-JSRetainPtr<JSStringRef> LayoutTestController::preferredPageSizeInPixels(int pageNumber) const
+JSRetainPtr<JSStringRef> LayoutTestController::pageSizeAndMarginsInPixels(int pageNumber, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft) const
 {
     // FIXME: implement
     return JSRetainPtr<JSStringRef>();
@@ -729,3 +723,7 @@ void LayoutTestController::setEditingBehavior(const char* editingBehavior)
     if (!strcmp(editingBehavior, "mac"))
         g_object_set(G_OBJECT(settings), "editing-behavior", WEBKIT_EDITING_BEHAVIOR_MAC, NULL);
 }
+
+void LayoutTestController::abortModal()
+{
+}
diff --git a/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm b/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
index 51ea004..ce02081 100644
--- a/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -137,6 +137,7 @@ static int threaded;
 static int dumpTree = YES;
 static int forceComplexText;
 static int useHTML5Parser = YES;
+static int useHTML5TreeBuilder = NO; // Temporary, will be removed.
 static BOOL printSeparators;
 static RetainPtr<CFStringRef> persistentUserStyleSheetLocation;
 
@@ -456,6 +457,7 @@ static void resetDefaultsToConsistentValues()
     [preferences setAcceleratedCompositingEnabled:YES];
     [preferences setWebGLEnabled:NO];
     [preferences setHTML5ParserEnabled:useHTML5Parser];
+    [preferences setHTML5TreeBuilderEnabled:useHTML5TreeBuilder]; // Temporary, will be removed.
 
     [[NSHTTPCookieStorage sharedHTTPCookieStorage] setCookieAcceptPolicy:NSHTTPCookieAcceptPolicyOnlyFromMainDocumentDomain];
 
@@ -563,6 +565,7 @@ static void initializeGlobalsFromCommandLineOptions(int argc, const char *argv[]
         {"threaded", no_argument, &threaded, YES},
         {"complex-text", no_argument, &forceComplexText, YES},
         {"legacy-parser", no_argument, &useHTML5Parser, NO},
+        {"html5-treebuilder", no_argument, &useHTML5TreeBuilder, YES},
         {NULL, 0, NULL, 0}
     };
     
diff --git a/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm b/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
index d0599e0..9b044c3 100644
--- a/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
+++ b/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
@@ -223,15 +223,9 @@ bool LayoutTestController::isPageBoxVisible(int pageNumber) const
     return [mainFrame isPageBoxVisible:pageNumber];
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::pageAreaRectInPixels(int pageNumber) const
+JSRetainPtr<JSStringRef> LayoutTestController::pageSizeAndMarginsInPixels(int pageNumber, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft) const
 {
-    JSRetainPtr<JSStringRef> propertyValue(Adopt, JSStringCreateWithCFString((CFStringRef)[mainFrame pageAreaRectInPixels:pageNumber]));
-    return propertyValue;
-}
-
-JSRetainPtr<JSStringRef> LayoutTestController::preferredPageSizeInPixels(int pageNumber) const
-{
-    JSRetainPtr<JSStringRef> propertyValue(Adopt, JSStringCreateWithCFString((CFStringRef)[mainFrame preferredPageSizeInPixels:pageNumber]));
+    JSRetainPtr<JSStringRef> propertyValue(Adopt, JSStringCreateWithCFString((CFStringRef)[mainFrame pageSizeAndMarginsInPixels:pageNumber:width:height:marginTop:marginRight:marginBottom:marginLeft]));
     return propertyValue;
 }
 
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.cpp b/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
index f5fbb5c..3eb1714 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
@@ -353,6 +353,14 @@ bool WebPage::allowGeolocationRequest(QWebFrame *)
     return m_drt->layoutTestController()->geolocationPermission();
 }
 
+void WebPage::setViewGeometry(const QRect& rect)
+{
+    if (WebViewGraphicsBased* v = qobject_cast<WebViewGraphicsBased*>(view()))
+        v->scene()->setSceneRect(QRectF(rect));
+    else if (QWidget *v = view())
+        v->setGeometry(rect);
+}
+
 WebViewGraphicsBased::WebViewGraphicsBased(QWidget* parent)
     : m_item(new QGraphicsWebView)
 {
@@ -660,13 +668,35 @@ void DumpRenderTree::hidePage()
     m_mainView->hide();
 }
 
+QString DumpRenderTree::dumpFrameScrollPosition(QWebFrame* frame)
+{
+    if (!frame || !DumpRenderTreeSupportQt::hasDocumentElement(frame))
+        return QString();
+
+    QString result;
+    QPoint pos = frame->scrollPosition();
+    if (pos.x() > 0 || pos.y() > 0) {
+        QWebFrame* parent = qobject_cast<QWebFrame *>(frame->parent());
+        if (parent)
+            result.append(QString("frame '%1' ").arg(frame->title()));
+        result.append(QString("scrolled to %1,%2\n").arg(pos.x()).arg(pos.y()));
+    }
+
+    if (m_controller->shouldDumpChildFrameScrollPositions()) {
+        QList<QWebFrame*> children = frame->childFrames();
+        for (int i = 0; i < children.size(); ++i)
+            result += dumpFrameScrollPosition(children.at(i));
+    }
+    return result;
+}
+
 QString DumpRenderTree::dumpFramesAsText(QWebFrame* frame)
 {
     if (!frame || !DumpRenderTreeSupportQt::hasDocumentElement(frame))
         return QString();
 
     QString result;
-    QWebFrame *parent = qobject_cast<QWebFrame *>(frame->parent());
+    QWebFrame* parent = qobject_cast<QWebFrame*>(frame->parent());
     if (parent) {
         result.append(QLatin1String("\n--------\nFrame: '"));
         result.append(frame->frameName());
@@ -721,16 +751,16 @@ static QString dumpHistoryItem(const QWebHistoryItem& item, int indent, bool cur
         result.append(QLatin1String("  **nav target**"));
     result.append(QLatin1String("\n"));
 
-    QList<QWebHistoryItem> children = DumpRenderTreeSupportQt::getChildHistoryItems(item);
-    for (int i = 0; i < children.size(); ++i)
-        result += dumpHistoryItem(children.at(i), 12, false);
+    QMap<QString, QWebHistoryItem> children = DumpRenderTreeSupportQt::getChildHistoryItems(item);
+    foreach (QWebHistoryItem item, children)
+        result += dumpHistoryItem(item, 12, false);
 
     return result;
 }
 
-QString DumpRenderTree::dumpBackForwardList()
+QString DumpRenderTree::dumpBackForwardList(QWebPage* page)
 {
-    QWebHistory* history = webPage()->history();
+    QWebHistory* history = page->history();
 
     QString result;
     result.append(QLatin1String("\n============== Back Forward List ==============\n"));
@@ -794,15 +824,21 @@ void DumpRenderTree::dump()
     QString resultString;
     if (m_controller->shouldDumpAsText())
         resultString = dumpFramesAsText(mainFrame);
-    else
+    else {
         resultString = mainFrame->renderTreeDump();
-
+        resultString += dumpFrameScrollPosition(mainFrame);
+    }
     if (!resultString.isEmpty()) {
         fprintf(stdout, "Content-Type: text/plain\n");
         fprintf(stdout, "%s", resultString.toUtf8().constData());
 
-        if (m_controller->shouldDumpBackForwardList())
-            fprintf(stdout, "%s", dumpBackForwardList().toUtf8().constData());
+        if (m_controller->shouldDumpBackForwardList()) {
+            fprintf(stdout, "%s", dumpBackForwardList(webPage()).toUtf8().constData());
+            foreach (QObject* widget, windows) {
+                QWebPage* page = qobject_cast<QWebPage*>(widget->findChild<QWebPage*>());
+                fprintf(stdout, "%s", dumpBackForwardList(page).toUtf8().constData());
+            }
+        }
 
     } else
         printf("ERROR: nil result from %s", methodNameStringForFailedTest(m_controller));
@@ -946,7 +982,13 @@ int DumpRenderTree::windowCount() const
 void DumpRenderTree::switchFocus(bool focused)
 {
     QFocusEvent event((focused) ? QEvent::FocusIn : QEvent::FocusOut, Qt::ActiveWindowFocusReason);
-    QApplication::sendEvent(m_mainView, &event);
+    if (!isGraphicsBased())
+        QApplication::sendEvent(m_mainView, &event);
+    else {
+        if (WebViewGraphicsBased* view = qobject_cast<WebViewGraphicsBased*>(m_mainView))
+            view->scene()->sendEvent(view->graphicsView(), &event);
+    }
+
 }
 
 void DumpRenderTree::checkPermission(const QUrl& url, NotificationPermission& permission)
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.h b/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.h
index 2ec972a..f258189 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.h
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.h
@@ -133,7 +133,8 @@ private Q_SLOTS:
 
 private:
     QString dumpFramesAsText(QWebFrame* frame);
-    QString dumpBackForwardList();
+    QString dumpBackForwardList(QWebPage* page);
+    QString dumpFrameScrollPosition(QWebFrame* frame);
     LayoutTestController *m_controller;
 
     bool m_dumpPixels;
@@ -198,12 +199,8 @@ protected:
     bool isTextOutputEnabled() { return m_drt->isTextOutputEnabled(); }
 
 private slots:
-    void setViewGeometry(const QRect &r)
-    {
-        QWidget *v = view();
-        if (v)
-            v->setGeometry(r);
-    }
+    void setViewGeometry(const QRect&);
+
 private:
     QWebInspector* m_webInspector;
     DumpRenderTree *m_drt;
diff --git a/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp b/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
index 5f340e9..1e495b1 100644
--- a/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
+++ b/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
@@ -368,9 +368,9 @@ void EventSender::contextClick()
 void EventSender::scheduleAsynchronousClick()
 {
     QMouseEvent* event = new QMouseEvent(QEvent::MouseButtonPress, m_mousePos, Qt::LeftButton, Qt::RightButton, Qt::NoModifier);
-    QApplication::postEvent(m_page, event);
+    postEvent(m_page, event);
     QMouseEvent* event2 = new QMouseEvent(QEvent::MouseButtonRelease, m_mousePos, Qt::LeftButton, Qt::RightButton, Qt::NoModifier);
-    QApplication::postEvent(m_page, event2);
+    postEvent(m_page, event2);
 }
 
 void EventSender::addTouchPoint(int x, int y)
@@ -552,7 +552,7 @@ void EventSender::replaySavedEvents(bool flush)
         // First send all the events that are ready to be sent
         while (!eventQueue[startOfQueue].m_delay && startOfQueue < endOfQueue) {
             QEvent* ev = eventQueue[startOfQueue++].m_event;
-            QApplication::postEvent(m_page->view(), ev); // ev deleted by the system
+            postEvent(m_page->view(), ev);
         }
         if (startOfQueue == endOfQueue) {
             // Reset the queue
@@ -643,3 +643,14 @@ void EventSender::sendEvent(QObject* receiver, QEvent* event)
     else
         QApplication::sendEvent(receiver, event);
 }
+
+void EventSender::postEvent(QObject* receiver, QEvent* event)
+{
+    // QGraphicsScene does not have a postEvent method, so send the event in this case
+    // and delete it after that.
+    if (WebCore::WebViewGraphicsBased* view = qobject_cast<WebCore::WebViewGraphicsBased*>(receiver)) {
+        view->scene()->sendEvent(view->graphicsView(), event);
+        delete event;
+    } else
+        QApplication::postEvent(receiver, event); // event deleted by the system
+}
diff --git a/WebKitTools/DumpRenderTree/qt/EventSenderQt.h b/WebKitTools/DumpRenderTree/qt/EventSenderQt.h
index c2ff746..a17e938 100644
--- a/WebKitTools/DumpRenderTree/qt/EventSenderQt.h
+++ b/WebKitTools/DumpRenderTree/qt/EventSenderQt.h
@@ -90,6 +90,7 @@ private:
     QGraphicsSceneMouseEvent* createGraphicsSceneMouseEvent(QEvent::Type, const QPoint& pos, const QPoint& screenPos, Qt::MouseButton, Qt::MouseButtons, Qt::KeyboardModifiers);
     QGraphicsSceneWheelEvent* createGraphicsSceneWheelEvent(QEvent::Type, const QPoint& pos, const QPoint& screenPos, int delta, Qt::KeyboardModifiers, Qt::Orientation);
     void sendEvent(QObject* receiver, QEvent* event);
+    void postEvent(QObject* receiver, QEvent* event);
 
 private:
     void sendTouchEvent(QEvent::Type);
diff --git a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
index 3cced7d..008190f 100644
--- a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
+++ b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
@@ -35,7 +35,6 @@
 #include "WorkQueueItemQt.h"
 #include <QDir>
 #include <QLocale>
-#include <qwebscriptworld.h>
 #include <qwebsettings.h>
 
 LayoutTestController::LayoutTestController(WebCore::DumpRenderTree* drt)
@@ -54,6 +53,7 @@ void LayoutTestController::reset()
     m_textDump = false;
     m_dumpBackForwardList = false;
     m_dumpChildrenAsText = false;
+    m_dumpChildFrameScrollPositions = false;
     m_canOpenWindows = false;
     m_waitForDone = false;
     m_dumpTitleChanges = false;
@@ -65,14 +65,18 @@ void LayoutTestController::reset()
     m_handleErrorPages = false;
     m_webHistory = 0;
     m_globalFlag = false;
+    m_userStyleSheetEnabled = false;
     m_desktopNotificationAllowedOrigins.clear();
 
     DumpRenderTreeSupportQt::dumpEditingCallbacks(false);
     DumpRenderTreeSupportQt::dumpFrameLoader(false);
     DumpRenderTreeSupportQt::dumpResourceLoadCallbacks(false);
+    DumpRenderTreeSupportQt::dumpResourceResponseMIMETypes(false);
     DumpRenderTreeSupportQt::setWillSendRequestReturnsNullOnRedirect(false);
     DumpRenderTreeSupportQt::setWillSendRequestReturnsNull(false);
     DumpRenderTreeSupportQt::setWillSendRequestClearHeaders(QStringList());
+    DumpRenderTreeSupportQt::clearScriptWorlds();
+    DumpRenderTreeSupportQt::setCustomPolicyDelegate(false, false);
     setIconDatabaseEnabled(false);
 
     emit hidePage();
@@ -225,6 +229,11 @@ void LayoutTestController::dumpResourceLoadCallbacks()
     DumpRenderTreeSupportQt::dumpResourceLoadCallbacks(true);
 }
 
+void LayoutTestController::dumpResourceResponseMIMETypes()
+{
+    DumpRenderTreeSupportQt::dumpResourceResponseMIMETypes(true);
+}
+
 void LayoutTestController::setWillSendRequestReturnsNullOnRedirect(bool enabled)
 {
     DumpRenderTreeSupportQt::setWillSendRequestReturnsNullOnRedirect(enabled);
@@ -490,6 +499,11 @@ void LayoutTestController::removeOriginAccessWhitelistEntry(const QString& sourc
     DumpRenderTreeSupportQt::removeWhiteListAccessFromOrigin(sourceOrigin, destinationProtocol, destinationHost, allowDestinationSubdomains);
 }
 
+void LayoutTestController::setCustomPolicyDelegate(bool enabled, bool permissive)
+{
+    DumpRenderTreeSupportQt::setCustomPolicyDelegate(enabled, permissive);
+}
+
 void LayoutTestController::waitForPolicyDelegate()
 {
     m_waitForPolicy = true;
@@ -524,6 +538,9 @@ void LayoutTestController::overridePreference(const QString& name, const QVarian
 void LayoutTestController::setUserStyleSheetLocation(const QString& url)
 {
     m_userStyleSheetLocation = QUrl(url);
+
+    if (m_userStyleSheetEnabled)
+        setUserStyleSheetEnabled(true);
 }
 
 void LayoutTestController::setCaretBrowsingEnabled(bool value)
@@ -533,6 +550,8 @@ void LayoutTestController::setCaretBrowsingEnabled(bool value)
 
 void LayoutTestController::setUserStyleSheetEnabled(bool enabled)
 {
+    m_userStyleSheetEnabled = enabled;
+
     if (enabled)
         m_drt->webPage()->settings()->setUserStyleSheetUrl(m_userStyleSheetLocation);
     else
@@ -665,16 +684,7 @@ void LayoutTestController::setMockGeolocationPosition(double latitude, double lo
 
 void LayoutTestController::evaluateScriptInIsolatedWorld(int worldID, const QString& script)
 {
-    QWebScriptWorld* scriptWorld;
-    if (!worldID) {
-        scriptWorld = new QWebScriptWorld();
-    } else if (!m_worldMap.contains(worldID)) {
-        scriptWorld = new QWebScriptWorld();
-        m_worldMap.insert(worldID, scriptWorld);
-    } else
-        scriptWorld = m_worldMap.value(worldID);
-
-    m_drt->webPage()->mainFrame()->evaluateScriptInIsolatedWorld(scriptWorld, script);
+    DumpRenderTreeSupportQt::evaluateScriptInIsolatedWorld(m_drt->webPage()->mainFrame(), worldID, script);
 }
 
 const unsigned LayoutTestController::maxViewWidth = 800;
diff --git a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
index b56f1c9..ed1a232 100644
--- a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
+++ b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
@@ -62,6 +62,7 @@ public:
     bool shouldDumpAsText() const { return m_textDump; }
     bool shouldDumpBackForwardList() const { return m_dumpBackForwardList; }
     bool shouldDumpChildrenAsText() const { return m_dumpChildrenAsText; }
+    bool shouldDumpChildFrameScrollPositions() const { return m_dumpChildFrameScrollPositions; }
     bool shouldDumpDatabaseCallbacks() const { return m_dumpDatabaseCallbacks; }
     bool shouldDumpStatusCallbacks() const { return m_dumpStatusCallbacks; }
     bool shouldWaitUntilDone() const { return m_waitForDone; }
@@ -88,6 +89,7 @@ public slots:
     void maybeDump(bool ok);
     void dumpAsText() { m_textDump = true; }
     void dumpChildFramesAsText() { m_dumpChildrenAsText = true; }
+    void dumpChildFrameScrollPositions() { m_dumpChildFrameScrollPositions = true; }
     void dumpDatabaseCallbacks() { m_dumpDatabaseCallbacks = true; }
     void dumpStatusCallbacks() { m_dumpStatusCallbacks = true; }
     void setCanOpenWindows() { m_canOpenWindows = true; }
@@ -103,6 +105,7 @@ public slots:
     void dumpEditingCallbacks();
     void dumpFrameLoadCallbacks();
     void dumpResourceLoadCallbacks();
+    void dumpResourceResponseMIMETypes();
     void setWillSendRequestReturnsNullOnRedirect(bool enabled);
     void setWillSendRequestReturnsNull(bool enabled);
     void setWillSendRequestClearHeader(const QStringList& headers);
@@ -171,7 +174,9 @@ public slots:
     void clearAllDatabases();
     void setIconDatabaseEnabled(bool enable);
 
+    void setCustomPolicyDelegate(bool enabled, bool permissive = true);
     void waitForPolicyDelegate();
+
     void overridePreference(const QString& name, const QVariant& value);
     void setUserStyleSheetLocation(const QString& url);
     void setUserStyleSheetEnabled(bool enabled);
@@ -194,6 +199,9 @@ public slots:
     bool isGeolocationPermissionSet() const { return m_isGeolocationPermissionSet; }
     bool geolocationPermission() const { return m_geolocationPermission; }
 
+    // Empty stub method to keep parity with object model exposed by global LayoutTestController.
+    void abortModal() {}
+
     /*
         Policy values: 'on', 'auto' or 'off'.
         Orientation values: 'vertical' or 'horizontal'.
@@ -218,6 +226,7 @@ private:
     bool m_textDump;
     bool m_dumpBackForwardList;
     bool m_dumpChildrenAsText;
+    bool m_dumpChildFrameScrollPositions;
     bool m_canOpenWindows;
     bool m_waitForDone;
     bool m_dumpTitleChanges;
@@ -227,10 +236,10 @@ private:
     bool m_handleErrorPages;
     bool m_loadFinished;
     bool m_globalFlag;
+    bool m_userStyleSheetEnabled;
     bool m_isGeolocationPermissionSet;
     bool m_geolocationPermission;
 
-    QMap<int, QWebScriptWorld*> m_worldMap;
     QUrl m_userStyleSheetLocation;
     QBasicTimer m_timeoutTimer;
     QWebFrame* m_topLoadingFrame;
diff --git a/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp b/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
index e0d5731..df96328 100644
--- a/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
+++ b/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
@@ -617,8 +617,14 @@ static bool resolveCygwinPath(const wstring& cygwinPath, wstring& windowsPath)
     DWORD keyType;
     DWORD result = ::SHGetValueW(HKEY_LOCAL_MACHINE, TEXT("SOFTWARE\\Cygnus Solutions\\Cygwin\\mounts v2\\/"), TEXT("native"), &keyType, &rootPath, &rootPathSize);
 
-    if (result != ERROR_SUCCESS || keyType != REG_SZ)
-        return false;
+    if (result != ERROR_SUCCESS || keyType != REG_SZ) {
+        // Cygwin 1.7 doesn't store Cygwin's root as a mount point anymore, because mount points are now stored in /etc/fstab.
+        // However, /etc/fstab doesn't contain any information about where / is located as a Windows path, so we need to use Cygwin's
+        // new registry key that has the root.
+        result = ::SHGetValueW(HKEY_LOCAL_MACHINE, TEXT("SOFTWARE\\Cygwin\\setup"), TEXT("rootdir"), &keyType, &rootPath, &rootPathSize);
+        if (result != ERROR_SUCCESS || keyType != REG_SZ)
+            return false;
+    }
 
     windowsPath = wstring(rootPath, rootPathSize);
 
@@ -1254,13 +1260,7 @@ bool LayoutTestController::isPageBoxVisible(int pageNumber) const
     return false;
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::pageAreaRectInPixels(int pageNumber) const
-{
-    // FIXME: implement
-    return JSRetainPtr<JSStringRef>();
-}
-
-JSRetainPtr<JSStringRef> LayoutTestController::preferredPageSizeInPixels(int pageNumber) const
+JSRetainPtr<JSStringRef> LayoutTestController::pageSizeAndMarginsInPixels(int pageNumber, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft) const
 {
     // FIXME: implement
     return JSRetainPtr<JSStringRef>();
@@ -1308,3 +1308,7 @@ void LayoutTestController::setEditingBehavior(const char* editingBehavior)
     if (behaviorString == "win")
         preferences->setEditingBehavior(WebKitEditingWinBehavior);
 }
+
+void LayoutTestController::abortModal()
+{
+}
diff --git a/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp b/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
index 90ddea8..511eb81 100644
--- a/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
+++ b/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
@@ -452,6 +452,10 @@ void LayoutTestController::setEditingBehavior(const char* editingBehavior)
     // FIXME: Implement
 }
 
+void LayoutTestController::abortModal()
+{
+}
+
 JSRetainPtr<JSStringRef> LayoutTestController::pageProperty(const char* propertyName, int pageNumber) const
 {
 
@@ -463,14 +467,9 @@ bool LayoutTestController::isPageBoxVisible(int pageNumber) const
     return true;
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::pageAreaRectInPixels(int pageNumber) const
+JSRetainPtr<JSStringRef> LayoutTestController::pageSizeAndMarginsInPixels(int pageNumber, int width, int height, int marginTop, int marginRight, int marginBottom, int marginLeft) const
 {
     // FIXME: Implement
     return 0;
 }
 
-JSRetainPtr<JSStringRef> LayoutTestController::preferredPageSizeInPixels(int pageNumber) const
-{
-    // FIXME: Implement
-    return 0;
-}
diff --git a/WebKitTools/GNUmakefile.am b/WebKitTools/GNUmakefile.am
index 4425196..473b510 100644
--- a/WebKitTools/GNUmakefile.am
+++ b/WebKitTools/GNUmakefile.am
@@ -6,6 +6,7 @@ noinst_PROGRAMS += \
 Programs_GtkLauncher_CPPFLAGS = \
 	-I$(srcdir)/WebKit/gtk \
 	-I$(top_builddir)/WebKit/gtk \
+	-I$(top_builddir)/DerivedSources \
 	$(global_cppflags) \
 	$(javascriptcore_cppflags)
 
@@ -20,7 +21,7 @@ Programs_GtkLauncher_CFLAGS = \
 	$(LIBSOUP_CFLAGS)
 
 Programs_GtkLauncher_LDADD = \
-	libwebkit-1.0.la \
+	libwebkitgtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
 	$(GTK_LIBS) \
 	$(GLIB_LIBS)
 
@@ -34,6 +35,7 @@ dumprendertree_cppflags := \
 	-I$(srcdir)/WebKitTools/DumpRenderTree/gtk \
 	-I$(srcdir)/WebKit/gtk \
 	-I$(top_builddir)/WebKit/gtk \
+	-I$(top_builddir)/DerivedSources \
 	$(global_cppflags) \
 	$(javascriptcore_cppflags)
 
@@ -81,7 +83,7 @@ Programs_DumpRenderTree_CFLAGS = \
 	$(LIBSOUP_CFLAGS)
 
 Programs_DumpRenderTree_LDADD = \
-	libwebkit-1.0.la \
+	libwebkitgtk-@WEBKITGTK_API_MAJOR_VERSION@.@WEBKITGTK_API_MINOR_VERSION@.la \
 	libJavaScriptCore.la \
 	$(GLOBALDEPS_LIBS) \
 	$(CAIRO_LIBS) \
diff --git a/WebKitTools/MiniBrowser/mac/AppDelegate.m b/WebKitTools/MiniBrowser/mac/AppDelegate.m
index efc9b37..2805157 100644
--- a/WebKitTools/MiniBrowser/mac/AppDelegate.m
+++ b/WebKitTools/MiniBrowser/mac/AppDelegate.m
@@ -31,7 +31,7 @@
 #import <WebKit2/WKStringCF.h>
 #import <WebKit2/WKContextPrivate.h>
 
-static NSString *defaultURL = @"file:///Users/andersca/Desktop/t.html";
+static NSString *defaultURL = @"http://www.webkit.org/";
 
 @implementation BrowserAppDelegate
 
@@ -153,4 +153,44 @@ void _didRecieveMessageFromInjectedBundle(WKContextRef context, WKStringRef mess
     processPageNamespace = 0;
 }
 
+- (BrowserWindowController *)frontmostBrowserWindowController
+{
+    NSArray* windows = [NSApp windows];
+    for (NSWindow* window in windows) {
+        id delegate = [window delegate];
+        if ([delegate isKindOfClass:[BrowserWindowController class]])
+            return (BrowserWindowController *)delegate;
+    }
+
+    return 0;
+}
+
+- (IBAction)openDocument:(id)sender
+{
+    NSOpenPanel *openPanel = [[NSOpenPanel openPanel] retain];
+    [openPanel beginForDirectory:nil
+        file:nil
+        types:nil
+        modelessDelegate:self
+        didEndSelector:@selector(openPanelDidEnd:returnCode:contextInfo:)
+        contextInfo:0];
+}
+
+- (void)openPanelDidEnd:(NSOpenPanel *)sheet returnCode:(int)returnCode contextInfo:(void *)contextInfo
+{
+    [sheet autorelease];
+    if (returnCode != NSOKButton || ![[sheet filenames] count])
+        return;
+    
+    NSString* filePath = [[sheet filenames] objectAtIndex:0];
+
+    BrowserWindowController *controller = [self frontmostBrowserWindowController];
+    if (!controller) {
+        controller = [[BrowserWindowController alloc] initWithPageNamespace:[self getCurrentPageNamespace]];
+        [[controller window] makeKeyAndOrderFront:self];
+    }
+    
+    [controller loadURLString:[[NSURL fileURLWithPath:filePath] absoluteString]];
+}
+
 @end
diff --git a/WebKitTools/MiniBrowser/mac/English.lproj/BrowserWindow.xib b/WebKitTools/MiniBrowser/mac/English.lproj/BrowserWindow.xib
index dbd4344..64c4999 100644
--- a/WebKitTools/MiniBrowser/mac/English.lproj/BrowserWindow.xib
+++ b/WebKitTools/MiniBrowser/mac/English.lproj/BrowserWindow.xib
@@ -2,17 +2,16 @@
 <archive type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="7.10">
 	<data>
 		<int key="IBDocument.SystemTarget">1060</int>
-		<string key="IBDocument.SystemVersion">10D573</string>
-		<string key="IBDocument.InterfaceBuilderVersion">740</string>
+		<string key="IBDocument.SystemVersion">10F569</string>
+		<string key="IBDocument.InterfaceBuilderVersion">800</string>
 		<string key="IBDocument.AppKitVersion">1038.29</string>
-		<string key="IBDocument.HIToolboxVersion">460.00</string>
+		<string key="IBDocument.HIToolboxVersion">461.00</string>
 		<object class="NSMutableDictionary" key="IBDocument.PluginVersions">
 			<string key="NS.key.0">com.apple.InterfaceBuilder.CocoaPlugin</string>
-			<string key="NS.object.0">740</string>
+			<string key="NS.object.0">800</string>
 		</object>
 		<object class="NSMutableArray" key="IBDocument.EditedObjectIDs">
 			<bool key="EncodedWithXMLCoder">YES</bool>
-			<integer value="2"/>
 		</object>
 		<object class="NSArray" key="IBDocument.PluginDependencies">
 			<bool key="EncodedWithXMLCoder">YES</bool>
@@ -46,7 +45,7 @@
 				<string key="NSWindowTitle">Window</string>
 				<string key="NSWindowClass">NSWindow</string>
 				<nil key="NSViewClass"/>
-				<string key="NSWindowContentMaxSize">{1.79769e+308, 1.79769e+308}</string>
+				<string key="NSWindowContentMaxSize">{3.40282e+38, 3.40282e+38}</string>
 				<object class="NSView" key="NSWindowView" id="1006">
 					<reference key="NSNextResponder"/>
 					<int key="NSvFlags">256</int>
@@ -57,6 +56,7 @@
 							<int key="NSvFlags">274</int>
 							<string key="NSFrameSize">{776, 608}</string>
 							<reference key="NSSuperview" ref="1006"/>
+							<reference key="NSWindow"/>
 							<int key="NSViewLayerContentsRedrawPolicy">2</int>
 							<string key="NSClassName">NSView</string>
 						</object>
@@ -65,6 +65,7 @@
 							<int key="NSvFlags">266</int>
 							<string key="NSFrame">{{45, 618}, {699, 22}}</string>
 							<reference key="NSSuperview" ref="1006"/>
+							<reference key="NSWindow"/>
 							<int key="NSViewLayerContentsRedrawPolicy">2</int>
 							<bool key="NSEnabled">YES</bool>
 							<object class="NSTextFieldCell" key="NSCell" id="1023147716">
@@ -104,6 +105,7 @@
 							<object class="NSPSMatrix" key="NSDrawMatrix"/>
 							<string key="NSFrame">{{752, 621}, {16, 16}}</string>
 							<reference key="NSSuperview" ref="1006"/>
+							<reference key="NSWindow"/>
 							<int key="NSpiFlags">28936</int>
 							<double key="NSMaxValue">1</double>
 						</object>
@@ -112,6 +114,7 @@
 							<int key="NSvFlags">268</int>
 							<string key="NSFrame">{{8, 616}, {29, 25}}</string>
 							<reference key="NSSuperview" ref="1006"/>
+							<reference key="NSWindow"/>
 							<bool key="NSEnabled">YES</bool>
 							<object class="NSButtonCell" key="NSCell" id="366486485">
 								<int key="NSCellFlags">-2080244224</int>
@@ -134,10 +137,12 @@
 					</object>
 					<string key="NSFrameSize">{776, 658}</string>
 					<reference key="NSSuperview"/>
+					<reference key="NSWindow"/>
 					<int key="NSViewLayerContentsRedrawPolicy">2</int>
 				</object>
 				<string key="NSScreenRect">{{0, 0}, {1920, 1178}}</string>
-				<string key="NSMaxSize">{1.79769e+308, 1.79769e+308}</string>
+				<string key="NSMaxSize">{3.40282e+38, 3.40282e+38}</string>
+				<string key="NSFrameAutosaveName">Main Window</string>
 			</object>
 		</object>
 		<object class="IBObjectContainer" key="IBDocument.Objects">
@@ -368,12 +373,52 @@
 						<object class="NSArray" key="dict.sortedKeys">
 							<bool key="EncodedWithXMLCoder">YES</bool>
 							<string>fetch:</string>
+							<string>forceRepaint:</string>
 							<string>reload:</string>
+							<string>removeReinsertWebView:</string>
+							<string>showHideWebView:</string>
 						</object>
 						<object class="NSMutableArray" key="dict.values">
 							<bool key="EncodedWithXMLCoder">YES</bool>
 							<string>id</string>
 							<string>id</string>
+							<string>id</string>
+							<string>id</string>
+							<string>id</string>
+						</object>
+					</object>
+					<object class="NSMutableDictionary" key="actionInfosByName">
+						<bool key="EncodedWithXMLCoder">YES</bool>
+						<object class="NSArray" key="dict.sortedKeys">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<string>fetch:</string>
+							<string>forceRepaint:</string>
+							<string>reload:</string>
+							<string>removeReinsertWebView:</string>
+							<string>showHideWebView:</string>
+						</object>
+						<object class="NSMutableArray" key="dict.values">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<object class="IBActionInfo">
+								<string key="name">fetch:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">forceRepaint:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">reload:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">removeReinsertWebView:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">showHideWebView:</string>
+								<string key="candidateClassName">id</string>
+							</object>
 						</object>
 					</object>
 					<object class="NSMutableDictionary" key="outlets">
@@ -393,6 +438,35 @@
 							<string>NSTextField</string>
 						</object>
 					</object>
+					<object class="NSMutableDictionary" key="toOneOutletInfosByName">
+						<bool key="EncodedWithXMLCoder">YES</bool>
+						<object class="NSArray" key="dict.sortedKeys">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<string>containerView</string>
+							<string>progressIndicator</string>
+							<string>reloadButton</string>
+							<string>urlText</string>
+						</object>
+						<object class="NSMutableArray" key="dict.values">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<object class="IBToOneOutletInfo">
+								<string key="name">containerView</string>
+								<string key="candidateClassName">NSView</string>
+							</object>
+							<object class="IBToOneOutletInfo">
+								<string key="name">progressIndicator</string>
+								<string key="candidateClassName">NSProgressIndicator</string>
+							</object>
+							<object class="IBToOneOutletInfo">
+								<string key="name">reloadButton</string>
+								<string key="candidateClassName">NSButton</string>
+							</object>
+							<object class="IBToOneOutletInfo">
+								<string key="name">urlText</string>
+								<string key="candidateClassName">NSTextField</string>
+							</object>
+						</object>
+					</object>
 					<object class="IBClassDescriptionSource" key="sourceIdentifier">
 						<string key="majorKey">IBProjectSource</string>
 						<string key="minorKey">mac/BrowserWindowController.h</string>
@@ -846,6 +920,13 @@
 						<string key="NS.key.0">showWindow:</string>
 						<string key="NS.object.0">id</string>
 					</object>
+					<object class="NSMutableDictionary" key="actionInfosByName">
+						<string key="NS.key.0">showWindow:</string>
+						<object class="IBActionInfo" key="NS.object.0">
+							<string key="name">showWindow:</string>
+							<string key="candidateClassName">id</string>
+						</object>
+					</object>
 					<object class="IBClassDescriptionSource" key="sourceIdentifier">
 						<string key="majorKey">IBFrameworkSource</string>
 						<string key="minorKey">AppKit.framework/Headers/NSWindowController.h</string>
@@ -854,6 +935,7 @@
 			</object>
 		</object>
 		<int key="IBDocument.localizationMode">0</int>
+		<string key="IBDocument.TargetRuntimeIdentifier">IBCocoaFramework</string>
 		<object class="NSMutableDictionary" key="IBDocument.PluginDeclaredDependencyDefaults">
 			<string key="NS.key.0">com.apple.InterfaceBuilder.CocoaPlugin.macosx</string>
 			<integer value="1060" key="NS.object.0"/>
@@ -865,5 +947,9 @@
 		<bool key="IBDocument.PluginDeclaredDependenciesTrackSystemTargetVersion">YES</bool>
 		<string key="IBDocument.LastKnownRelativeProjectPath">../../MiniBrowser.xcodeproj</string>
 		<int key="IBDocument.defaultPropertyAccessControl">3</int>
+		<object class="NSMutableDictionary" key="IBDocument.LastKnownImageSizes">
+			<string key="NS.key.0">NSRefreshTemplate</string>
+			<string key="NS.object.0">{10, 12}</string>
+		</object>
 	</data>
 </archive>
diff --git a/WebKitTools/MiniBrowser/mac/MiniBrowser_Prefix.pch b/WebKitTools/MiniBrowser/mac/MiniBrowser_Prefix.pch
index faa14fc..cb8ceae 100644
--- a/WebKitTools/MiniBrowser/mac/MiniBrowser_Prefix.pch
+++ b/WebKitTools/MiniBrowser/mac/MiniBrowser_Prefix.pch
@@ -33,4 +33,4 @@
 #define LOG NSLog
 #else
 #define LOG(...) ((void)0)
-#endif
\ No newline at end of file
+#endif
diff --git a/WebKitTools/MiniBrowser/mac/WebBundle/WebBundleMain.m b/WebKitTools/MiniBrowser/mac/WebBundle/WebBundleMain.m
index f52c98e..d7f2e36 100644
--- a/WebKitTools/MiniBrowser/mac/WebBundle/WebBundleMain.m
+++ b/WebKitTools/MiniBrowser/mac/WebBundle/WebBundleMain.m
@@ -25,6 +25,7 @@
 
 #include <Cocoa/Cocoa.h>
 #include <WebKit2/WKBundle.h>
+#include <WebKit2/WKBundleFrame.h>
 #include <WebKit2/WKBundleInitialize.h>
 #include <WebKit2/WKBundlePage.h>
 #include <WebKit2/WKString.h>
@@ -66,7 +67,7 @@ void _didReceiveTitleForFrame(WKBundlePageRef page, WKStringRef title, WKBundleF
 
 void _didClearWindowForFrame(WKBundlePageRef page, WKBundleFrameRef frame, JSContextRef ctx, JSObjectRef window, const void *clientInfo)
 {
-    CFURLRef cfURL = WKURLCopyCFURL(0, WKBundlePageGetMainFrameURL(page));
+    CFURLRef cfURL = WKURLCopyCFURL(0, WKBundleFrameGetURL(WKBundlePageGetMainFrame(page)));
     LOG(@"WKBundlePageClient - _didClearWindowForFrame %@", [(NSURL *)cfURL absoluteString]);
     CFRelease(cfURL);
 
diff --git a/WebKitTools/QtTestBrowser/mainwindow.cpp b/WebKitTools/QtTestBrowser/mainwindow.cpp
index 941ef79..c5cf15c 100644
--- a/WebKitTools/QtTestBrowser/mainwindow.cpp
+++ b/WebKitTools/QtTestBrowser/mainwindow.cpp
@@ -51,9 +51,12 @@ void MainWindow::buildUI()
 #if defined(Q_WS_S60)
     bar->setIconSize(QSize(16, 16));
 #endif
+    QAction* reloadAction = page()->action(QWebPage::Reload);
+    connect(reloadAction, SIGNAL(triggered()), this, SLOT(changeLocation()));
+
     bar->addAction(page()->action(QWebPage::Back));
     bar->addAction(page()->action(QWebPage::Forward));
-    bar->addAction(page()->action(QWebPage::Reload));
+    bar->addAction(reloadAction);
     bar->addAction(page()->action(QWebPage::Stop));
 
     urlEdit = new LocationEdit(this);
@@ -142,6 +145,13 @@ void MainWindow::load(const QUrl& url)
 void MainWindow::changeLocation()
 {
     QString string = urlEdit->text();
+    QUrl mainFrameURL = page()->mainFrame()->url();
+
+    if (mainFrameURL.isValid() && string == mainFrameURL.toString()) {
+        page()->triggerAction(QWebPage::Reload);
+        return;
+    }
+
     load(string);
 }
 
diff --git a/WebKitTools/QtTestBrowser/webview.cpp b/WebKitTools/QtTestBrowser/webview.cpp
index 1467cf8..d06493e 100644
--- a/WebKitTools/QtTestBrowser/webview.cpp
+++ b/WebKitTools/QtTestBrowser/webview.cpp
@@ -192,14 +192,14 @@ void WebViewTraditional::mousePressEvent(QMouseEvent* event)
 void GraphicsWebView::contextMenuEvent(QGraphicsSceneContextMenuEvent* event)
 {
     QMenu* menu = createContextMenu(page(), event->pos().toPoint());
-    menu->exec(mapToScene(event->pos()).toPoint());
+    menu->exec(event->screenPos());
     delete menu;
 }
 
 void WebViewTraditional::contextMenuEvent(QContextMenuEvent* event)
 {
     QMenu* menu = createContextMenu(page(), event->pos());
-    menu->exec(mapToGlobal(event->pos()));
+    menu->exec(event->globalPos());
     delete menu;
 }
 
diff --git a/WebKitTools/Scripts/build-webkit b/WebKitTools/Scripts/build-webkit
index 88765e8..2934b21 100755
--- a/WebKitTools/Scripts/build-webkit
+++ b/WebKitTools/Scripts/build-webkit
@@ -59,9 +59,9 @@ my ($threeDCanvasSupport, $threeDRenderingSupport, $channelMessagingSupport, $cl
     $domStorageSupport, $eventsourceSupport, $filtersSupport, $geolocationSupport, $iconDatabaseSupport, $imageResizerSupport, $indexedDatabaseSupport, $inputSpeechSupport,
     $javaScriptDebuggerSupport, $mathmlSupport, $offlineWebApplicationSupport, $rubySupport, $systemMallocSupport, $sandboxSupport, $sharedWorkersSupport,
     $svgSupport, $svgAnimationSupport, $svgAsImageSupport, $svgDOMObjCBindingsSupport, $svgFontsSupport,
-    $svgForeignObjectSupport, $svgUseSupport, $videoSupport, $webSocketsSupport, $wmlSupport, $wcssSupport, $xhtmlmpSupport, $workersSupport,
+    $svgForeignObjectSupport, $svgUseSupport, $videoSupport, $webSocketsSupport, $webTimingSupport, $wmlSupport, $wcssSupport, $xhtmlmpSupport, $workersSupport,
     $xpathSupport, $xsltSupport, $coverageSupport, $notificationsSupport, $blobSliceSupport, $tiledBackingStoreSupport,
-    $fileReaderSupport, $fileWriterSupport);
+    $fileReaderSupport, $fileWriterSupport, $directoryUploadSupport);
 
 my @features = (
     { option => "3d-canvas", desc => "Toggle 3D canvas support",
@@ -91,6 +91,9 @@ my @features = (
     { option => "datalist", desc => "Toggle HTML5 datalist support",
       define => "ENABLE_DATALIST", default => 1, value => \$datalistSupport },
           
+    { option => "directory-upload", desc => "Toogle Directory upload support",
+      define => "ENABLE_DIRECTORY_UPLOAD", default => 0, value => \$directoryUploadSupport },
+
     { option => "dom-storage", desc => "Toggle DOM Storage Support",
       define => "ENABLE_DOM_STORAGE", default => 1, value => \$domStorageSupport },
 
@@ -169,6 +172,9 @@ my @features = (
     { option => "web-sockets", desc => "Toggle Web Sockets support",
       define => "ENABLE_WEB_SOCKETS", default => 1, value=> \$webSocketsSupport },
 
+    { option => "web-timing", desc => "Toggle Web Timing support",
+      define => "ENABLE_WEB_TIMING", default => 0, value=> \$webTimingSupport },
+
     { option => "wml", desc => "Toggle WML support",
       define => "ENABLE_WML", default => 0, value => \$wmlSupport },
 
diff --git a/WebKitTools/Scripts/build-webkittestrunner b/WebKitTools/Scripts/build-webkittestrunner
new file mode 100755
index 0000000..bb059e1
--- /dev/null
+++ b/WebKitTools/Scripts/build-webkittestrunner
@@ -0,0 +1,68 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2010 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+use strict;
+use File::Basename;
+use FindBin;
+use Getopt::Long qw(:config pass_through);
+use lib $FindBin::Bin;
+use webkitdirs;
+use POSIX;
+
+my $showHelp = 0;
+my $clean = 0;
+
+my $programName = basename($0);
+my $usage = <<EOF;
+Usage: $programName [options] [options to pass to build system]
+  --help        Show this help message
+  --clean       Clean up the build directory
+EOF
+
+GetOptions(
+    'help' => \$showHelp,
+    'clean' => \$clean,
+);
+
+if ($showHelp) {
+   print STDERR $usage;
+   exit 1;
+}
+
+checkRequiredSystemConfig();
+setConfiguration();
+chdirWebKit();
+
+# Build
+chdir "WebKitTools/WebKitTestRunner" or die;
+
+my $result;
+if (isAppleMacWebKit()) {
+    $result = buildXCodeProject("WebKitTestRunner", $clean, XcodeOptions(), @ARGV);
+} else {
+    die "WebKitTestRunner is not supported on this platform.\n";
+}
+
+exit exitStatus($result);
diff --git a/WebKitTools/Scripts/debug-test-runner b/WebKitTools/Scripts/debug-test-runner
new file mode 100755
index 0000000..5a9b7f9
--- /dev/null
+++ b/WebKitTools/Scripts/debug-test-runner
@@ -0,0 +1,35 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2010 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# Simplified "debug" script for debugging the WebKitTestRunner.
+
+use strict;
+use FindBin;
+use lib $FindBin::Bin;
+use webkitdirs;
+
+setConfiguration();
+
+exit exitStatus(debugWebKitTestRunner());
diff --git a/WebKitTools/Scripts/num-cpus b/WebKitTools/Scripts/num-cpus
index ede9995..8a8c97f 100755
--- a/WebKitTools/Scripts/num-cpus
+++ b/WebKitTools/Scripts/num-cpus
@@ -1,3 +1,6 @@
-#!/bin/bash
-# Assumes cygwin.
-ls /proc/registry/HKEY_LOCAL_MACHINE/HARDWARE/DESCRIPTION/System/CentralProcessor | wc -w
+#!/usr/bin/perl -w
+use strict;
+use FindBin;
+use lib $FindBin::Bin;
+use webkitdirs;
+print numberOfCPUs() . "\n";
diff --git a/WebKitTools/Scripts/old-run-webkit-tests b/WebKitTools/Scripts/old-run-webkit-tests
index a25a24d..0e705a9 100755
--- a/WebKitTools/Scripts/old-run-webkit-tests
+++ b/WebKitTools/Scripts/old-run-webkit-tests
@@ -1,6 +1,6 @@
 #!/usr/bin/perl
 
-# Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+# Copyright (C) 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
 # Copyright (C) 2006 Alexey Proskuryakov (ap@nypop.com)
 # Copyright (C) 2007 Matt Lilek (pewtermoose@gmail.com)
 # Copyright (C) 2007 Eric Seidel <eric@webkit.org>
@@ -165,6 +165,7 @@ my $useRemoteLinksToTests = 0;
 my $useValgrind = 0;
 my $verbose = 0;
 my $shouldWaitForHTTPD = 0;
+my $useWebKitTestRunner = 0;
 
 my @leaksFilenames;
 
@@ -279,6 +280,7 @@ Usage: $programName [options] [testdir|testpath ...]
   -v|--verbose                    More verbose output (overrides --quiet)
   -m|--merge-leak-depth arg       Merges leak callStacks and prints the number of unique leaks beneath a callstack depth of arg.  Defaults to 5.
   --use-remote-links-to-tests     Link to test files within the SVN repository in the results.
+  --webkit-test-runner            Use WebKitTestRunner rather than DumpRenderTree.
 EOF
 
 setConfiguration();
@@ -321,6 +323,7 @@ my $getOptionsResult = GetOptions(
     'use-remote-links-to-tests' => \$useRemoteLinksToTests,
     'valgrind' => \$useValgrind,
     'verbose|v' => \$verbose,
+    'webkit-test-runner' => \$useWebKitTestRunner,
 );
 
 if (!$getOptionsResult || $showHelp) {
@@ -354,8 +357,11 @@ $productDir .= "/Programs" if isGtk();
 
 chdirWebKit();
 
+my $dumpToolName = $useWebKitTestRunner ? "WebKitTestRunner" : "DumpRenderTree";
+
 if (!defined($root)) {
-    print STDERR "Running build-dumprendertree\n";
+    my $dumpToolBuildScript =  "build-" . lc($dumpToolName);
+    print STDERR "Running $dumpToolBuildScript\n";
 
     local *DEVNULL;
     my ($childIn, $childOut, $childErr);
@@ -370,7 +376,7 @@ if (!defined($root)) {
     }
 
     my @args = argumentsForConfiguration();
-    my $buildProcess = open3($childIn, $childOut, $childErr, "WebKitTools/Scripts/build-dumprendertree", @args) or die "Failed to run build-dumprendertree";
+    my $buildProcess = open3($childIn, $childOut, $childErr, "WebKitTools/Scripts/$dumpToolBuildScript", @args) or die "Failed to run build-dumprendertree";
     close($childIn);
     waitpid $buildProcess, 0;
     my $buildResult = $?;
@@ -380,12 +386,11 @@ if (!defined($root)) {
     close DEVNULL if ($quiet);
 
     if ($buildResult) {
-        print STDERR "Compiling DumpRenderTree failed!\n";
+        print STDERR "Compiling $dumpToolName failed!\n";
         exit exitStatus($buildResult);
     }
 }
 
-my $dumpToolName = "DumpRenderTree";
 $dumpToolName .= "_debug" if isCygwin() && configurationForVisualStudio() !~ /^Release|Debug_Internal$/;
 my $dumpTool = "$productDir/$dumpToolName";
 die "can't find executable $dumpToolName (looked in $productDir)\n" unless -x $dumpTool;
diff --git a/WebKitTools/Scripts/run-test-runner b/WebKitTools/Scripts/run-test-runner
new file mode 100755
index 0000000..98fa3b6
--- /dev/null
+++ b/WebKitTools/Scripts/run-test-runner
@@ -0,0 +1,35 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2010 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# Simplified "run" script for launching the WebKit2 WebKitTestRunner.
+
+use strict;
+use FindBin;
+use lib $FindBin::Bin;
+use webkitdirs;
+
+setConfiguration();
+
+exit exitStatus(runWebKitTestRunner());
diff --git a/WebKitTools/Scripts/test-html5-parser b/WebKitTools/Scripts/test-html5-parser
index 5b935b8..eb9bab4 100755
--- a/WebKitTools/Scripts/test-html5-parser
+++ b/WebKitTools/Scripts/test-html5-parser
@@ -60,7 +60,6 @@ system("WebKitTools/Scripts/build-dumprendertree", @args) == 0 or die "Failed to
 
 my @tests = (
     "html5lib/runner",
-    "html5lib/webkit-resumer",
 );
 
 foreach my $test (@tests) {
@@ -69,7 +68,7 @@ foreach my $test (@tests) {
     my $testPath = "LayoutTests/$test.html";
     my $expectedPath = "LayoutTests/$test-expected-html5.txt";
     my $actualPath = "LayoutTests/$test-actual-html5.txt";
-    my $command = "DYLD_FRAMEWORK_PATH=$productDir $dumpTool --html5-parser $testPath";
+    my $command = "DYLD_FRAMEWORK_PATH=$productDir $dumpTool --html5-treebuilder $testPath";
     print $command, "\n";
     my $output = `$command`;
     writeToFile($actualPath, $output);
diff --git a/WebKitTools/Scripts/webkitdirs.pm b/WebKitTools/Scripts/webkitdirs.pm
index 46d2cbf..9f54c3e 100644
--- a/WebKitTools/Scripts/webkitdirs.pm
+++ b/WebKitTools/Scripts/webkitdirs.pm
@@ -1,4 +1,4 @@
-# Copyright (C) 2005, 2006, 2007 Apple Inc. All rights reserved.
+# Copyright (C) 2005, 2006, 2007, 2010 Apple Inc. All rights reserved.
 # Copyright (C) 2009 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
@@ -50,6 +50,7 @@ BEGIN {
 our @EXPORT_OK;
 
 my $architecture;
+my $numberOfCPUs;
 my $baseProductDir;
 my @baseProductDirOption;
 my $configuration;
@@ -229,6 +230,28 @@ sub determineArchitecture
     }
 }
 
+sub determineNumberOfCPUs
+{
+    return if defined $numberOfCPUs;
+    if (isLinux()) {
+        # First try the nproc utility, if it exists. If we get no
+        # results fall back to just interpretting /proc directly.
+        $numberOfCPUs = `nproc 2> /dev/null`;
+        if ($numberOfCPUs eq "") {
+            $numberOfCPUs = (grep /processor/, `cat /proc/cpuinfo`);
+        }
+    } elsif (isWindows() || isCygwin()) {
+        if (defined($ENV{NUMBER_OF_PROCESSORS})) {
+            $numberOfCPUs = $ENV{NUMBER_OF_PROCESSORS};
+        } else {
+            # Assumes cygwin
+            $numberOfCPUs = `ls /proc/registry/HKEY_LOCAL_MACHINE/HARDWARE/DESCRIPTION/System/CentralProcessor | wc -w`;
+        }
+    } elsif (isDarwin()) {
+        $numberOfCPUs = `sysctl -n hw.ncpu`;
+    }
+}
+
 sub jscPath($)
 {
     my ($productDir) = @_;
@@ -468,6 +491,12 @@ sub architecture()
     return $architecture;
 }
 
+sub numberOfCPUs()
+{
+    determineNumberOfCPUs();
+    return $numberOfCPUs;
+}
+
 sub setArchitecture
 {
     if (my $arch = shift @_) {
@@ -566,7 +595,7 @@ sub builtDylibPathForName
         return "$configurationProductDir/libwxwebkit.dylib";
     }
     if (isGtk()) {
-        return "$configurationProductDir/$libraryName/../.libs/libwebkit-1.0.so";
+        return "$configurationProductDir/$libraryName/../.libs/libwebkitgtk-1.0.so";
     }
     if (isEfl()) {
         return "$configurationProductDir/$libraryName/../.libs/libewebkit.so";
@@ -687,8 +716,6 @@ sub determineIsSymbian()
         $isSymbian = 1;
         return;
     }
-
-    $isSymbian = defined($ENV{'EPOCROOT'});
 }
 
 sub determineIsEfl()
@@ -1260,6 +1287,12 @@ sub buildAutotoolsProject($@)
         }
     }
 
+    # Automatically determine the number of CPUs for make only
+    # if make arguments haven't already been specified.
+    if ($makeArgs eq "") {
+        $makeArgs = "-j" . numberOfCPUs();
+    }
+
     $prefix = $ENV{"WebKitInstallationPrefix"} if !defined($prefix);
     push @buildArgs, "--prefix=" . $prefix if defined($prefix);
 
@@ -1443,7 +1476,7 @@ sub buildChromiumMakefile($$)
         return system qw(rm -rf out);
     }
     my $config = configuration();
-    my $numCpus = (grep /processor/, `cat /proc/cpuinfo`) || 1;
+    my $numCpus = numberOfCPUs();
     my @command = ("make", "-fMakefile.chromium", "-j$numCpus", "BUILDTYPE=$config", $target);
     print join(" ", @command) . "\n";
     return system @command;
@@ -1493,6 +1526,9 @@ sub buildChromium($@)
 {
     my ($clean, @options) = @_;
 
+    # We might need to update DEPS or re-run GYP if things have changed.
+    system("perl", "WebKitTools/Scripts/update-webkit-chromium") == 0 or die $!;
+
     my $result = 1;
     if (isDarwin()) {
         # Mac build - builds the root xcode project.
@@ -1610,4 +1646,43 @@ sub debugMiniBrowser
     return 1;
 }
 
+sub runWebKitTestRunner
+{
+    if (isAppleMacWebKit()) {
+        my $productDir = productDir();
+        print "Starting WebKitTestRunner with DYLD_FRAMEWORK_PATH set to point to $productDir.\n";
+        $ENV{DYLD_FRAMEWORK_PATH} = $productDir;
+        $ENV{WEBKIT_UNSET_DYLD_FRAMEWORK_PATH} = "YES";
+        my $webKitTestRunnerPath = "$productDir/WebKitTestRunner";
+        if (!isTiger() && architecture()) {
+            return system "arch", "-" . architecture(), $webKitTestRunnerPath, @ARGV;
+        } else {
+            return system $webKitTestRunnerPath, @ARGV;
+        }
+    }
+
+    return 1;
+}
+
+sub debugWebKitTestRunner
+{
+    if (isAppleMacWebKit()) {
+        my $gdbPath = "/usr/bin/gdb";
+        die "Can't find gdb executable. Is gdb installed?\n" unless -x $gdbPath;
+
+        my $productDir = productDir();
+        $ENV{DYLD_FRAMEWORK_PATH} = $productDir;
+        $ENV{WEBKIT_UNSET_DYLD_FRAMEWORK_PATH} = 'YES';
+
+        my $webKitTestRunnerPath = "$productDir/WebKitTestRunner";
+
+        print "Starting WebKitTestRunner under gdb with DYLD_FRAMEWORK_PATH set to point to $productDir.\n";
+        my @architectureFlags = ("-arch", architecture()) if !isTiger();
+        exec $gdbPath, @architectureFlags, $webKitTestRunnerPath or die;
+        return;
+    }
+
+    return 1;
+}
+
 1;
diff --git a/WebKitTools/Scripts/webkitpy/common/checkout/scm.py b/WebKitTools/Scripts/webkitpy/common/checkout/scm.py
index fc4c6fd..d7c621c 100644
--- a/WebKitTools/Scripts/webkitpy/common/checkout/scm.py
+++ b/WebKitTools/Scripts/webkitpy/common/checkout/scm.py
@@ -31,6 +31,8 @@
 
 import os
 import re
+import sys
+import shutil
 
 from webkitpy.common.system.executive import Executive, run_command, ScriptError
 from webkitpy.common.system.user import User
@@ -166,82 +168,95 @@ class SCM:
         return match.group('svn_revision')
 
     @staticmethod
+    def _subclass_must_implement():
+        raise NotImplementedError("subclasses must implement")
+
+    @staticmethod
     def in_working_directory(path):
-        raise NotImplementedError, "subclasses must implement"
+        SCM._subclass_must_implement()
 
     @staticmethod
     def find_checkout_root(path):
-        raise NotImplementedError, "subclasses must implement"
+        SCM._subclass_must_implement()
 
     @staticmethod
     def commit_success_regexp():
-        raise NotImplementedError, "subclasses must implement"
+        SCM._subclass_must_implement()
 
     def working_directory_is_clean(self):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def clean_working_directory(self):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def status_command(self):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
-    def add(self, path):
-        raise NotImplementedError, "subclasses must implement"
+    def add(self, path, return_exit_code=False):
+        self._subclass_must_implement()
+
+    def delete(self, path):
+        self._subclass_must_implement()
 
     def changed_files(self, git_commit=None, squash=None):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def changed_files_for_revision(self):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def added_files(self):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def conflicted_files(self):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def display_name(self):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def create_patch(self, git_commit=None, squash=None):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def committer_email_for_revision(self, revision):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def contents_at_revision(self, path, revision):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def diff_for_revision(self, revision):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
+
+    def diff_for_file(self, path, log=None):
+        self._subclass_must_implement()
+
+    def show_head(self, path):
+        self._subclass_must_implement()
 
     def apply_reverse_diff(self, revision):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def revert_files(self, file_paths):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def should_squash(self, squash):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def commit_with_message(self, message, username=None, git_commit=None, squash=None):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def svn_commit_log(self, svn_revision):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     def last_svn_commit_log(self):
-        raise NotImplementedError, "subclasses must implement"
+        self._subclass_must_implement()
 
     # Subclasses must indicate if they support local commits,
     # but the SCM baseclass will only call local_commits methods when this is true.
     @staticmethod
     def supports_local_commits():
-        raise NotImplementedError, "subclasses must implement"
+        SCM._subclass_must_implement()
 
     def remote_merge_base():
-        raise NotImplementedError, "subclasses must implement"
+        SCM._subclass_must_implement()
 
     def commit_locally_with_message(self, message):
         error("Your source control manager does not support local commits.")
@@ -261,7 +276,8 @@ class SVN(SCM):
     def __init__(self, cwd):
         SCM.__init__(self, cwd)
         self.cached_version = None
-    
+        self._bogus_dir = None
+
     @staticmethod
     def in_working_directory(path):
         return os.path.isdir(os.path.join(path, '.svn'))
@@ -343,9 +359,23 @@ class SVN(SCM):
         field_count = 6 if self.svn_version() > "1.6" else 5
         return "^(?P<status>[%s]).{%s} (?P<filename>.+)$" % (expected_types, field_count)
 
-    def add(self, path):
-        # path is assumed to be cwd relative?
-        self.run(["svn", "add", path])
+    def _add_parent_directories(self, path):
+        """Does 'svn add' to the path and its parents."""
+        if self.in_working_directory(path):
+            return
+        dirname = os.path.dirname(path)
+        # We have dirname directry - ensure it added.
+        if dirname != path:
+            self._add_parent_directories(dirname)
+        self.add(path)
+
+    def add(self, path, return_exit_code=False):
+        self._add_parent_directories(os.path.dirname(os.path.abspath(path)))
+        return self.run(["svn", "add", path], return_exit_code=return_exit_code)
+
+    def delete(self, path):
+        parent, base = os.path.split(os.path.abspath(path))
+        return self.run(["svn", "delete", "--force", base], cwd=parent)
 
     def changed_files(self, git_commit=None, squash=None):
         return self.run_status_and_extract_filenames(self.status_command(), self._status_regexp("ACDMR"))
@@ -362,6 +392,9 @@ class SVN(SCM):
     def added_files(self):
         return self.run_status_and_extract_filenames(self.status_command(), self._status_regexp("A"))
 
+    def deleted_files(self):
+        return self.run_status_and_extract_filenames(self.status_command(), self._status_regexp("D"))
+
     @staticmethod
     def supports_local_commits():
         return False
@@ -391,6 +424,44 @@ class SVN(SCM):
         # FIXME: This should probably use cwd=self.checkout_root
         return self.run(['svn', 'diff', '-c', revision])
 
+    def _bogus_dir_name(self):
+        if sys.platform.startswith("win"):
+            parent_dir = tempfile.gettempdir()
+        else:
+            parent_dir = sys.path[0]  # tempdir is not secure.
+        return os.path.join(parent_dir, "temp_svn_config")
+
+    def _setup_bogus_dir(self, log):
+        self._bogus_dir = self._bogus_dir_name()
+        if not os.path.exists(self._bogus_dir):
+            os.mkdir(self._bogus_dir)
+            self._delete_bogus_dir = True
+        else:
+            self._delete_bogus_dir = False
+        if log:
+            log.debug('  Html: temp config dir: "%s".', self._bogus_dir)
+
+    def _teardown_bogus_dir(self, log):
+        if self._delete_bogus_dir:
+            shutil.rmtree(self._bogus_dir, True)
+            if log:
+                log.debug('  Html: removed temp config dir: "%s".', self._bogus_dir)
+        self._bogus_dir = None
+
+    def diff_for_file(self, path, log=None):
+        self._setup_bogus_dir(log)
+        try:
+            args = ['svn', 'diff']
+            if self._bogus_dir:
+                args += ['--config-dir', self._bogus_dir]
+            args.append(path)
+            return self.run(args)
+        finally:
+            self._teardown_bogus_dir(log)
+
+    def show_head(self, path):
+        return self.run(['svn', 'cat', '-r', 'BASE', path], decode_output=False)
+
     def _repository_url(self):
         return self.value_from_svn_info(self.checkout_root, 'URL')
 
@@ -435,6 +506,14 @@ class SVN(SCM):
         # http://svnbook.red-bean.com/en/1.0/ch03s03.html
         return self.svn_commit_log('BASE')
 
+    def propset(self, pname, pvalue, path):
+        dir, base = os.path.split(path)
+        return self.run(['svn', 'pset', pname, pvalue, base], cwd=dir)
+
+    def propget(self, pname, path):
+        dir, base = os.path.split(path)
+        return self.run(['svn', 'pget', pname, base], cwd=dir).encode('utf-8').rstrip("\n")
+
 # All git-specific logic should go here.
 class Git(SCM):
     def __init__(self, cwd):
@@ -447,13 +526,18 @@ class Git(SCM):
     @classmethod
     def find_checkout_root(cls, path):
         # "git rev-parse --show-cdup" would be another way to get to the root
-        (checkout_root, dot_git) = os.path.split(run_command(['git', 'rev-parse', '--git-dir'], cwd=path))
+        (checkout_root, dot_git) = os.path.split(run_command(['git', 'rev-parse', '--git-dir'], cwd=(path or "./")))
         # If we were using 2.6 # checkout_root = os.path.relpath(checkout_root, path)
         if not os.path.isabs(checkout_root): # Sometimes git returns relative paths
             checkout_root = os.path.join(path, checkout_root)
         return checkout_root
 
     @classmethod
+    def to_object_name(cls, filepath):
+        root_end_with_slash = os.path.join(cls.find_checkout_root(os.path.dirname(filepath)), '')
+        return filepath.replace(root_end_with_slash, '')
+
+    @classmethod
     def read_git_config(cls, key):
         # FIXME: This should probably use cwd=self.checkout_root.
         return run_command(["git", "config", key],
@@ -494,9 +578,11 @@ class Git(SCM):
     def _status_regexp(self, expected_types):
         return '^(?P<status>[%s])\t(?P<filename>.+)$' % expected_types
 
-    def add(self, path):
-        # path is assumed to be cwd relative?
-        self.run(["git", "add", path])
+    def add(self, path, return_exit_code=False):
+        return self.run(["git", "add", path], return_exit_code=return_exit_code)
+
+    def delete(self, path):
+        return self.run(["git", "rm", "-f", path])
 
     def _merge_base(self, git_commit, squash):
         if git_commit:
@@ -537,6 +623,9 @@ class Git(SCM):
     def added_files(self):
         return self.run_status_and_extract_filenames(self.status_command(), self._status_regexp("A"))
 
+    def deleted_files(self):
+        return self.run_status_and_extract_filenames(self.status_command(), self._status_regexp("D"))
+
     @staticmethod
     def supports_local_commits():
         return True
@@ -569,6 +658,12 @@ class Git(SCM):
         git_commit = self.git_commit_from_svn_revision(revision)
         return self.create_patch(git_commit)
 
+    def diff_for_file(self, path, log=None):
+        return self.run(['git', 'diff', 'HEAD', '--', path])
+
+    def show_head(self, path):
+        return self.run(['git', 'show', 'HEAD:' + self.to_object_name(path)], decode_output=False)
+
     def committer_email_for_revision(self, revision):
         git_commit = self.git_commit_from_svn_revision(revision)
         committer_email = self.run(["git", "log", "-1", "--pretty=format:%ce", git_commit])
diff --git a/WebKitTools/Scripts/webkitpy/common/checkout/scm_unittest.py b/WebKitTools/Scripts/webkitpy/common/checkout/scm_unittest.py
index 36a1d1c..eaa3b46 100644
--- a/WebKitTools/Scripts/webkitpy/common/checkout/scm_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/common/checkout/scm_unittest.py
@@ -40,6 +40,7 @@ import subprocess
 import tempfile
 import unittest
 import urllib
+import shutil
 
 from datetime import date
 from webkitpy.common.checkout.api import Checkout
@@ -63,8 +64,12 @@ def run_silent(args, cwd=None):
 
 
 def write_into_file_at_path(file_path, contents, encoding="utf-8"):
-    with codecs.open(file_path, "w", encoding) as file:
-        file.write(contents)
+    if encoding:
+        with codecs.open(file_path, "w", encoding) as file:
+            file.write(contents)
+    else:
+        with open(file_path, "w") as file:
+            file.write(contents)
 
 
 def read_from_path(file_path, encoding="utf-8"):
@@ -388,6 +393,11 @@ OcmYex&reD$;sO8*F9L)B
         # Cannot delete again.
         self.assertRaises(ScriptError, self.checkout.apply_patch, self._create_patch(git_binary_deletion))
 
+    def _shared_test_add_recursively(self):
+        os.mkdir("added_dir")
+        write_into_file_at_path("added_dir/added_file", "new stuff")
+        self.scm.add("added_dir/added_file")
+        self.assertTrue("added_dir/added_file" in self.scm.added_files())
 
 class SVNTest(SCMTest):
 
@@ -632,6 +642,60 @@ Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==
     def test_committer_email_for_revision(self):
         self._shared_test_committer_email_for_revision()
 
+    def test_add_recursively(self):
+        self._shared_test_add_recursively()
+
+    def test_delete(self):
+        os.chdir(self.svn_checkout_path)
+        self.scm.delete("test_file")
+        self.assertTrue("test_file" in self.scm.deleted_files())
+
+    def test_propset_propget(self):
+        filepath = os.path.join(self.svn_checkout_path, "test_file")
+        expected_mime_type = "x-application/foo-bar"
+        self.scm.propset("svn:mime-type", expected_mime_type, filepath)
+        self.assertEqual(expected_mime_type, self.scm.propget("svn:mime-type", filepath))
+
+    def test_show_head(self):
+        write_into_file_at_path("test_file", u"Hello!", "utf-8")
+        SVNTestRepository._svn_commit("fourth commit")
+        self.assertEqual("Hello!", self.scm.show_head('test_file'))
+
+    def test_show_head_binary(self):
+        data = "\244"
+        write_into_file_at_path("binary_file", data, encoding=None)
+        self.scm.add("binary_file")
+        self.scm.commit_with_message("a test commit")
+        self.assertEqual(data, self.scm.show_head('binary_file'))
+
+    def do_test_diff_for_file(self):
+        write_into_file_at_path('test_file', 'some content')
+        self.scm.commit_with_message("a test commit")
+        diff = self.scm.diff_for_file('test_file')
+        self.assertEqual(diff, "")
+
+        write_into_file_at_path("test_file", "changed content")
+        diff = self.scm.diff_for_file('test_file')
+        self.assertTrue("-some content" in diff)
+        self.assertTrue("+changed content" in diff)
+
+    def clean_bogus_dir(self):
+        self.bogus_dir = self.scm._bogus_dir_name()
+        if os.path.exists(self.bogus_dir):
+            shutil.rmtree(self.bogus_dir)
+
+    def test_diff_for_file_with_existing_bogus_dir(self):
+        self.clean_bogus_dir()
+        os.mkdir(self.bogus_dir)
+        self.do_test_diff_for_file()
+        self.assertTrue(os.path.exists(self.bogus_dir))
+        shutil.rmtree(self.bogus_dir)
+
+    def test_diff_for_file_with_missing_bogus_dir(self):
+        self.clean_bogus_dir()
+        self.do_test_diff_for_file()
+        self.assertFalse(os.path.exists(self.bogus_dir))
+
 
 class GitTest(SCMTest):
 
@@ -1098,6 +1162,46 @@ class GitSVNTest(SCMTest):
     def test_committer_email_for_revision(self):
         self._shared_test_committer_email_for_revision()
 
+    def test_add_recursively(self):
+        self._shared_test_add_recursively()
+
+    def test_delete(self):
+        self._two_local_commits()
+        self.scm.delete('test_file_commit1')
+        self.assertTrue("test_file_commit1" in self.scm.deleted_files())
+
+    def test_to_object_name(self):
+        relpath = 'test_file_commit1'
+        fullpath = os.path.join(self.git_checkout_path, relpath)
+        self._two_local_commits()
+        self.assertEqual(relpath, self.scm.to_object_name(fullpath))
+
+    def test_show_head(self):
+        self._two_local_commits()
+        self.assertEqual("more test content", self.scm.show_head('test_file_commit1'))
+
+    def test_show_head_binary(self):
+        self._two_local_commits()
+        data = "\244"
+        write_into_file_at_path("binary_file", data, encoding=None)
+        self.scm.add("binary_file")
+        self.scm.commit_locally_with_message("a test commit")
+        self.assertEqual(data, self.scm.show_head('binary_file'))
+
+    def test_diff_for_file(self):
+        self._two_local_commits()
+        write_into_file_at_path('test_file_commit1', "Updated", encoding=None)
+
+        diff = self.scm.diff_for_file('test_file_commit1')
+        cached_diff = self.scm.diff_for_file('test_file_commit1')
+        self.assertTrue("+Updated" in diff)
+        self.assertTrue("-more test content" in diff)
+
+        self.scm.add('test_file_commit1')
+
+        cached_diff = self.scm.diff_for_file('test_file_commit1')
+        self.assertTrue("+Updated" in cached_diff)
+        self.assertTrue("-more test content" in cached_diff)
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py b/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
index f11b8a9..35f32d4 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
@@ -58,7 +58,9 @@ import urllib
 import webbrowser
 import zipfile
 
-from webkitpy.common.system.executive import run_command
+from webkitpy.common.system.executive import run_command, ScriptError
+from webkitpy.common.checkout.scm import detect_scm_system
+import webkitpy.common.checkout.scm as scm
 
 import port
 from layout_package import test_expectations
@@ -68,9 +70,6 @@ from test_types import text_diff
 _log = logging.getLogger("webkitpy.layout_tests."
                          "rebaseline_chromium_webkit_tests")
 
-# Repository type constants.
-REPO_SVN, REPO_UNKNOWN = range(2)
-
 BASELINE_SUFFIXES = ['.txt', '.png', '.checksum']
 REBASELINE_PLATFORM_ORDER = ['mac', 'win', 'win-xp', 'win-vista', 'linux']
 ARCHIVE_DIR_NAME_DICT = {'win': 'webkit-rel',
@@ -241,8 +240,7 @@ class Rebaseliner(object):
                                                self._platform,
                                                False,
                                                False)
-
-        self._repo_type = self._get_repo_type()
+        self._scm = detect_scm_system(os.getcwd())
 
     def run(self, backup):
         """Run rebaseline process."""
@@ -285,15 +283,6 @@ class Rebaseliner(object):
     def get_rebaselining_tests(self):
         return self._rebaselining_tests
 
-    # FIXME: Callers should use scm.py instead.
-    def _get_repo_type(self):
-        """Get the repository type that client is using."""
-        return_code = run_command(['svn', 'info'], return_exit_code=True)
-        if return_code == 0:
-            return REPO_SVN
-
-        return REPO_UNKNOWN
-
     def _compile_rebaselining_tests(self):
         """Compile list of tests that need rebaselining for the platform.
 
@@ -371,6 +360,9 @@ class Rebaseliner(object):
           None on failure
         """
 
+        if self._options.force_archive_url:
+            return self._options.force_archive_url
+
         dir_name = self._get_archive_dir_name(self._platform,
                                               self._options.webkit_canary)
         if not dir_name:
@@ -431,7 +423,7 @@ class Rebaseliner(object):
             _log.info('Test %d: %s', test_no, test)
 
             found = False
-            svn_error = False
+            scm_error = False
             test_basename = os.path.splitext(test)[0]
             for suffix in BASELINE_SUFFIXES:
                 archive_test_name = ('layout-test-results/%s-actual%s' %
@@ -480,16 +472,17 @@ class Rebaseliner(object):
 
                 shutil.move(temp_name, expected_fullpath)
 
-                if not self._svn_add(expected_fullpath):
-                    svn_error = True
+                if 0 != self._scm.add(expected_fullpath, return_exit_code=True):
+                    # FIXME: print detailed diagnose messages
+                    scm_error = True
                 elif suffix != '.checksum':
                     self._create_html_baseline_files(expected_fullpath)
 
             if not found:
                 _log.warn('  No new baselines found in archive.')
             else:
-                if svn_error:
-                    _log.warn('  Failed to add baselines to SVN.')
+                if scm_error:
+                    _log.warn('  Failed to add baselines to your repository.')
                 else:
                     _log.info('  Rebaseline succeeded.')
                     self._rebaselined_tests.append(test)
@@ -572,15 +565,7 @@ class Rebaseliner(object):
 
         if not filename or not os.path.isfile(filename):
             return
-
-        if self._repo_type == REPO_SVN:
-            parent_dir, basename = os.path.split(filename)
-            original_dir = os.getcwd()
-            os.chdir(parent_dir)
-            run_shell(['svn', 'delete', '--force', basename], False)
-            os.chdir(original_dir)
-        else:
-            os.remove(filename)
+        self._scm.delete(filename)
 
     def _update_rebaselined_tests_in_file(self, backup):
         """Update the rebaselined tests in test expectations file.
@@ -609,91 +594,10 @@ class Rebaseliner(object):
             # Or is new_expectations always a byte array?
             with open(path, "w") as file:
                 file.write(new_expectations)
+            self._scm.add(path)
         else:
             _log.info('No test was rebaselined so nothing to remove.')
 
-    # FIXME: Callers should move to SCM.add instead.
-    def _svn_add(self, filename):
-        """Add the file to SVN repository.
-
-        Args:
-          filename: full path of the file to add.
-
-        Returns:
-          True if the file already exists in SVN or is sucessfully added
-               to SVN.
-          False otherwise.
-        """
-
-        if not filename:
-            return False
-
-        parent_dir, basename = os.path.split(filename)
-        if self._repo_type != REPO_SVN or parent_dir == filename:
-            _log.info("No svn checkout found, skip svn add.")
-            return True
-
-        original_dir = os.getcwd()
-        os.chdir(parent_dir)
-        status_output = run_shell(['svn', 'status', basename], False)
-        os.chdir(original_dir)
-        output = status_output.upper()
-        if output.startswith('A') or output.startswith('M'):
-            _log.info('  File already added to SVN: "%s"', filename)
-            return True
-
-        if output.find('IS NOT A WORKING COPY') >= 0:
-            _log.info('  File is not a working copy, add its parent: "%s"',
-                      parent_dir)
-            return self._svn_add(parent_dir)
-
-        os.chdir(parent_dir)
-        add_output = run_shell(['svn', 'add', basename], True)
-        os.chdir(original_dir)
-        output = add_output.upper().rstrip()
-        if output.startswith('A') and output.find(basename.upper()) >= 0:
-            _log.info('  Added new file: "%s"', filename)
-            self._svn_prop_set(filename)
-            return True
-
-        if (not status_output) and (add_output.upper().find(
-            'ALREADY UNDER VERSION CONTROL') >= 0):
-            _log.info('  File already under SVN and has no change: "%s"',
-                      filename)
-            return True
-
-        _log.warn('  Failed to add file to SVN: "%s"', filename)
-        _log.warn('  Svn status output: "%s"', status_output)
-        _log.warn('  Svn add output: "%s"', add_output)
-        return False
-
-    def _svn_prop_set(self, filename):
-        """Set the baseline property
-
-        Args:
-          filename: full path of the file to add.
-
-        Returns:
-          True if the file already exists in SVN or is sucessfully added
-               to SVN.
-          False otherwise.
-        """
-        ext = os.path.splitext(filename)[1].upper()
-        if ext != '.TXT' and ext != '.PNG' and ext != '.CHECKSUM':
-            return
-
-        parent_dir, basename = os.path.split(filename)
-        original_dir = os.getcwd()
-        os.chdir(parent_dir)
-        if ext == '.PNG':
-            cmd = ['svn', 'pset', 'svn:mime-type', 'image/png', basename]
-        else:
-            cmd = ['svn', 'pset', 'svn:eol-style', 'LF', basename]
-
-        _log.debug('  Set svn prop: %s', ' '.join(cmd))
-        run_shell(cmd, False)
-        os.chdir(original_dir)
-
     def _create_html_baseline_files(self, baseline_fullpath):
         """Create baseline files (old, new and diff) in html directory.
 
@@ -715,8 +619,13 @@ class Rebaseliner(object):
         _log.info('  Html: copied new baseline file from "%s" to "%s".',
                   baseline_fullpath, new_file)
 
-        # Get the old baseline from SVN and save to the html directory.
-        output = run_shell(['svn', 'cat', '-r', 'BASE', baseline_fullpath])
+        # Get the old baseline from the repository and save to the html directory.
+        try:
+            output = self._scm.show_head(baseline_fullpath)
+        except ScriptError, e:
+            _log.info(e)
+            output = ""
+
         if (not output) or (output.upper().rstrip().endswith(
             'NO SUCH FILE OR DIRECTORY')):
             _log.info('  No base file: "%s"', baseline_fullpath)
@@ -733,27 +642,7 @@ class Rebaseliner(object):
 
         # Get the diff between old and new baselines and save to the html dir.
         if baseline_filename.upper().endswith('.TXT'):
-            # If the user specified a custom diff command in their svn config
-            # file, then it'll be used when we do svn diff, which we don't want
-            # to happen since we want the unified diff.  Using --diff-cmd=diff
-            # doesn't always work, since they can have another diff executable
-            # in their path that gives different line endings.  So we use a
-            # bogus temp directory as the config directory, which gets
-            # around these problems.
-            if sys.platform.startswith("win"):
-                parent_dir = tempfile.gettempdir()
-            else:
-                parent_dir = sys.path[0]  # tempdir is not secure.
-            bogus_dir = os.path.join(parent_dir, "temp_svn_config")
-            _log.debug('  Html: temp config dir: "%s".', bogus_dir)
-            if not os.path.exists(bogus_dir):
-                os.mkdir(bogus_dir)
-                delete_bogus_dir = True
-            else:
-                delete_bogus_dir = False
-
-            output = run_shell(["svn", "diff", "--config-dir", bogus_dir,
-                               baseline_fullpath])
+            output = self._scm.diff_for_file(baseline_fullpath, log=_log)
             if output:
                 diff_file = get_result_file_fullpath(
                     self._options.html_directory, baseline_filename,
@@ -764,12 +653,6 @@ class Rebaseliner(object):
                 _log.info('  Html: created baseline diff file: "%s".',
                           diff_file)
 
-            if delete_bogus_dir:
-                shutil.rmtree(bogus_dir, True)
-                _log.debug('  Html: removed temp config dir: "%s".',
-                           bogus_dir)
-
-
 class HtmlGenerator(object):
     """Class to generate rebaselining result comparison html."""
 
@@ -1001,6 +884,10 @@ def main():
                              default=False,
                              help='include debug-level logging.')
 
+    option_parser.add_option('-q', '--quiet',
+                             action='store_true',
+                             help='Suppress result HTML viewing')
+
     option_parser.add_option('-p', '--platforms',
                              default='mac,win,win-xp,win-vista,linux',
                              help=('Comma delimited list of platforms '
@@ -1011,6 +898,9 @@ def main():
                                       'layout_test_results'),
                              help=('Url to find the layout test result archive'
                                    ' file.'))
+    option_parser.add_option('-U', '--force_archive_url',
+                             help=('Url of result zip file. This option is for debugging '
+                                   'purposes'))
 
     option_parser.add_option('-w', '--webkit_canary',
                              action='store_true',
@@ -1106,7 +996,8 @@ def main():
                                    rebaseline_platforms,
                                    rebaselining_tests)
     html_generator.generate_html()
-    html_generator.show_html()
+    if not options.quiet:
+        html_generator.show_html()
     log_dashed_string('Rebaselining result comparison done', None)
 
     sys.exit(0)
diff --git a/WebKitTools/Scripts/webkitpy/style/checker.py b/WebKitTools/Scripts/webkitpy/style/checker.py
index 5d75a1b..e3c56c5 100644
--- a/WebKitTools/Scripts/webkitpy/style/checker.py
+++ b/WebKitTools/Scripts/webkitpy/style/checker.py
@@ -205,7 +205,7 @@ _SKIPPED_FILES_WITH_WARNING = [
     # The Qt API and tests do not follow WebKit style.
     # They follow Qt style. :)
     "gtk2drawing.c", # WebCore/platform/gtk/gtk2drawing.c
-    "gtk2drawing.h", # WebCore/platform/gtk/gtk2drawing.h
+    "gtkdrawing.h", # WebCore/platform/gtk/gtkdrawing.h
     "JavaScriptCore/qt/api/",
     "WebKit/gtk/tests/",
     "WebKit/qt/Api/",
diff --git a/WebKitTools/Scripts/webkitpy/style/checker_unittest.py b/WebKitTools/Scripts/webkitpy/style/checker_unittest.py
index e99ac68..5254275 100755
--- a/WebKitTools/Scripts/webkitpy/style/checker_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/style/checker_unittest.py
@@ -281,10 +281,10 @@ class CheckerDispatcherSkipTest(unittest.TestCase):
         # Check skipped files.
         paths_to_skip = [
            "gtk2drawing.c",
-           "gtk2drawing.h",
+           "gtkdrawing.h",
            "JavaScriptCore/qt/api/qscriptengine_p.h",
            "WebCore/platform/gtk/gtk2drawing.c",
-           "WebCore/platform/gtk/gtk2drawing.h",
+           "WebCore/platform/gtk/gtkdrawing.h",
            "WebKit/gtk/tests/testatk.c",
            "WebKit/qt/Api/qwebpage.h",
            "WebKit/qt/tests/qwebsecurityorigin/tst_qwebsecurityorigin.cpp",
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/download.py b/WebKitTools/Scripts/webkitpy/tool/commands/download.py
index 17fb12c..59af16a 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/download.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/download.py
@@ -82,7 +82,6 @@ class Land(AbstractSequencedCommand):
         steps.EnsureBuildersAreGreen,
         steps.UpdateChangeLogsWithReviewer,
         steps.ValidateReviewer,
-        steps.EnsureBuildersAreGreen,
         steps.Build,
         steps.RunTests,
         steps.Commit,
@@ -243,7 +242,6 @@ class AbstractPatchLandingCommand(AbstractPatchSequencingCommand):
         steps.Update,
         steps.ApplyPatch,
         steps.ValidateReviewer,
-        steps.EnsureBuildersAreGreen,
         steps.Build,
         steps.RunTests,
         steps.Commit,
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/upload.py b/WebKitTools/Scripts/webkitpy/tool/commands/upload.py
index e682ca7..9c935e8 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/upload.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/upload.py
@@ -178,8 +178,13 @@ class Post(AbstractPatchUploadingCommand):
 
 class LandSafely(AbstractPatchUploadingCommand):
     name = "land-safely"
-    help_text = "Land the current diff via the commit-queue (Experimental)"
+    help_text = "Land the current diff via the commit-queue"
     argument_names = "[BUGID]"
+    long_help = """land-safely updates the ChangeLog with the reviewer listed
+    in bugs.webkit.org for BUGID (or the bug ID detected from the ChangeLog).
+    The command then uploads the current diff to the bug and marks it for
+    commit by the commit-queue."""
+    show_in_main_help = True
     steps = [
         steps.UpdateChangeLogsWithReviewer,
         steps.ObsoletePatches,
diff --git a/WebKitTools/Scripts/webkitpy/tool/steps/ensurebuildersaregreen.py b/WebKitTools/Scripts/webkitpy/tool/steps/ensurebuildersaregreen.py
index 40bc302..7b717ef 100644
--- a/WebKitTools/Scripts/webkitpy/tool/steps/ensurebuildersaregreen.py
+++ b/WebKitTools/Scripts/webkitpy/tool/steps/ensurebuildersaregreen.py
@@ -28,7 +28,7 @@
 
 from webkitpy.tool.steps.abstractstep import AbstractStep
 from webkitpy.tool.steps.options import Options
-from webkitpy.common.system.deprecated_logging import error
+from webkitpy.common.system.deprecated_logging import log, error
 
 
 class EnsureBuildersAreGreen(AbstractStep):
@@ -45,4 +45,6 @@ class EnsureBuildersAreGreen(AbstractStep):
         if not red_builders_names:
             return
         red_builders_names = map(lambda name: "\"%s\"" % name, red_builders_names) # Add quotes around the names.
-        error("Builders [%s] are red, please do not commit.\nSee http://%s.\nPass --ignore-builders to bypass this check." % (", ".join(red_builders_names), self._tool.buildbot.buildbot_host))
+        log("\nBuilders [%s] are red, please do not commit.\nSee http://%s/console?category=core\n" % (", ".join(red_builders_names), self._tool.buildbot.buildbot_host))
+        if not self._tool.user.confirm("Are you sure you want to continue?"):
+            error("User aborted.")
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ASCIICType.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ASCIICType.h
new file mode 100644
index 0000000..f2258d2
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ASCIICType.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/ASCIICType.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Assertions.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Assertions.h
new file mode 100644
index 0000000..2144410
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Assertions.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/Assertions.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Atomics.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Atomics.h
new file mode 100644
index 0000000..37b1892
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Atomics.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/Atomics.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/FastMalloc.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/FastMalloc.h
new file mode 100644
index 0000000..1701231
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/FastMalloc.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/FastMalloc.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashMap.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashMap.h
new file mode 100644
index 0000000..9f262e2
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashMap.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/HashMap.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashSet.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashSet.h
new file mode 100644
index 0000000..cfe2d80
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashSet.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/HashSet.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashTraits.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashTraits.h
new file mode 100644
index 0000000..412fa98
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashTraits.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/HashTraits.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Locker.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Locker.h
new file mode 100644
index 0000000..75b0acd
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Locker.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/Locker.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MainThread.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MainThread.h
new file mode 100644
index 0000000..ff75971
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MainThread.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/MainThread.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MathExtras.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MathExtras.h
new file mode 100644
index 0000000..2955786
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MathExtras.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/MathExtras.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Noncopyable.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Noncopyable.h
new file mode 100644
index 0000000..f8484d2
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Noncopyable.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/Noncopyable.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtr.h
new file mode 100644
index 0000000..9211d38
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtr.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/OwnPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtrCommon.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtrCommon.h
new file mode 100644
index 0000000..6064e88
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtrCommon.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/PassOwnPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassOwnPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassOwnPtr.h
new file mode 100644
index 0000000..6064e88
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassOwnPtr.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/PassOwnPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassRefPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassRefPtr.h
new file mode 100644
index 0000000..aafd1a2
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassRefPtr.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/PassRefPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Platform.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Platform.h
new file mode 100644
index 0000000..3b22955
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Platform.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/Platform.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefCounted.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefCounted.h
new file mode 100644
index 0000000..628a63b
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefCounted.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/RefCounted.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefPtr.h
new file mode 100644
index 0000000..0ff6213
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefPtr.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/RefPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RetainPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RetainPtr.h
new file mode 100644
index 0000000..65fc27b
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RetainPtr.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/RetainPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/StringExtras.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/StringExtras.h
new file mode 100644
index 0000000..063d500
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/StringExtras.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/StringExtras.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadSafeShared.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadSafeShared.h
new file mode 100644
index 0000000..4a7a77f
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadSafeShared.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/ThreadSafeShared.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Threading.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Threading.h
new file mode 100644
index 0000000..17359e5
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Threading.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/Threading.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadingPrimitives.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadingPrimitives.h
new file mode 100644
index 0000000..a7ee117
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadingPrimitives.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/ThreadingPrimitives.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Vector.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Vector.h
new file mode 100644
index 0000000..c6d15fd
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Vector.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/Vector.h>
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
new file mode 100644
index 0000000..63013fb
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
@@ -0,0 +1,117 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "InjectedBundle.h"
+
+#include "InjectedBundlePage.h"
+#include <WebKit2/WKBundle.h>
+#include <WebKit2/WKBundlePage.h>
+#include <WebKit2/WKRetainPtr.h>
+#include <WebKit2/WKStringCF.h>
+#include <WebKit2/WebKit2.h>
+#include <wtf/RetainPtr.h>
+
+namespace WTR {
+
+InjectedBundle& InjectedBundle::shared()
+{
+    static InjectedBundle& shared = *new InjectedBundle;
+    return shared;
+}
+
+InjectedBundle::InjectedBundle()
+    : m_bundle(0)
+    , m_layoutTestController(LayoutTestController::create(std::string("")))
+{
+}
+
+void InjectedBundle::_didCreatePage(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo)
+{
+    static_cast<InjectedBundle*>(const_cast<void*>(clientInfo))->didCreatePage(page);
+}
+
+void InjectedBundle::_willDestroyPage(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo)
+{
+    static_cast<InjectedBundle*>(const_cast<void*>(clientInfo))->willDestroyPage(page);
+}
+
+void InjectedBundle::_didRecieveMessage(WKBundleRef bundle, WKStringRef message, const void *clientInfo)
+{
+    static_cast<InjectedBundle*>(const_cast<void*>(clientInfo))->didRecieveMessage(message);
+}
+
+void InjectedBundle::initialize(WKBundleRef bundle)
+{
+    m_bundle = bundle;
+
+    WKBundleClient client = {
+        0,
+        this,
+        _didCreatePage,
+        _willDestroyPage,
+        _didRecieveMessage
+    };
+    WKBundleSetClient(m_bundle, &client);
+}
+
+void InjectedBundle::done()
+{
+    std::string output = m_outputStream.str();
+    RetainPtr<CFStringRef> outputCFString(AdoptCF, CFStringCreateWithCString(0, output.c_str(), kCFStringEncodingUTF8));
+    WKRetainPtr<WKStringRef> doneMessage(AdoptWK, WKStringCreateWithCFString(outputCFString.get()));
+    WKBundlePostMessage(m_bundle, doneMessage.get());
+}
+
+void InjectedBundle::didCreatePage(WKBundlePageRef page)
+{
+    m_pages.add(page, new InjectedBundlePage(page));
+}
+
+void InjectedBundle::willDestroyPage(WKBundlePageRef page)
+{
+    delete m_pages.take(page);
+}
+
+void InjectedBundle::didRecieveMessage(WKStringRef message)
+{
+    CFStringRef cfMessage = WKStringCopyCFString(0, message);
+    if (CFEqual(cfMessage, CFSTR("BeginTest"))) {
+        WKRetainPtr<WKStringRef> ackMessage(AdoptWK, WKStringCreateWithCFString(CFSTR("BeginTestAck")));
+        WKBundlePostMessage(m_bundle, ackMessage.get());
+
+        reset();
+        return;
+    }
+
+    WKRetainPtr<WKStringRef> errorMessage(AdoptWK, WKStringCreateWithCFString(CFSTR("Error: Unknown.")));
+    WKBundlePostMessage(m_bundle, errorMessage.get());
+}
+
+void InjectedBundle::reset()
+{
+    m_outputStream.str("");
+}
+
+} // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.h b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
new file mode 100644
index 0000000..33934cf
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InjectedBundle_h
+#define InjectedBundle_h
+
+#include "LayoutTestController.h"
+#include <WebKit2/WKBase.h>
+#include <WebKit2/WKBundleBase.h>
+#include <wtf/HashMap.h>
+#include <wtf/RefPtr.h>
+
+#include <sstream>
+
+namespace WTR {
+
+class InjectedBundlePage;
+
+class InjectedBundle {
+public:
+    static InjectedBundle& shared();
+
+    // Initialize the InjectedBundle.
+    void initialize(WKBundleRef);
+
+    void done();
+
+    LayoutTestController* layoutTestController() { return m_layoutTestController.get(); }
+
+    std::ostringstream& os() { return m_outputStream; }
+
+private:
+    InjectedBundle();
+    ~InjectedBundle();
+
+    static void _didCreatePage(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo);
+    static void _willDestroyPage(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo);
+    static void _didRecieveMessage(WKBundleRef bundle, WKStringRef message, const void *clientInfo);
+
+    void didCreatePage(WKBundlePageRef page);
+    void willDestroyPage(WKBundlePageRef page);
+    void didRecieveMessage(WKStringRef message);
+
+    void reset();
+
+    WKBundleRef m_bundle;
+    HashMap<WKBundlePageRef, InjectedBundlePage*> m_pages;
+
+    RefPtr<LayoutTestController> m_layoutTestController;
+
+    std::ostringstream m_outputStream;
+};
+
+} // namespace WTR
+
+#endif // InjectedBundle_h
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundleMain.cpp b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundleMain.cpp
index f108548..27779df 100644
--- a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundleMain.cpp
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundleMain.cpp
@@ -23,84 +23,10 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#include <WebKit2/WKBundle.h>
+#include "InjectedBundle.h"
 #include <WebKit2/WKBundleInitialize.h>
-#include <WebKit2/WKBundlePage.h>
-#include <WebKit2/WebKit2.h>
-
-static WKBundleRef globalBundle;
-
-// WKBundlePageClient
-
-void _didStartProvisionalLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
-{
-}
-
-void _didReceiveServerRedirectForProvisionalLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
-{
-}
-
-void _didFailProvisionalLoadWithErrorForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
-{
-}
-
-void _didCommitLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
-{
-}
-
-void _didFinishLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
-{
-}
-
-void _didFailLoadWithErrorForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
-{
-}
-
-void _didReceiveTitleForFrame(WKBundlePageRef page, WKStringRef title, WKBundleFrameRef frame, const void *clientInfo)
-{
-}
-
-void _didClearWindow(WKBundlePageRef page, WKBundleFrameRef frame, JSContextRef ctx, JSObjectRef window, const void *clientInfo)
-{
-}
-
-// WKBundleClient
-
-void _didCreatePage(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo)
-{
-    WKBundlePageClient client = {
-        0,
-        0,
-        _didStartProvisionalLoadForFrame,
-        _didReceiveServerRedirectForProvisionalLoadForFrame,
-        _didFailProvisionalLoadWithErrorForFrame,
-        _didCommitLoadForFrame,
-        _didFinishLoadForFrame,
-        _didFailLoadWithErrorForFrame,
-        _didReceiveTitleForFrame,
-        _didClearWindow
-    };
-    WKBundlePageSetClient(page, &client);
-}
-
-void _willDestroyPage(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo)
-{
-}
-
-void _didRecieveMessage(WKBundleRef bundle, WKStringRef message, const void *clientInfo)
-{
-}
 
 extern "C" void WKBundleInitialize(WKBundleRef bundle)
 {
-    globalBundle = bundle;
-
-    WKBundleClient client = {
-        0,
-        0,
-        _didCreatePage,
-        _willDestroyPage,
-        _didRecieveMessage
-    };
-    WKBundleSetClient(bundle, &client);
+    WTR::InjectedBundle::shared().initialize(bundle);
 }
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
new file mode 100644
index 0000000..cabb90d
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
@@ -0,0 +1,160 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "InjectedBundlePage.h"
+
+#include "InjectedBundle.h"
+#include <WebKit2/WKBundleFrame.h>
+#include <WebKit2/WKBundlePagePrivate.h>
+#include <WebKit2/WKRetainPtr.h>
+#include <WebKit2/WKString.h>
+#include <WebKit2/WKStringCF.h>
+#include <wtf/RetainPtr.h>
+#include <wtf/Vector.h>
+
+namespace WTR {
+
+InjectedBundlePage::InjectedBundlePage(WKBundlePageRef page)
+    : m_page(page)
+{
+    WKBundlePageClient client = {
+        0,
+        this,
+        _didStartProvisionalLoadForFrame,
+        _didReceiveServerRedirectForProvisionalLoadForFrame,
+        _didFailProvisionalLoadWithErrorForFrame,
+        _didCommitLoadForFrame,
+        _didFinishLoadForFrame,
+        _didFailLoadWithErrorForFrame,
+        _didReceiveTitleForFrame,
+        _didClearWindowForFrame
+    };
+    WKBundlePageSetClient(m_page, &client);
+}
+
+InjectedBundlePage::~InjectedBundlePage()
+{
+}
+
+void InjectedBundlePage::_didStartProvisionalLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
+{
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didStartProvisionalLoadForFrame(frame);
+}
+
+void InjectedBundlePage::_didReceiveServerRedirectForProvisionalLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
+{
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didReceiveServerRedirectForProvisionalLoadForFrame(frame);
+}
+
+void InjectedBundlePage::_didFailProvisionalLoadWithErrorForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
+{
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didFailProvisionalLoadWithErrorForFrame(frame);
+}
+
+void InjectedBundlePage::_didCommitLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
+{
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didCommitLoadForFrame(frame);
+}
+
+void InjectedBundlePage::_didFinishLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
+{
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didFinishLoadForFrame(frame);
+}
+
+void InjectedBundlePage::_didFailLoadWithErrorForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo)
+{
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didFailLoadWithErrorForFrame(frame);
+}
+
+void InjectedBundlePage::_didReceiveTitleForFrame(WKBundlePageRef page, WKStringRef title, WKBundleFrameRef frame, const void *clientInfo)
+{
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didReceiveTitleForFrame(title, frame);
+}
+
+void InjectedBundlePage::_didClearWindowForFrame(WKBundlePageRef page, WKBundleFrameRef frame, JSContextRef ctx, JSObjectRef window, const void *clientInfo)
+{
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didClearWindowForFrame(frame, ctx, window);
+}
+
+void InjectedBundlePage::didStartProvisionalLoadForFrame(WKBundleFrameRef frame)
+{
+}
+
+void InjectedBundlePage::didReceiveServerRedirectForProvisionalLoadForFrame(WKBundleFrameRef frame)
+{
+}
+
+void InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame(WKBundleFrameRef frame)
+{
+}
+
+void InjectedBundlePage::didCommitLoadForFrame(WKBundleFrameRef frame)
+{
+}
+
+static std::auto_ptr<Vector<char> > WKStringToUTF8(WKStringRef wkStringRef)
+{
+    RetainPtr<CFStringRef> cfString(AdoptCF, WKStringCopyCFString(0, wkStringRef));
+    CFIndex bufferLength = CFStringGetMaximumSizeForEncoding(CFStringGetLength(cfString.get()), kCFStringEncodingUTF8) + 1;
+    std::auto_ptr<Vector<char> > buffer(new Vector<char>(bufferLength));
+    if (!CFStringGetCString(cfString.get(), buffer->data(), bufferLength, kCFStringEncodingUTF8)) {
+        buffer->shrink(1);
+        (*buffer)[0] = 0;
+    } else
+        buffer->shrink(strlen(buffer->data()) + 1);
+    return buffer;
+}
+
+void InjectedBundlePage::didFinishLoadForFrame(WKBundleFrameRef frame)
+{
+    if (!WKBundleFrameIsMainFrame(frame))
+        return;
+
+    WKRetainPtr<WKStringRef> externalRepresentation(AdoptWK, WKBundlePageCopyRenderTreeExternalRepresentation(m_page));
+    std::auto_ptr<Vector<char> > utf8String = WKStringToUTF8(externalRepresentation.get());
+
+    InjectedBundle::shared().os() << utf8String->data();
+    InjectedBundle::shared().done();
+}
+
+void InjectedBundlePage::didFailLoadWithErrorForFrame(WKBundleFrameRef frame)
+{
+    if (!WKBundleFrameIsMainFrame(frame))
+        return;
+
+    InjectedBundle::shared().done();
+}
+
+void InjectedBundlePage::didReceiveTitleForFrame(WKStringRef title, WKBundleFrameRef frame)
+{
+}
+
+void InjectedBundlePage::didClearWindowForFrame(WKBundleFrameRef frame, JSContextRef ctx, JSObjectRef window)
+{
+    JSValueRef exception = 0;
+    InjectedBundle::shared().layoutTestController()->makeWindowObject(ctx, window, &exception);
+}
+
+} // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h
new file mode 100644
index 0000000..9782827
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InjectedBundlePage_h
+#define InjectedBundlePage_h
+
+#include <WebKit2/WKBundlePage.h>
+
+namespace WTR {
+
+class InjectedBundlePage {
+public:
+    InjectedBundlePage(WKBundlePageRef);
+    ~InjectedBundlePage();
+
+    WKBundlePageRef page() const { return m_page; }
+
+private:
+    static void _didStartProvisionalLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo);
+    static void _didReceiveServerRedirectForProvisionalLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo);
+    static void _didFailProvisionalLoadWithErrorForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo);
+    static void _didCommitLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo);
+    static void _didFinishLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo);
+    static void _didFailLoadWithErrorForFrame(WKBundlePageRef page, WKBundleFrameRef frame, const void *clientInfo);
+    static void _didReceiveTitleForFrame(WKBundlePageRef page, WKStringRef title, WKBundleFrameRef frame, const void *clientInfo);
+    static void _didClearWindowForFrame(WKBundlePageRef page, WKBundleFrameRef frame, JSContextRef ctx, JSObjectRef window, const void *clientInfo);
+
+    void didStartProvisionalLoadForFrame(WKBundleFrameRef frame);
+    void didReceiveServerRedirectForProvisionalLoadForFrame(WKBundleFrameRef frame);
+    void didFailProvisionalLoadWithErrorForFrame(WKBundleFrameRef frame);
+    void didCommitLoadForFrame(WKBundleFrameRef frame);
+    void didFinishLoadForFrame(WKBundleFrameRef frame);
+    void didFailLoadWithErrorForFrame(WKBundleFrameRef frame);
+    void didReceiveTitleForFrame(WKStringRef title, WKBundleFrameRef frame);
+    void didClearWindowForFrame(WKBundleFrameRef frame, JSContextRef ctx, JSObjectRef window);
+
+    WKBundlePageRef m_page;
+};
+
+} // namespace WTR
+
+#endif // InjectedBundlePage_h
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp b/WebKitTools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
new file mode 100644
index 0000000..014851c
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/LayoutTestController.cpp
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "LayoutTestController.h"
+
+#include <JavaScriptCore/JSRetainPtr.h>
+
+namespace WTR {
+
+PassRefPtr<LayoutTestController> LayoutTestController::create(const std::string& testPathOrURL)
+{
+    return adoptRef(new LayoutTestController(testPathOrURL));
+}
+
+LayoutTestController::LayoutTestController(const std::string& testPathOrURL)
+    : m_dumpAsText(false)
+    , m_testPathOrURL(testPathOrURL)
+{
+}
+
+LayoutTestController::~LayoutTestController()
+{
+}
+
+static JSValueRef dumpAsTextCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    controller->setDumpAsText(true);
+    return JSValueMakeUndefined(context);
+}
+
+// Object Finalization
+
+static void layoutTestControllerObjectFinalize(JSObjectRef object)
+{
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(object));
+    controller->deref();
+}
+
+// Object Creation
+
+void LayoutTestController::makeWindowObject(JSContextRef context, JSObjectRef windowObject, JSValueRef* exception)
+{
+    JSRetainPtr<JSStringRef> layoutTestContollerStr(Adopt, JSStringCreateWithUTF8CString("layoutTestController"));
+    ref();
+
+    JSClassRef classRef = getJSClass();
+    JSValueRef layoutTestContollerObject = JSObjectMake(context, classRef, this);
+    JSClassRelease(classRef);
+
+    JSObjectSetProperty(context, windowObject, layoutTestContollerStr.get(), layoutTestContollerObject, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete, exception);
+}
+
+JSClassRef LayoutTestController::getJSClass()
+{
+    static JSStaticFunction* staticFunctions = LayoutTestController::staticFunctions();
+    static JSClassDefinition classDefinition = {
+        0, kJSClassAttributeNone, "LayoutTestController", 0, 0, staticFunctions,
+        0, layoutTestControllerObjectFinalize, 0, 0, 0, 0, 0, 0, 0, 0, 0
+    };
+
+    return JSClassCreate(&classDefinition);
+}
+
+JSStaticFunction* LayoutTestController::staticFunctions()
+{
+    static JSStaticFunction staticFunctions[] = {
+        { "dumpAsText", dumpAsTextCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { 0, 0, 0 }
+    };
+
+    return staticFunctions;
+}
+
+} // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/LayoutTestController.h b/WebKitTools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
new file mode 100644
index 0000000..56717c1
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LayoutTestController_h
+#define LayoutTestController_h
+
+#include <JavaScriptCore/JavaScriptCore.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <string>
+
+namespace WTR {
+
+class LayoutTestController : public RefCounted<LayoutTestController> {
+public:
+    static PassRefPtr<LayoutTestController> create(const std::string& testPathOrURL);
+    ~LayoutTestController();
+
+    void makeWindowObject(JSContextRef context, JSObjectRef windowObject, JSValueRef* exception);
+
+    bool dumpAsText() const { return m_dumpAsText; }
+    void setDumpAsText(bool dumpAsText) { m_dumpAsText = dumpAsText; }
+
+private:
+    LayoutTestController(const std::string& testPathOrURL);
+
+    bool m_dumpAsText;
+
+    std::string m_testPathOrURL;
+    
+    static JSClassRef getJSClass();
+    static JSStaticValue* staticValues();
+    static JSStaticFunction* staticFunctions();
+};
+
+} // namespace WTR
+
+#endif // LayoutTestController_h
diff --git a/WebKitTools/WebKitTestRunner/TestController.cpp b/WebKitTools/WebKitTestRunner/TestController.cpp
index 5355862..b5b15d1 100644
--- a/WebKitTools/WebKitTestRunner/TestController.cpp
+++ b/WebKitTools/WebKitTestRunner/TestController.cpp
@@ -25,6 +25,7 @@
 
 #include "TestController.h"
 
+#include "PlatformWebView.h"
 #include "TestInvocation.h"
 #include <getopt.h>
 
@@ -93,12 +94,25 @@ void TestController::initialize(int argc, const char *argv[])
     }
 
     initializeInjectedBundlePath();
+
+    m_context.adopt(WKContextCreateWithInjectedBundlePath(injectedBundlePath()));
+
+    WKContextInjectedBundleClient injectedBundlePathClient = {
+        0,
+        this,
+        _didRecieveMessageFromInjectedBundle
+    };
+    WKContextSetInjectedBundleClient(m_context.get(), &injectedBundlePathClient);
+
+    m_pageNamespace.adopt(WKPageNamespaceCreate(m_context.get()));
+    m_mainWebView = new PlatformWebView(m_pageNamespace.get());
 }
 
 void TestController::runTest(const char* test)
 {
-    TestInvocation invocation(test);
-    invocation.invoke();
+    m_currentInvocation.set(new TestInvocation(test));
+    m_currentInvocation->invoke();
+    m_currentInvocation.clear();
 }
 
 void TestController::runTestingServerLoop()
@@ -128,5 +142,14 @@ bool TestController::run()
     return true;
 }
 
-} // namespace WTR
+void TestController::_didRecieveMessageFromInjectedBundle(WKContextRef context, WKStringRef message, const void *clientInfo)
+{
+    static_cast<TestController*>(const_cast<void*>(clientInfo))->didRecieveMessageFromInjectedBundle(message);
+}
 
+void TestController::didRecieveMessageFromInjectedBundle(WKStringRef message)
+{
+    m_currentInvocation->didRecieveMessageFromInjectedBundle(message);
+}
+
+} // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/TestController.h b/WebKitTools/WebKitTestRunner/TestController.h
index 86eaa7c..7ad11fe 100644
--- a/WebKitTools/WebKitTestRunner/TestController.h
+++ b/WebKitTools/WebKitTestRunner/TestController.h
@@ -29,9 +29,13 @@
 #include <WebKit2/WKRetainPtr.h>
 #include <string>
 #include <vector>
+#include <wtf/OwnPtr.h>
 
 namespace WTR {
 
+class TestInvocation;
+class PlatformWebView;
+
 class TestController {
 public:
     static TestController& shared();
@@ -46,6 +50,10 @@ public:
 
     WKStringRef injectedBundlePath() { return m_injectedBundlePath.get(); }
 
+    PlatformWebView* mainWebView() { return m_mainWebView; }
+    WKPageNamespaceRef pageNamespace() { return m_pageNamespace.get(); }
+    WKContextRef context() { return m_context.get(); }
+
 private:
     TestController();
     ~TestController();
@@ -55,15 +63,25 @@ private:
     
     void initializeInjectedBundlePath();
 
+    // WKContextInjectedBundleClient
+    static void _didRecieveMessageFromInjectedBundle(WKContextRef context, WKStringRef message, const void*);
+    void didRecieveMessageFromInjectedBundle(WKStringRef message);
+
+    OwnPtr<TestInvocation> m_currentInvocation;
+
     bool m_dumpTree;
     bool m_dumpPixels;
     bool m_threaded;
-    bool m_forceComplexText;    
+    bool m_forceComplexText;
     bool m_verbose;
     bool m_printSeparators;
     bool m_usingServerMode;
     std::vector<std::string> m_paths;
     WKRetainPtr<WKStringRef> m_injectedBundlePath;
+
+    PlatformWebView* m_mainWebView;
+    WKRetainPtr<WKContextRef> m_context;
+    WKRetainPtr<WKPageNamespaceRef> m_pageNamespace;
 };
 
 } // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/TestInvocation.cpp b/WebKitTools/WebKitTestRunner/TestInvocation.cpp
index 80efd62..72d07ae 100644
--- a/WebKitTools/WebKitTestRunner/TestInvocation.cpp
+++ b/WebKitTools/WebKitTestRunner/TestInvocation.cpp
@@ -25,13 +25,14 @@
 
 #include "TestInvocation.h"
 
+#include "PlatformWebView.h"
 #include "TestController.h"
-#include <JavaScriptCore/RetainPtr.h>
 #include <WebKit2/WKContextPrivate.h>
-#include <WebKit2/WKPagePrivate.h>
 #include <WebKit2/WKRetainPtr.h>
 #include <WebKit2/WKStringCF.h>
 #include <WebKit2/WKURLCF.h>
+#include <wtf/Vector.h>
+#include <wtf/RetainPtr.h>
 
 using namespace WebKit;
 
@@ -48,123 +49,85 @@ static WKURLRef createWKURL(const char* pathOrURL)
     return WKURLCreateWithCFURL(cfURL.get());
 }
 
+static std::auto_ptr<Vector<char> > WKStringToUTF8(WKStringRef wkStringRef)
+{
+    RetainPtr<CFStringRef> cfString(AdoptCF, WKStringCopyCFString(0, wkStringRef));
+    CFIndex bufferLength = CFStringGetMaximumSizeForEncoding(CFStringGetLength(cfString.get()), kCFStringEncodingUTF8) + 1;
+    std::auto_ptr<Vector<char> > buffer(new Vector<char>(bufferLength));
+    if (!CFStringGetCString(cfString.get(), buffer->data(), bufferLength, kCFStringEncodingUTF8)) {
+        buffer->shrink(1);
+        (*buffer)[0] = 0;
+    } else
+        buffer->shrink(strlen(buffer->data()) + 1);
+    return buffer;
+}
+
 TestInvocation::TestInvocation(const char* pathOrURL)
     : m_url(AdoptWK, createWKURL(pathOrURL))
-    , m_mainWebView(0)
-    , m_loadDone(false)
-    , m_renderTreeFetchDone(false)
-    , m_failed(false)
+    , m_gotInitialResponse(false)
+    , m_gotFinalMessage(false)
+    , m_error(false)
 {
 }
 
 TestInvocation::~TestInvocation()
 {
-    delete m_mainWebView;
-    m_mainWebView = 0;
 }
 
 void TestInvocation::invoke()
 {
-    initializeMainWebView();
-
-    WKPageLoadURL(m_mainWebView->page(), m_url.get());
-    runUntil(m_loadDone);
+    WKRetainPtr<WKStringRef> message(AdoptWK, WKStringCreateWithCFString(CFSTR("BeginTest")));
+    WKContextPostMessageToInjectedBundle(TestController::shared().context(), message.get());
 
-    if (m_failed)
+    runUntil(m_gotInitialResponse);
+    if (m_error) {
+        dump("FAIL\n");
         return;
+    }
 
-    WKPageRenderTreeExternalRepresentation(m_mainWebView->page(), this, renderTreeExternalRepresentationFunction, renderTreeExternalRepresentationDisposeFunction);
-    runUntil(m_renderTreeFetchDone);
+    WKPageLoadURL(TestController::shared().mainWebView()->page(), m_url.get());
+
+    runUntil(m_gotFinalMessage);
+    if (m_error) {
+        dump("FAIL\n");
+        return;
+    }
 }
 
 void TestInvocation::dump(const char* stringToDump)
 {
     printf("Content-Type: text/plain\n");
     printf("%s", stringToDump);
-    printf("#EOF\n");
-}
-
-void TestInvocation::initializeMainWebView()
-{
-    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreateWithInjectedBundlePath(TestController::shared().injectedBundlePath()));
-    WKRetainPtr<WKPageNamespaceRef> pageNamespace(AdoptWK, WKPageNamespaceCreate(context.get()));
-    m_mainWebView = new PlatformWebView(pageNamespace.get());
-
-    WKPageLoaderClient loaderClient = { 
-        0,
-        this,
-        didStartProvisionalLoadForFrame,
-        didReceiveServerRedirectForProvisionalLoadForFrame,
-        didFailProvisionalLoadWithErrorForFrame,
-        didCommitLoadForFrame,
-        didFinishLoadForFrame,
-        didFailLoadForFrame,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0
-    };
-    WKPageSetPageLoaderClient(m_mainWebView->page(), &loaderClient);
-}
-
-void TestInvocation::didStartProvisionalLoadForFrame(WKPageRef page, WKFrameRef frame, const void* clientInfo)
-{
-}
-
-void TestInvocation::didReceiveServerRedirectForProvisionalLoadForFrame(WKPageRef page, WKFrameRef frame, const void* clientInfo)
-{
-}
 
-void TestInvocation::didFailProvisionalLoadWithErrorForFrame(WKPageRef page, WKFrameRef frame, const void* clientInfo)
-{
-    TestInvocation* self = reinterpret_cast<TestInvocation*>(const_cast<void*>(clientInfo));
-    self->m_loadDone = true;
-    self->m_failed = true;
-}
-
-void TestInvocation::didCommitLoadForFrame(WKPageRef page, WKFrameRef frame, const void* clientInfo)
-{
-}
-
-void TestInvocation::didFinishLoadForFrame(WKPageRef page, WKFrameRef frame, const void* clientInfo)
-{
-    TestInvocation* self = reinterpret_cast<TestInvocation*>(const_cast<void*>(clientInfo));
-    self->m_loadDone = true;
-}
+    fputs("#EOF\n", stdout);
+    fputs("#EOF\n", stdout);
+    fputs("#EOF\n", stderr);
 
-void TestInvocation::didFailLoadForFrame(WKPageRef page, WKFrameRef frame, const void* clientInfo)
-{
-    TestInvocation* self = reinterpret_cast<TestInvocation*>(const_cast<void*>(clientInfo));
-
-    self->m_loadDone = true;
-    self->m_failed = true;
+    fflush(stdout);
+    fflush(stderr);
 }
 
-void TestInvocation::renderTreeExternalRepresentationFunction(WKStringRef wkResult, void* context)
+void TestInvocation::didRecieveMessageFromInjectedBundle(WKStringRef message)
 {
-    TestInvocation* self = reinterpret_cast<TestInvocation*>(context);
-
-    RetainPtr<CFStringRef> result(AdoptCF, WKStringCopyCFString(0, wkResult));
-    CFIndex bufferLength = CFStringGetMaximumSizeForEncoding(CFStringGetLength(result.get()), kCFStringEncodingUTF8) + 1;
-    char* buffer = (char*)malloc(bufferLength);
-    CFStringGetCString(result.get(), buffer, bufferLength, kCFStringEncodingUTF8);
-
-    self->dump(buffer);
-    free(buffer);
+    RetainPtr<CFStringRef> cfMessage(AdoptCF, WKStringCopyCFString(0, message));
+    
+    if (CFEqual(cfMessage.get(), CFSTR("Error"))) {
+        // Set all states to true to stop spinning the runloop.
+        m_gotInitialResponse = true;
+        m_gotFinalMessage = true;
+        m_error = true;
+        return;
+    }
 
-    self->m_renderTreeFetchDone = true;
-}
+    if (CFEqual(cfMessage.get(), CFSTR("BeginTestAck"))) {
+        m_gotInitialResponse = true;
+        return;
+    }
 
-void TestInvocation::renderTreeExternalRepresentationDisposeFunction(void* context)
-{
-    TestInvocation* self = reinterpret_cast<TestInvocation*>(context);
+    std::auto_ptr<Vector<char> > utf8Message = WKStringToUTF8(message);
 
-    self->m_renderTreeFetchDone = true;
-    self->m_failed = true;
+    dump(utf8Message->data());
+    m_gotFinalMessage = true;
 }
 
 } // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/TestInvocation.h b/WebKitTools/WebKitTestRunner/TestInvocation.h
index 4552203..fb03150 100644
--- a/WebKitTools/WebKitTestRunner/TestInvocation.h
+++ b/WebKitTools/WebKitTestRunner/TestInvocation.h
@@ -26,47 +26,31 @@
 #ifndef TestInvocation_h
 #define TestInvocation_h
 
-#include "PlatformWebView.h"
 #include <WebKit2/WKRetainPtr.h>
-#include <JavaScriptCore/Noncopyable.h>
+#include <wtf/Noncopyable.h>
 
 namespace WTR {
 
-class TestInvocation : Noncopyable {
+class TestInvocation : public Noncopyable {
 public:
     TestInvocation(const char*);
     ~TestInvocation();
 
     void invoke();
+    void didRecieveMessageFromInjectedBundle(WKStringRef message);
 
 private:
-    void initializeMainWebView();
     void dump(const char*);
 
     // Helper
     static void runUntil(bool& done);
 
-    // PageLoaderClient
-    static void didStartProvisionalLoadForFrame(WKPageRef page, WKFrameRef, const void*);
-    static void didReceiveServerRedirectForProvisionalLoadForFrame(WKPageRef, WKFrameRef, const void*);
-    static void didFailProvisionalLoadWithErrorForFrame(WKPageRef, WKFrameRef, const void*);
-    static void didCommitLoadForFrame(WKPageRef, WKFrameRef, const void*);
-    static void didFinishLoadForFrame(WKPageRef, WKFrameRef, const void*);
-    static void didFailLoadForFrame(WKPageRef, WKFrameRef, const void*);
-
-    // RenderTreeExternalRepresentation callbacks
-    static void renderTreeExternalRepresentationFunction(WKStringRef, void*);
-    static void renderTreeExternalRepresentationDisposeFunction(void*);
-
-    WKStringRef injectedBundlePath();
-
     WKRetainPtr<WKURLRef> m_url;
-    PlatformWebView* m_mainWebView;
 
     // Invocation state
-    bool m_loadDone;
-    bool m_renderTreeFetchDone;
-    bool m_failed;
+    bool m_gotInitialResponse;
+    bool m_gotFinalMessage;
+    bool m_error;
 };
 
 } // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj b/WebKitTools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
index bef50b5..caf26a4 100644
--- a/WebKitTools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
+++ b/WebKitTools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
@@ -17,6 +17,9 @@
 		BC7934AC1190658C005EA8E2 /* WebKit2.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BC7934AB1190658C005EA8E2 /* WebKit2.framework */; };
 		BC7934E811906846005EA8E2 /* PlatformWebViewMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC7934E711906846005EA8E2 /* PlatformWebViewMac.mm */; };
 		BC8C795C11D2785D004535A1 /* TestControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC8C795B11D2785D004535A1 /* TestControllerMac.mm */; };
+		BCC997A411D3C8F60017BCA2 /* InjectedBundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC997A011D3C8F60017BCA2 /* InjectedBundle.cpp */; };
+		BCC997A511D3C8F60017BCA2 /* InjectedBundlePage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC997A211D3C8F60017BCA2 /* InjectedBundlePage.cpp */; };
+		BCC9981811D3F51E0017BCA2 /* LayoutTestController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC9981711D3F51E0017BCA2 /* LayoutTestController.cpp */; };
 		BCD7D2F811921278006DB7EE /* TestInvocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD7D2F711921278006DB7EE /* TestInvocation.cpp */; };
 		BCDA2ABF1190B51A00C3BC47 /* TestInvocationMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCDA2ABE1190B51A00C3BC47 /* TestInvocationMac.mm */; };
 		BCDA2B9A1191051F00C3BC47 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BCDA2B991191051F00C3BC47 /* JavaScriptCore.framework */; };
@@ -62,6 +65,12 @@
 		BC7934DD119066EC005EA8E2 /* PlatformWebView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformWebView.h; sourceTree = "<group>"; };
 		BC7934E711906846005EA8E2 /* PlatformWebViewMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformWebViewMac.mm; sourceTree = "<group>"; };
 		BC8C795B11D2785D004535A1 /* TestControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = TestControllerMac.mm; sourceTree = "<group>"; };
+		BCC997A011D3C8F60017BCA2 /* InjectedBundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundle.cpp; sourceTree = "<group>"; };
+		BCC997A111D3C8F60017BCA2 /* InjectedBundle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundle.h; sourceTree = "<group>"; };
+		BCC997A211D3C8F60017BCA2 /* InjectedBundlePage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundlePage.cpp; sourceTree = "<group>"; };
+		BCC997A311D3C8F60017BCA2 /* InjectedBundlePage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundlePage.h; sourceTree = "<group>"; };
+		BCC9981611D3F51E0017BCA2 /* LayoutTestController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = LayoutTestController.h; sourceTree = "<group>"; };
+		BCC9981711D3F51E0017BCA2 /* LayoutTestController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = LayoutTestController.cpp; sourceTree = "<group>"; };
 		BCD7D2F611921278006DB7EE /* TestInvocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TestInvocation.h; sourceTree = "<group>"; };
 		BCD7D2F711921278006DB7EE /* TestInvocation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TestInvocation.cpp; sourceTree = "<group>"; };
 		BCDA2ABE1190B51A00C3BC47 /* TestInvocationMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = TestInvocationMac.mm; sourceTree = "<group>"; };
@@ -141,7 +150,13 @@
 		BC25183511D1571D002EBC01 /* InjectedBundle */ = {
 			isa = PBXGroup;
 			children = (
+				BCC997A011D3C8F60017BCA2 /* InjectedBundle.cpp */,
+				BCC997A111D3C8F60017BCA2 /* InjectedBundle.h */,
 				BC25184611D15767002EBC01 /* InjectedBundleMain.cpp */,
+				BCC997A211D3C8F60017BCA2 /* InjectedBundlePage.cpp */,
+				BCC997A311D3C8F60017BCA2 /* InjectedBundlePage.h */,
+				BCC9981611D3F51E0017BCA2 /* LayoutTestController.h */,
+				BCC9981711D3F51E0017BCA2 /* LayoutTestController.cpp */,
 			);
 			path = InjectedBundle;
 			sourceTree = "<group>";
@@ -262,6 +277,9 @@
 			buildActionMask = 2147483647;
 			files = (
 				BC251A3E11D16831002EBC01 /* InjectedBundleMain.cpp in Sources */,
+				BCC997A411D3C8F60017BCA2 /* InjectedBundle.cpp in Sources */,
+				BCC997A511D3C8F60017BCA2 /* InjectedBundlePage.cpp in Sources */,
+				BCC9981811D3F51E0017BCA2 /* LayoutTestController.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};