Merge WebKit at r76408: Initial merge by git.

Change-Id: I5b91decbd693ccbf5c1b8354b37cd68cc9a1ea53

61 files changed, 831 insertions, 115 deletions

diff --git a/Source/WebCore/html/CollectionCache.h b/Source/WebCore/html/CollectionCache.h
index df1d1fa..8e4a066 100644
--- a/Source/WebCore/html/CollectionCache.h
+++ b/Source/WebCore/html/CollectionCache.h
@@ -29,7 +29,9 @@ namespace WebCore {
 
 class Element;
 
-struct CollectionCache : FastAllocBase {
+struct CollectionCache {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     CollectionCache();
     CollectionCache(const CollectionCache&);
     CollectionCache& operator=(const CollectionCache& other)
diff --git a/Source/WebCore/html/DOMSettableTokenList.h b/Source/WebCore/html/DOMSettableTokenList.h
index 2b711b4..8f6fd4e 100644
--- a/Source/WebCore/html/DOMSettableTokenList.h
+++ b/Source/WebCore/html/DOMSettableTokenList.h
@@ -35,6 +35,7 @@
 namespace WebCore {
 
 class DOMSettableTokenList : public DOMTokenList, public RefCounted<DOMSettableTokenList> {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassRefPtr<DOMSettableTokenList> create()
     {
diff --git a/Source/WebCore/html/DOMTokenList.h b/Source/WebCore/html/DOMTokenList.h
index 5df2ede..0b75b66 100644
--- a/Source/WebCore/html/DOMTokenList.h
+++ b/Source/WebCore/html/DOMTokenList.h
@@ -27,15 +27,16 @@
 
 #include "ExceptionCode.h"
 #include <wtf/text/AtomicString.h>
-#include <wtf/Noncopyable.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
 class Element;
 
-class DOMTokenList : public Noncopyable {
+class DOMTokenList {
+    WTF_MAKE_NONCOPYABLE(DOMTokenList); WTF_MAKE_FAST_ALLOCATED;
 public:
+    DOMTokenList() { }
     virtual ~DOMTokenList() {};
 
     virtual void ref() = 0;
diff --git a/Source/WebCore/html/FormAssociatedElement.h b/Source/WebCore/html/FormAssociatedElement.h
index 873bdf4..ebefdc6 100644
--- a/Source/WebCore/html/FormAssociatedElement.h
+++ b/Source/WebCore/html/FormAssociatedElement.h
@@ -46,6 +46,7 @@ public:
 
     virtual bool isFormControlElement() const = 0;
     virtual bool isEnumeratable() const = 0;
+    virtual bool isResettable() const = 0;
 
     const AtomicString& name() const { return formControlName(); }
 
diff --git a/Source/WebCore/html/HTMLAreaElement.cpp b/Source/WebCore/html/HTMLAreaElement.cpp
index dc87ef6..ac4c865 100644
--- a/Source/WebCore/html/HTMLAreaElement.cpp
+++ b/Source/WebCore/html/HTMLAreaElement.cpp
@@ -22,6 +22,7 @@
 #include "config.h"
 #include "HTMLAreaElement.h"
 
+#include "AffineTransform.h"
 #include "Attribute.h"
 #include "Frame.h"
 #include "HTMLImageElement.h"
diff --git a/Source/WebCore/html/HTMLAttributeNames.in b/Source/WebCore/html/HTMLAttributeNames.in
index 513e44f..eac9a73 100644
--- a/Source/WebCore/html/HTMLAttributeNames.in
+++ b/Source/WebCore/html/HTMLAttributeNames.in
@@ -177,6 +177,8 @@ onerror
 onfocus
 onfocusin
 onfocusout
+onformchange
+onforminput
 onhashchange
 oninput
 oninvalid
diff --git a/Source/WebCore/html/HTMLCanvasElement.cpp b/Source/WebCore/html/HTMLCanvasElement.cpp
index f286749..0fdb7b2 100644
--- a/Source/WebCore/html/HTMLCanvasElement.cpp
+++ b/Source/WebCore/html/HTMLCanvasElement.cpp
@@ -406,6 +406,11 @@ void HTMLCanvasElement::createImageBuffer() const
     m_imageBuffer->context()->scale(FloatSize(size.width() / unscaledSize.width(), size.height() / unscaledSize.height()));
     m_imageBuffer->context()->setShadowsIgnoreTransforms(true);
     m_imageBuffer->context()->setImageInterpolationQuality(DefaultInterpolationQuality);
+
+#if USE(JSC)
+    if (hasCachedDOMNodeWrapperUnchecked(document(), const_cast<HTMLCanvasElement*>(this)))
+        scriptExecutionContext()->globalData()->heap.reportExtraMemoryCost(m_imageBuffer->dataSize());
+#endif
 }
 
 GraphicsContext* HTMLCanvasElement::drawingContext() const
@@ -446,8 +451,7 @@ AffineTransform HTMLCanvasElement::baseTransform() const
     AffineTransform transform;
     if (size.width() && size.height())
         transform.scaleNonUniform(size.width() / unscaledSize.width(), size.height() / unscaledSize.height());
-    transform.multiply(m_imageBuffer->baseTransform());
-    return transform;
+    return m_imageBuffer->baseTransform() * transform;
 }
 
 }
diff --git a/Source/WebCore/html/HTMLElement.cpp b/Source/WebCore/html/HTMLElement.cpp
index af3115c..b7eca06 100644
--- a/Source/WebCore/html/HTMLElement.cpp
+++ b/Source/WebCore/html/HTMLElement.cpp
@@ -190,6 +190,10 @@ void HTMLElement::parseMappedAttribute(Attribute* attr)
         setAttributeEventListener(eventNames().focusinEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onfocusoutAttr) {
         setAttributeEventListener(eventNames().focusoutEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == onformchangeAttr) {
+        setAttributeEventListener(eventNames().formchangeEvent, createAttributeEventListener(this, attr));
+    } else if (attr->name() == onforminputAttr) {
+        setAttributeEventListener(eventNames().forminputEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onblurAttr) {
         setAttributeEventListener(eventNames().blurEvent, createAttributeEventListener(this, attr));
     } else if (attr->name() == onkeydownAttr) {
@@ -685,19 +689,18 @@ bool HTMLElement::isContentRichlyEditable() const
 
 String HTMLElement::contentEditable() const 
 {
-    if (!renderer())
-        return "false";
-    
-    switch (renderer()->style()->userModify()) {
-        case READ_WRITE:
-            return "true";
-        case READ_ONLY:
-            return "false";
-        case READ_WRITE_PLAINTEXT_ONLY:
-            return "plaintext-only";
-        default:
-            return "inherit";
-    }
+    const AtomicString& value = fastGetAttribute(contenteditableAttr);
+
+    if (value.isNull())
+        return "inherit";
+    if (value.isEmpty() || equalIgnoringCase(value, "true"))
+        return "true";
+    if (equalIgnoringCase(value, "false"))
+         return "false";
+    if (equalIgnoringCase(value, "plaintext-only"))
+        return "plaintext-only";
+
+    return "inherit";
 }
 
 void HTMLElement::setContentEditable(Attribute* attr) 
@@ -726,14 +729,16 @@ void HTMLElement::setContentEditable(Attribute* attr)
     }
 }
 
-void HTMLElement::setContentEditable(const String &enabled)
+void HTMLElement::setContentEditable(const String& enabled, ExceptionCode& ec)
 {
-    if (enabled == "inherit") {
-        ExceptionCode ec;
+    if (equalIgnoringCase(enabled, "true"))
+        setAttribute(contenteditableAttr, "true", ec);
+    else if (equalIgnoringCase(enabled, "false"))
+        setAttribute(contenteditableAttr, "false", ec);
+    else if (equalIgnoringCase(enabled, "inherit"))
         removeAttribute(contenteditableAttr, ec);
-    }
     else
-        setAttribute(contenteditableAttr, enabled.isEmpty() ? "true" : enabled);
+        ec = SYNTAX_ERR;
 }
 
 bool HTMLElement::draggable() const
@@ -837,6 +842,40 @@ HTMLFormElement* HTMLElement::virtualForm() const
     return findFormAncestor();
 }
 
+HTMLFormElement* HTMLElement::shadowAncestorOwnerForm()
+{
+    Node* ancestorNode = shadowAncestorNode();
+    if (!ancestorNode)
+        return form();
+
+    if (!ancestorNode->isHTMLElement())
+        return 0;
+    HTMLElement* ancestorHTML = static_cast<HTMLElement*>(ancestorNode);
+    if (!ancestorHTML)
+        return 0;
+    return ancestorHTML->form();
+}
+
+void HTMLElement::dispatchChangeEvents()
+{
+    RefPtr<HTMLElement> protector(this);
+    RefPtr<HTMLFormElement> ownerForm(shadowAncestorOwnerForm());
+
+    Node::dispatchChangeEvents();
+    if (ownerForm)
+        ownerForm->dispatchFormChange();
+}
+
+void HTMLElement::dispatchInputEvents()
+{
+    RefPtr<HTMLElement> protector(this);
+    RefPtr<HTMLFormElement> ownerForm(shadowAncestorOwnerForm());
+
+    Node::dispatchInputEvents();
+    if (ownerForm)
+        ownerForm->dispatchFormInput();
+}
+
 } // namespace WebCore
 
 #ifndef NDEBUG
diff --git a/Source/WebCore/html/HTMLElement.h b/Source/WebCore/html/HTMLElement.h
index a64db2c..ad84f5d 100644
--- a/Source/WebCore/html/HTMLElement.h
+++ b/Source/WebCore/html/HTMLElement.h
@@ -61,7 +61,7 @@ public:
     virtual bool isContentRichlyEditable() const;
 
     String contentEditable() const;
-    void setContentEditable(const String&);
+    void setContentEditable(const String&, ExceptionCode&);
 
     virtual bool draggable() const;
     void setDraggable(bool);
@@ -84,6 +84,9 @@ public:
 
     HTMLFormElement* findFormAncestor() const;
 
+    virtual void dispatchChangeEvents();
+    virtual void dispatchInputEvents();
+
 protected:
     HTMLElement(const QualifiedName& tagName, Document*);
 
@@ -101,6 +104,8 @@ private:
 
     Node* insertAdjacent(const String& where, Node* newChild, ExceptionCode&);
     PassRefPtr<DocumentFragment> textToFragment(const String&, ExceptionCode&);
+
+    HTMLFormElement* shadowAncestorOwnerForm();
 };
 
 inline HTMLElement::HTMLElement(const QualifiedName& tagName, Document* document)
diff --git a/Source/WebCore/html/HTMLElement.idl b/Source/WebCore/html/HTMLElement.idl
index 77423fc..cd400c4 100644
--- a/Source/WebCore/html/HTMLElement.idl
+++ b/Source/WebCore/html/HTMLElement.idl
@@ -59,7 +59,8 @@ module html {
 
         readonly attribute HTMLCollection children;
 
-                 attribute [ConvertNullToNullString] DOMString contentEditable;
+                 attribute [ConvertNullToNullString] DOMString contentEditable
+                     setter raises(DOMException);
         readonly attribute boolean isContentEditable;
 
                  attribute boolean spellcheck;
diff --git a/Source/WebCore/html/HTMLFormControlElement.cpp b/Source/WebCore/html/HTMLFormControlElement.cpp
index b3ad7c8..bb42dfd 100644
--- a/Source/WebCore/html/HTMLFormControlElement.cpp
+++ b/Source/WebCore/html/HTMLFormControlElement.cpp
@@ -178,7 +178,12 @@ void HTMLFormControlElement::setName(const AtomicString& value)
 
 void HTMLFormControlElement::dispatchFormControlChangeEvent()
 {
-    dispatchEvent(Event::create(eventNames().changeEvent, true, false));
+    HTMLElement::dispatchChangeEvents();
+}
+
+void HTMLFormControlElement::dispatchFormControlInputEvent()
+{
+    HTMLElement::dispatchInputEvents();
 }
 
 void HTMLFormControlElement::setDisabled(bool b)
diff --git a/Source/WebCore/html/HTMLFormControlElement.h b/Source/WebCore/html/HTMLFormControlElement.h
index 8403b84..c88905c 100644
--- a/Source/WebCore/html/HTMLFormControlElement.h
+++ b/Source/WebCore/html/HTMLFormControlElement.h
@@ -53,12 +53,14 @@ public:
     virtual void setFormControlValueMatchesRenderer(bool b) { m_valueMatchesRenderer = b; }
 
     virtual void dispatchFormControlChangeEvent();
+    virtual void dispatchFormControlInputEvent();
 
     virtual bool disabled() const { return m_disabled; }
     void setDisabled(bool);
 
     virtual bool isFocusable() const;
     virtual bool isEnumeratable() const { return false; }
+    virtual bool isResettable() const { return false; }
 
     // Determines whether or not a control will be automatically focused.
     virtual bool autofocus() const;
diff --git a/Source/WebCore/html/HTMLFormElement.cpp b/Source/WebCore/html/HTMLFormElement.cpp
index c896bbf..d778601 100644
--- a/Source/WebCore/html/HTMLFormElement.cpp
+++ b/Source/WebCore/html/HTMLFormElement.cpp
@@ -590,6 +590,39 @@ bool HTMLFormElement::checkValidity()
     return controls.isEmpty();
 }
 
+void HTMLFormElement::broadcastFormEvent(const AtomicString& eventName)
+{
+    RefPtr<HTMLFormElement> protector(this);
+    // Copy m_associatedElements because event handlers called from
+    // formElement->dispatchEvent() might change m_associatedElements.
+    Vector<RefPtr<FormAssociatedElement> > elements;
+    elements.reserveCapacity(m_associatedElements.size());
+    for (unsigned i = 0; i < m_associatedElements.size(); ++i) {
+        if (!m_associatedElements[i]->isResettable())
+            continue;
+        elements.append(m_associatedElements[i]);
+    }
+
+    for (unsigned i = 0; i < elements.size(); ++i) {
+        // We can assume a resettable control is always a HTMLFormControlElement.
+        // FIXME: We should handle resettable non-HTMLFormControlElements maybe in the future.
+        ASSERT(elements[i]->isFormControlElement());
+        HTMLFormControlElement* formElement = static_cast<HTMLFormControlElement*>(elements[i].get());
+        if (!formElement->dispatchEvent(Event::create(eventName, false, false)))
+            continue;
+    }
+}
+
+void HTMLFormElement::dispatchFormInput()
+{
+    broadcastFormEvent(eventNames().forminputEvent);
+}
+
+void HTMLFormElement::dispatchFormChange()
+{
+    broadcastFormEvent(eventNames().formchangeEvent);
+}
+
 void HTMLFormElement::collectUnhandledInvalidControls(Vector<RefPtr<FormAssociatedElement> >& unhandledInvalidControls)
 {
     RefPtr<HTMLFormElement> protector(this);
diff --git a/Source/WebCore/html/HTMLFormElement.h b/Source/WebCore/html/HTMLFormElement.h
index bd087b8..7d7f4f8 100644
--- a/Source/WebCore/html/HTMLFormElement.h
+++ b/Source/WebCore/html/HTMLFormElement.h
@@ -114,6 +114,9 @@ public:
 
     const Vector<FormAssociatedElement*>& associatedElements() const { return m_associatedElements; }
 
+    void dispatchFormInput();
+    void dispatchFormChange();
+
 private:
     HTMLFormElement(const QualifiedName&, Document*);
 
@@ -144,6 +147,8 @@ private:
     // event was not canceled to the specified vector.
     void collectUnhandledInvalidControls(Vector<RefPtr<FormAssociatedElement> >&);
 
+    void broadcastFormEvent(const AtomicString&);
+
     friend class HTMLFormCollection;
 
     typedef HashMap<RefPtr<AtomicStringImpl>, RefPtr<HTMLFormControlElement> > AliasMap;
diff --git a/Source/WebCore/html/HTMLFormElement.idl b/Source/WebCore/html/HTMLFormElement.idl
index e9759e2..3e9e46d 100644
--- a/Source/WebCore/html/HTMLFormElement.idl
+++ b/Source/WebCore/html/HTMLFormElement.idl
@@ -43,6 +43,9 @@ module html {
 #endif
         void reset();
         boolean checkValidity();
+
+        void dispatchFormInput();
+        void dispatchFormChange();
     };
 
 }
diff --git a/Source/WebCore/html/HTMLInputElement.cpp b/Source/WebCore/html/HTMLInputElement.cpp
index c7a1a86..637e831 100644
--- a/Source/WebCore/html/HTMLInputElement.cpp
+++ b/Source/WebCore/html/HTMLInputElement.cpp
@@ -1048,6 +1048,12 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
             return;
     }
 
+    if (evt->isMouseEvent() && evt->type() == eventNames().mousedownEvent) {
+        m_inputType->handleMouseDownEvent(static_cast<MouseEvent*>(evt));
+        if (evt->defaultHandled())
+            return;
+    }
+
     m_inputType->forwardEvent(evt);
 
     if (!callBaseClassEarly && !evt->defaultHandled())
@@ -1391,7 +1397,7 @@ void HTMLInputElement::stepUpFromRenderer(int n)
         if (m_inputType->isRangeControl())
             dispatchFormControlChangeEvent();
         else
-            dispatchEvent(Event::create(eventNames().inputEvent, true, false));
+            dispatchFormControlInputEvent();
     }
 }
 
diff --git a/Source/WebCore/html/HTMLInputElement.h b/Source/WebCore/html/HTMLInputElement.h
index eb30de0..403248c 100644
--- a/Source/WebCore/html/HTMLInputElement.h
+++ b/Source/WebCore/html/HTMLInputElement.h
@@ -211,6 +211,7 @@ private:
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
     virtual bool isMouseFocusable() const;
     virtual bool isEnumeratable() const;
+    virtual bool isResettable() const { return true; }
     virtual void updateFocusAppearance(bool restorePreviousSelection);
     virtual void aboutToUnload();
     virtual bool shouldUseInputMethod() const;
diff --git a/Source/WebCore/html/HTMLKeygenElement.h b/Source/WebCore/html/HTMLKeygenElement.h
index 80f94b5..3dc4ad2 100644
--- a/Source/WebCore/html/HTMLKeygenElement.h
+++ b/Source/WebCore/html/HTMLKeygenElement.h
@@ -32,14 +32,16 @@ class HTMLKeygenElement : public HTMLSelectElement {
 public:
     static PassRefPtr<HTMLKeygenElement> create(const QualifiedName&, Document*, HTMLFormElement*);
 
+    virtual bool willValidate() const { return false; }
+
 private:
     HTMLKeygenElement(const QualifiedName&, Document*, HTMLFormElement*);
 
+    virtual bool isResettable() const { return true; }
+
     virtual const AtomicString& formControlType() const;
     virtual void parseMappedAttribute(Attribute*);
     virtual bool appendFormData(FormDataList&, bool);
-
-    virtual bool willValidate() const { return false; }
     virtual bool isOptionalFormControl() const { return false; }
 
     AtomicString m_challenge;
diff --git a/Source/WebCore/html/HTMLKeygenElement.idl b/Source/WebCore/html/HTMLKeygenElement.idl
new file mode 100644
index 0000000..c34a925
--- /dev/null
+++ b/Source/WebCore/html/HTMLKeygenElement.idl
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+
+    interface HTMLKeygenElement : HTMLElement {
+        attribute [Reflect] boolean autofocus;
+        attribute [Reflect] DOMString challenge;
+        attribute [Reflect] boolean disabled;
+        readonly attribute HTMLFormElement form;
+        attribute [Reflect] DOMString keytype;
+        attribute DOMString name;
+
+        readonly attribute DOMString type;
+
+        readonly attribute boolean willValidate;
+        readonly attribute ValidityState validity;
+        readonly attribute DOMString validationMessage;
+        boolean checkValidity();
+        void setCustomValidity(in [ConvertUndefinedOrNullToNullString] DOMString error);
+
+        readonly attribute NodeList labels;
+    };
+
+}
diff --git a/Source/WebCore/html/HTMLMediaElement.cpp b/Source/WebCore/html/HTMLMediaElement.cpp
index 43d53f5..be478b3 100644
--- a/Source/WebCore/html/HTMLMediaElement.cpp
+++ b/Source/WebCore/html/HTMLMediaElement.cpp
@@ -544,6 +544,7 @@ void HTMLMediaElement::prepareForLoad()
         refreshCachedTime();
         m_paused = true;
         m_seeking = false;
+        invalidateCachedTime();
         scheduleEvent(eventNames().emptiedEvent);
     }
 
@@ -1001,6 +1002,7 @@ void HTMLMediaElement::setReadyState(MediaPlayer::ReadyState state)
 
         if (m_autoplaying && m_paused && autoplay()) {
             m_paused = false;
+            invalidateCachedTime();
             scheduleEvent(eventNames().playEvent);
             scheduleEvent(eventNames().playingEvent);
         }
@@ -1310,6 +1312,7 @@ void HTMLMediaElement::setPlaybackRate(float rate)
 
     if (m_playbackRate != rate) {
         m_playbackRate = rate;
+        invalidateCachedTime();
         scheduleEvent(eventNames().ratechangeEvent);
     }
     if (m_player && potentiallyPlaying() && m_player->rate() != rate)
@@ -1414,6 +1417,7 @@ void HTMLMediaElement::playInternal()
     
     if (m_paused) {
         m_paused = false;
+        invalidateCachedTime();
         scheduleEvent(eventNames().playEvent);
 
         if (m_readyState <= HAVE_CURRENT_DATA)
@@ -1901,6 +1905,7 @@ void HTMLMediaElement::mediaPlayerRateChanged(MediaPlayer*)
     // Stash the rate in case the one we tried to set isn't what the engine is
     // using (eg. it can't handle the rate we set)
     m_playbackRate = m_player->rate();
+    invalidateCachedTime();
     endProcessingMediaPlayerCallback();
 }
 
diff --git a/Source/WebCore/html/HTMLObjectElement.h b/Source/WebCore/html/HTMLObjectElement.h
index ff773f1..cc8a03c 100644
--- a/Source/WebCore/html/HTMLObjectElement.h
+++ b/Source/WebCore/html/HTMLObjectElement.h
@@ -50,6 +50,7 @@ public:
     virtual bool isFormControlElement() const { return false; }
 
     virtual bool isEnumeratable() const { return true; }
+    virtual bool isResettable() const { return false; }
     virtual bool appendFormData(FormDataList&, bool);
 
     // Implementations of constraint validation API.
diff --git a/Source/WebCore/html/HTMLOutputElement.h b/Source/WebCore/html/HTMLOutputElement.h
index 83ecee2..4c5c684 100644
--- a/Source/WebCore/html/HTMLOutputElement.h
+++ b/Source/WebCore/html/HTMLOutputElement.h
@@ -56,6 +56,7 @@ private:
     virtual void parseMappedAttribute(Attribute*);
     virtual const AtomicString& formControlType() const;
     virtual bool isEnumeratable() const { return true; }
+    virtual bool isResettable() const { return true; }
     virtual void childrenChanged(bool createdByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void reset();
 
diff --git a/Source/WebCore/html/HTMLParserQuirks.h b/Source/WebCore/html/HTMLParserQuirks.h
index 50de710..3bf22a4 100644
--- a/Source/WebCore/html/HTMLParserQuirks.h
+++ b/Source/WebCore/html/HTMLParserQuirks.h
@@ -27,13 +27,13 @@
 #define HTMLParserQuirks_h
 
 #include <wtf/Forward.h>
-#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
 class Node;
 
-class HTMLParserQuirks : public Noncopyable {
+class HTMLParserQuirks {
+    WTF_MAKE_NONCOPYABLE(HTMLParserQuirks);
 public:
     HTMLParserQuirks() { }
     virtual ~HTMLParserQuirks() { }
diff --git a/Source/WebCore/html/HTMLSelectElement.h b/Source/WebCore/html/HTMLSelectElement.h
index a22df02..42e8963 100644
--- a/Source/WebCore/html/HTMLSelectElement.h
+++ b/Source/WebCore/html/HTMLSelectElement.h
@@ -107,6 +107,7 @@ private:
     virtual bool canStartSelection() const { return false; }
 
     virtual bool isEnumeratable() const { return true; }
+    virtual bool isResettable() const { return true; }
 
     virtual bool saveFormControlState(String& value) const;
     virtual void restoreFormControlState(const String&);
diff --git a/Source/WebCore/html/HTMLTagNames.in b/Source/WebCore/html/HTMLTagNames.in
index 4153f5c..f5ff077 100644
--- a/Source/WebCore/html/HTMLTagNames.in
+++ b/Source/WebCore/html/HTMLTagNames.in
@@ -71,7 +71,7 @@ input constructorNeedsFormElement
 ins interfaceName=HTMLModElement
 isindex interfaceName=HTMLIsIndexElement, constructorNeedsFormElement
 kbd interfaceName=HTMLElement
-keygen JSInterfaceName=HTMLSelectElement, constructorNeedsFormElement
+keygen constructorNeedsFormElement
 label
 layer interfaceName=HTMLElement
 legend constructorNeedsFormElement
diff --git a/Source/WebCore/html/HTMLTextAreaElement.h b/Source/WebCore/html/HTMLTextAreaElement.h
index 669fcd8..21b5880 100644
--- a/Source/WebCore/html/HTMLTextAreaElement.h
+++ b/Source/WebCore/html/HTMLTextAreaElement.h
@@ -80,6 +80,7 @@ private:
     virtual void defaultEventHandler(Event*);
 
     virtual bool isEnumeratable() const { return true; }
+    virtual bool isResettable() const { return true; }
 
     virtual const AtomicString& formControlType() const;
 
diff --git a/Source/WebCore/html/InputType.cpp b/Source/WebCore/html/InputType.cpp
index 729f204..2f8d414 100644
--- a/Source/WebCore/html/InputType.cpp
+++ b/Source/WebCore/html/InputType.cpp
@@ -305,6 +305,10 @@ void InputType::handleClickEvent(MouseEvent*)
 {
 }
 
+void InputType::handleMouseDownEvent(MouseEvent*)
+{
+}
+
 void InputType::handleDOMActivateEvent(Event*)
 {
 }
diff --git a/Source/WebCore/html/InputType.h b/Source/WebCore/html/InputType.h
index 0d1f6b8..e6ceb96 100644
--- a/Source/WebCore/html/InputType.h
+++ b/Source/WebCore/html/InputType.h
@@ -33,6 +33,7 @@
 #define InputType_h
 
 #include <wtf/Forward.h>
+#include <wtf/FastAllocBase.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
@@ -56,17 +57,18 @@ class WheelEvent;
 typedef int ExceptionCode;
 
 struct ClickHandlingState {
+    WTF_MAKE_FAST_ALLOCATED;
+public:
     bool checked;
     bool indeterminate;
     RefPtr<HTMLInputElement> checkedRadioButton;
-
-    WTF_MAKE_FAST_ALLOCATED
 };
 
 // An InputType object represents the type-specific part of an HTMLInputElement.
 // Do not expose instances of InputType and classes derived from it to classes
 // other than HTMLInputElement.
-class InputType : public Noncopyable {
+class InputType {
+    WTF_MAKE_NONCOPYABLE(InputType); WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*, const String&);
     static PassOwnPtr<InputType> createText(HTMLInputElement*);
@@ -153,6 +155,7 @@ public:
     // Event handlers
 
     virtual void handleClickEvent(MouseEvent*);
+    virtual void handleMouseDownEvent(MouseEvent*);
     virtual PassOwnPtr<ClickHandlingState> willDispatchClick();
     virtual void didDispatchClick(Event*, const ClickHandlingState&);
     virtual void handleDOMActivateEvent(Event*);
diff --git a/Source/WebCore/html/RangeInputType.cpp b/Source/WebCore/html/RangeInputType.cpp
index 7d0a38c..e9ac295 100644
--- a/Source/WebCore/html/RangeInputType.cpp
+++ b/Source/WebCore/html/RangeInputType.cpp
@@ -36,6 +36,8 @@
 #include "HTMLNames.h"
 #include "HTMLParserIdioms.h"
 #include "KeyboardEvent.h"
+#include "MouseEvent.h"
+#include "PlatformMouseEvent.h"
 #include "RenderSlider.h"
 #include "SliderThumbElement.h"
 #include "StepRange.h"
@@ -141,6 +143,15 @@ double RangeInputType::stepScaleFactor() const
     return rangeStepScaleFactor;
 }
 
+void RangeInputType::handleMouseDownEvent(MouseEvent* event)
+{
+    if (event->button() != LeftButton || event->target() != element())
+        return;
+
+    if (SliderThumbElement* thumb = toSliderThumbElement(element()->shadowRoot()))
+        thumb->dragFrom(event->absoluteLocation());
+}
+
 void RangeInputType::handleKeydownEvent(KeyboardEvent* event)
 {
     const String& key = event->keyIdentifier();
@@ -181,6 +192,7 @@ void RangeInputType::handleKeydownEvent(KeyboardEvent* event)
     event->setDefaultHandled();
 }
 
+<<<<<<< HEAD
 void RangeInputType::forwardEvent(Event* event)
 {
     if (element()->renderer()
@@ -193,6 +205,8 @@ void RangeInputType::forwardEvent(Event* event)
         toRenderSlider(element()->renderer())->forwardEvent(event);
 }
 
+=======
+>>>>>>> WebKit.org at r76408
 void RangeInputType::createShadowSubtree()
 {
     element()->setShadowRoot(SliderThumbElement::create(element()->document()));
diff --git a/Source/WebCore/html/RangeInputType.h b/Source/WebCore/html/RangeInputType.h
index 57eb299..15d224d 100644
--- a/Source/WebCore/html/RangeInputType.h
+++ b/Source/WebCore/html/RangeInputType.h
@@ -55,8 +55,8 @@ private:
     virtual double stepBase() const;
     virtual double defaultStep() const;
     virtual double stepScaleFactor() const;
+    virtual void handleMouseDownEvent(MouseEvent*);
     virtual void handleKeydownEvent(KeyboardEvent*);
-    virtual void forwardEvent(Event*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*) const;
     virtual void createShadowSubtree();
     virtual double parseToDouble(const String&, double) const;
diff --git a/Source/WebCore/html/StepRange.h b/Source/WebCore/html/StepRange.h
index ce044ea..2fa1393 100644
--- a/Source/WebCore/html/StepRange.h
+++ b/Source/WebCore/html/StepRange.h
@@ -28,7 +28,8 @@ namespace WebCore {
 
 class HTMLInputElement;
 
-class StepRange : public Noncopyable {
+class StepRange {
+    WTF_MAKE_NONCOPYABLE(StepRange);
 public:
     bool hasStep;
     double step;
diff --git a/Source/WebCore/html/ValidationMessage.h b/Source/WebCore/html/ValidationMessage.h
index 5fa1f96..7cd0cbb 100644
--- a/Source/WebCore/html/ValidationMessage.h
+++ b/Source/WebCore/html/ValidationMessage.h
@@ -42,7 +42,8 @@ namespace WebCore {
 class FormAssociatedElement;
 class HTMLElement;
 
-class ValidationMessage : public Noncopyable {
+class ValidationMessage {
+    WTF_MAKE_NONCOPYABLE(ValidationMessage);
 public:
     static PassOwnPtr<ValidationMessage> create(FormAssociatedElement*);
     ~ValidationMessage();
diff --git a/Source/WebCore/html/ValidityState.h b/Source/WebCore/html/ValidityState.h
index e140c49..4a96488 100644
--- a/Source/WebCore/html/ValidityState.h
+++ b/Source/WebCore/html/ValidityState.h
@@ -29,7 +29,8 @@
 
 namespace WebCore {
 
-class ValidityState : public Noncopyable {
+class ValidityState {
+    WTF_MAKE_NONCOPYABLE(ValidityState); WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<ValidityState> create(FormAssociatedElement* control)
     {
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext.h b/Source/WebCore/html/canvas/CanvasRenderingContext.h
index a25e8a1..a143596 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext.h
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext.h
@@ -41,7 +41,8 @@ class HTMLVideoElement;
 class KURL;
 class WebGLObject;
 
-class CanvasRenderingContext : public Noncopyable {
+class CanvasRenderingContext {
+    WTF_MAKE_NONCOPYABLE(CanvasRenderingContext); WTF_MAKE_FAST_ALLOCATED;
 public:
     CanvasRenderingContext(HTMLCanvasElement*);
     virtual ~CanvasRenderingContext() { }
diff --git a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 62c5793..e029128 100644
--- a/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/Source/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -57,6 +57,7 @@
 #include "Settings.h"
 #include "StrokeStyleApplier.h"
 #include "TextMetrics.h"
+#include "TextRun.h"
 
 #if ENABLE(ACCELERATED_2D_CANVAS)
 #include "Chrome.h"
@@ -170,7 +171,7 @@ void CanvasRenderingContext2D::reset()
     m_path.clear();
 #if ENABLE(ACCELERATED_2D_CANVAS)
     if (GraphicsContext* c = drawingContext()) {
-        if (m_context3D) {
+        if (m_context3D && m_drawingBuffer) {
             m_drawingBuffer->reset(IntSize(canvas()->width(), canvas()->height()));
             c->setSharedGraphicsContext3D(m_context3D.get(), m_drawingBuffer.get(), IntSize(canvas()->width(), canvas()->height()));
         }
@@ -537,7 +538,7 @@ void CanvasRenderingContext2D::transform(float m11, float m12, float m21, float
         return;
 
     AffineTransform transform(m11, m12, m21, m22, dx, dy);
-    AffineTransform newTransform = transform * state().m_transform;
+    AffineTransform newTransform = state().m_transform * transform;
     if (!newTransform.isInvertible()) {
         state().m_invertibleCTM = false;
         return;
@@ -562,7 +563,7 @@ void CanvasRenderingContext2D::setTransform(float m11, float m12, float m21, flo
         return;
     c->concatCTM(c->getCTM().inverse());
     c->concatCTM(canvas()->baseTransform());
-    state().m_transform.multiply(ctm.inverse());
+    state().m_transform = ctm.inverse() * state().m_transform;
     m_path.transform(ctm);
 
     state().m_invertibleCTM = true;
@@ -1895,7 +1896,7 @@ void CanvasRenderingContext2D::paintRenderingResultsToCanvas()
 #if ENABLE(ACCELERATED_2D_CANVAS) && USE(ACCELERATED_COMPOSITING)
 PlatformLayer* CanvasRenderingContext2D::platformLayer() const
 {
-    return m_drawingBuffer->platformLayer();
+    return m_drawingBuffer ? m_drawingBuffer->platformLayer() : 0;
 }
 #endif
 
diff --git a/Source/WebCore/html/canvas/CheckedInt.h b/Source/WebCore/html/canvas/CheckedInt.h
index 861e8e6..b83ac19 100644
--- a/Source/WebCore/html/canvas/CheckedInt.h
+++ b/Source/WebCore/html/canvas/CheckedInt.h
@@ -60,29 +60,93 @@ namespace CheckedInt_internal {
 
 struct unsupported_type {};
 
-template<typename T> struct integer_type_manually_recorded_info
-{
-    enum { is_supported = 0 };
-    typedef unsupported_type twice_bigger_type;
-};
+template<typename T> struct integer_type_manually_recorded_info;
 
 
-#define CHECKEDINT_REGISTER_SUPPORTED_TYPE(T,_twice_bigger_type)  \
+#define CHECKEDINT_REGISTER_SUPPORTED_TYPE(T,_twice_bigger_type,_unsigned_type) \
 template<> struct integer_type_manually_recorded_info<T>       \
 {                                                              \
     enum { is_supported = 1 };                                 \
     typedef _twice_bigger_type twice_bigger_type;              \
-    static void TYPE_NOT_SUPPORTED_BY_CheckedInt() {}             \
+    typedef _unsigned_type unsigned_type;                      \
 };
 
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(int8_t,   int16_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint8_t,  uint16_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(int16_t,  int32_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint16_t, uint32_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(int32_t,  int64_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint32_t, uint64_t)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(int64_t,  unsupported_type)
-CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint64_t, unsupported_type)
+//                                 Type      Twice Bigger Type   Unsigned Type
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(int8_t,   int16_t,             uint8_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint8_t,  uint16_t,            uint8_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(int16_t,  int32_t,             uint16_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint16_t, uint32_t,            uint16_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(int32_t,  int64_t,             uint32_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint32_t, uint64_t,            uint32_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(int64_t,  unsupported_type,    uint64_t)
+CHECKEDINT_REGISTER_SUPPORTED_TYPE(uint64_t, unsupported_type,    uint64_t)
+
+// now implement the fallback for standard types like int, long, ...
+// the difficulty is that they may or may not be equal to one of the above types, and/or
+// to each other. This is why any attempt to handle at once PRInt8... types and standard types
+// is bound to fail.
+template<typename T>
+struct is_standard_integer_type { enum { value = 0 }; };
+
+template<>
+struct is_standard_integer_type<char> { enum { value = 1 }; };
+template<>
+struct is_standard_integer_type<unsigned char> { enum { value = 1 }; };
+template<>
+struct is_standard_integer_type<short> { enum { value = 1 }; };
+template<>
+struct is_standard_integer_type<unsigned short> { enum { value = 1 }; };
+template<>
+struct is_standard_integer_type<int> { enum { value = 1 }; };
+template<>
+struct is_standard_integer_type<unsigned int> { enum { value = 1 }; };
+template<>
+struct is_standard_integer_type<long> { enum { value = 1 }; };
+template<>
+struct is_standard_integer_type<unsigned long> { enum { value = 1 }; };
+template<>
+struct is_standard_integer_type<long long> { enum { value = 1 }; };
+template<>
+struct is_standard_integer_type<unsigned long long> { enum { value = 1 }; };
+
+template<int size, bool is_signed>
+struct explicitly_sized_integer_type {};
+
+template<>
+struct explicitly_sized_integer_type<1, true> { typedef int8_t type; };
+template<>
+struct explicitly_sized_integer_type<1, false> { typedef uint8_t type; };
+template<>
+struct explicitly_sized_integer_type<2, true> { typedef int16_t type; };
+template<>
+struct explicitly_sized_integer_type<2, false> { typedef uint16_t type; };
+template<>
+struct explicitly_sized_integer_type<4, true> { typedef int32_t type; };
+template<>
+struct explicitly_sized_integer_type<4, false> { typedef uint32_t type; };
+template<>
+struct explicitly_sized_integer_type<8, true> { typedef int64_t type; };
+template<>
+struct explicitly_sized_integer_type<8, false> { typedef uint64_t type; };
+
+template<typename T> struct integer_type_manually_recorded_info
+{
+    enum {
+      is_supported = is_standard_integer_type<T>::value,
+      size = sizeof(T),
+      is_signed = (T(-1) > T(0)) ? 0 : 1
+    };
+    typedef typename explicitly_sized_integer_type<size, is_signed>::type explicit_sized_type;
+    typedef integer_type_manually_recorded_info<explicit_sized_type> base;
+    typedef typename base::twice_bigger_type twice_bigger_type;
+    typedef typename base::unsigned_type unsigned_type;
+};
+
+template<typename T, bool is_supported = integer_type_manually_recorded_info<T>::is_supported>
+struct TYPE_NOT_SUPPORTED_BY_CheckedInt {};
+
+template<typename T>
+struct TYPE_NOT_SUPPORTED_BY_CheckedInt<T, true> { static void run() {} };
 
 
 /*** Step 2: record some info about a given integer type,
@@ -348,8 +412,7 @@ protected:
     template<typename U>
     CheckedInt(const U& value, bool isValid) : mValue(value), mIsValid(isValid)
     {
-        CheckedInt_internal::integer_type_manually_recorded_info<T>
-            ::TYPE_NOT_SUPPORTED_BY_CheckedInt();
+        CheckedInt_internal::TYPE_NOT_SUPPORTED_BY_CheckedInt<T>::run();
     }
 
 public:
@@ -366,15 +429,13 @@ public:
         : mValue(value),
           mIsValid(CheckedInt_internal::is_in_range<T>(value))
     {
-        CheckedInt_internal::integer_type_manually_recorded_info<T>
-            ::TYPE_NOT_SUPPORTED_BY_CheckedInt();
+        CheckedInt_internal::TYPE_NOT_SUPPORTED_BY_CheckedInt<T>::run();
     }
 
     /** Constructs a valid checked integer with uninitialized value */
     CheckedInt() : mIsValid(1)
     {
-        CheckedInt_internal::integer_type_manually_recorded_info<T>
-            ::TYPE_NOT_SUPPORTED_BY_CheckedInt();
+        CheckedInt_internal::TYPE_NOT_SUPPORTED_BY_CheckedInt<T>::run();
     }
 
     /** \returns the actual value */
diff --git a/Source/WebCore/html/canvas/OESStandardDerivatives.cpp b/Source/WebCore/html/canvas/OESStandardDerivatives.cpp
new file mode 100644
index 0000000..25aae2f
--- /dev/null
+++ b/Source/WebCore/html/canvas/OESStandardDerivatives.cpp
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(3D_CANVAS)
+
+#include "OESStandardDerivatives.h"
+
+namespace WebCore {
+
+OESStandardDerivatives::OESStandardDerivatives() : WebGLExtension()
+{
+}
+
+OESStandardDerivatives::~OESStandardDerivatives()
+{
+}
+
+WebGLExtension::ExtensionName OESStandardDerivatives::getName() const
+{
+    return OESStandardDerivativesName;
+}
+
+PassRefPtr<OESStandardDerivatives> OESStandardDerivatives::create()
+{
+    return adoptRef(new OESStandardDerivatives);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(3D_CANVAS)
diff --git a/Source/WebCore/html/canvas/OESStandardDerivatives.h b/Source/WebCore/html/canvas/OESStandardDerivatives.h
new file mode 100644
index 0000000..c74e24f
--- /dev/null
+++ b/Source/WebCore/html/canvas/OESStandardDerivatives.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef OESStandardDerivatives_h
+#define OESStandardDerivatives_h
+
+#include "WebGLExtension.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class OESStandardDerivatives : public WebGLExtension {
+public:
+    static PassRefPtr<OESStandardDerivatives> create();
+
+    virtual ~OESStandardDerivatives();
+    virtual ExtensionName getName() const;
+
+private:
+    OESStandardDerivatives();
+};
+
+} // namespace WebCore
+
+#endif // OESStandardDerivatives_h
diff --git a/Source/WebCore/html/canvas/OESStandardDerivatives.idl b/Source/WebCore/html/canvas/OESStandardDerivatives.idl
new file mode 100644
index 0000000..a9d1dd6
--- /dev/null
+++ b/Source/WebCore/html/canvas/OESStandardDerivatives.idl
@@ -0,0 +1,30 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module html {
+    interface [Conditional=3D_CANVAS, OmitConstructor, DontCheckEnums] OESStandardDerivatives {
+        const unsigned int FRAGMENT_SHADER_DERIVATIVE_HINT_OES = 0x8B8B;
+    };
+}
diff --git a/Source/WebCore/html/canvas/TypedArrayBase.h b/Source/WebCore/html/canvas/TypedArrayBase.h
index 2bef6f0..a828620 100644
--- a/Source/WebCore/html/canvas/TypedArrayBase.h
+++ b/Source/WebCore/html/canvas/TypedArrayBase.h
@@ -60,7 +60,12 @@ class TypedArrayBase : public ArrayBufferView {
         return m_length;
     }
 
- protected:
+    virtual unsigned byteLength() const
+    {
+        return m_length * sizeof(T);
+    }
+
+protected:
     TypedArrayBase(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length)
         : ArrayBufferView(buffer, byteOffset)
         , m_length(length)
@@ -110,13 +115,6 @@ class TypedArrayBase : public ArrayBufferView {
     // We do not want to have to access this via a virtual function in subclasses,
     // which is why it is protected rather than private.
     unsigned m_length;
-
-  private:
-    // Overridden from ArrayBufferView.
-    virtual unsigned byteLength() const
-    {
-        return m_length * sizeof(T);
-    }
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/html/canvas/WebGLBuffer.cpp b/Source/WebCore/html/canvas/WebGLBuffer.cpp
index 4566bfa..849472b 100644
--- a/Source/WebCore/html/canvas/WebGLBuffer.cpp
+++ b/Source/WebCore/html/canvas/WebGLBuffer.cpp
@@ -61,9 +61,9 @@ bool WebGLBuffer::associateBufferDataImpl(ArrayBuffer* array, GC3Dintptr byteOff
         return false;
 
     if (array && byteLength) {
-        CheckedInt<int32_t> checkedOffset(byteOffset);
-        CheckedInt<int32_t> checkedLength(byteLength);
-        CheckedInt<int32_t> checkedMax = checkedOffset + checkedLength;
+        CheckedInt<GC3Dintptr> checkedOffset(byteOffset);
+        CheckedInt<GC3Dsizeiptr> checkedLength(byteLength);
+        CheckedInt<GC3Dintptr> checkedMax = checkedOffset + checkedLength;
         if (!checkedMax.valid() || checkedMax.value() > static_cast<int32_t>(array->byteLength()))
             return false;
     }
@@ -124,11 +124,11 @@ bool WebGLBuffer::associateBufferSubDataImpl(GC3Dintptr offset, ArrayBuffer* arr
         return false;
 
     if (byteLength) {
-        CheckedInt<int32_t> checkedBufferOffset(offset);
-        CheckedInt<int32_t> checkedArrayOffset(arrayByteOffset);
-        CheckedInt<int32_t> checkedLength(byteLength);
-        CheckedInt<int32_t> checkedArrayMax = checkedArrayOffset + checkedLength;
-        CheckedInt<int32_t> checkedBufferMax = checkedBufferOffset + checkedLength;
+        CheckedInt<GC3Dintptr> checkedBufferOffset(offset);
+        CheckedInt<GC3Dintptr> checkedArrayOffset(arrayByteOffset);
+        CheckedInt<GC3Dsizeiptr> checkedLength(byteLength);
+        CheckedInt<GC3Dintptr> checkedArrayMax = checkedArrayOffset + checkedLength;
+        CheckedInt<GC3Dintptr> checkedBufferMax = checkedBufferOffset + checkedLength;
         if (!checkedArrayMax.valid() || checkedArrayMax.value() > static_cast<int32_t>(array->byteLength()) || !checkedBufferMax.valid() || checkedBufferMax.value() > m_byteLength)
             return false;
     }
diff --git a/Source/WebCore/html/canvas/WebGLExtension.h b/Source/WebCore/html/canvas/WebGLExtension.h
index f2d6b7b..d135c18 100644
--- a/Source/WebCore/html/canvas/WebGLExtension.h
+++ b/Source/WebCore/html/canvas/WebGLExtension.h
@@ -36,6 +36,7 @@ public:
     enum ExtensionName {
         WebKitLoseContextName,
         OESTextureFloatName,
+        OESStandardDerivativesName,
     };
 
     virtual ~WebGLExtension();
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
index c445e2b..a3b9699 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -44,6 +44,7 @@
 #include "ImageData.h"
 #include "IntSize.h"
 #include "NotImplemented.h"
+#include "OESStandardDerivatives.h"
 #include "OESTextureFloat.h"
 #include "RenderBox.h"
 #include "RenderLayer.h"
@@ -62,6 +63,7 @@
 #include <wtf/ByteArray.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/PassOwnArrayPtr.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -101,12 +103,11 @@ namespace {
 
     // Return true if a character belongs to the ASCII subset as defined in
     // GLSL ES 1.0 spec section 3.1.
-    // We make exceptions for " ' `.
     bool validateCharacter(unsigned char c)
     {
         // Printing characters are valid except " $ ` @ \ ' DEL.
         if (c >= 32 && c <= 126
-            && c != '$' && c != '@' && c != '\\')
+            && c != '"' && c != '$' && c != '`' && c != '@' && c != '\\' && c != '\'')
             return true;
         // Horizontal tab, line feed, vertical tab, form feed, carriage return
         // are also valid.
@@ -115,6 +116,189 @@ namespace {
         return false;
     }
 
+    // Strips comments from shader text. This allows non-ASCII characters
+    // to be used in comments without potentially breaking OpenGL
+    // implementations not expecting characters outside the GLSL ES set.
+    class StripComments {
+    public:
+        StripComments(const String& str)
+            : m_parseState(BeginningOfLine)
+            , m_sourceString(str)
+            , m_length(str.length())
+            , m_position(0)
+        {
+            parse();
+        }
+
+        String result()
+        {
+            return m_builder.toString();
+        }
+
+    private:
+        bool hasMoreCharacters()
+        {
+            return (m_position < m_length);
+        }
+
+        void parse()
+        {
+            while (hasMoreCharacters()) {
+                process(current());
+                // process() might advance the position.
+                if (hasMoreCharacters())
+                    advance();
+            }
+        }
+
+        void process(UChar);
+
+        bool peek(UChar& character)
+        {
+            if (m_position + 1 >= m_length)
+                return false;
+            character = m_sourceString[m_position + 1];
+            return true;
+        }
+
+        UChar current()
+        {
+            ASSERT(m_position < m_length);
+            return m_sourceString[m_position];
+        }
+
+        void advance()
+        {
+            ++m_position;
+        }
+
+        bool isNewline(UChar character)
+        {
+            // Don't attempt to canonicalize newline related characters.
+            return (character == '\n' || character == '\r');
+        }
+
+        void emit(UChar character)
+        {
+            m_builder.append(character);
+        }
+
+        enum ParseState {
+            // Have not seen an ASCII non-whitespace character yet on
+            // this line. Possible that we might see a preprocessor
+            // directive.
+            BeginningOfLine,
+
+            // Have seen at least one ASCII non-whitespace character
+            // on this line.
+            MiddleOfLine,
+
+            // Handling a preprocessor directive. Passes through all
+            // characters up to the end of the line. Disables comment
+            // processing.
+            InPreprocessorDirective,
+
+            // Handling a single-line comment. The comment text is
+            // replaced with a single space.
+            InSingleLineComment,
+
+            // Handling a multi-line comment. Newlines are passed
+            // through to preserve line numbers.
+            InMultiLineComment
+        };
+
+        ParseState m_parseState;
+        String m_sourceString;
+        unsigned m_length;
+        unsigned m_position;
+        StringBuilder m_builder;
+    };
+
+    void StripComments::process(UChar c)
+    {
+        if (isNewline(c)) {
+            // No matter what state we are in, pass through newlines
+            // so we preserve line numbers.
+            emit(c);
+
+            if (m_parseState != InMultiLineComment)
+                m_parseState = BeginningOfLine;
+
+            return;
+        }
+
+        UChar temp = 0;
+        switch (m_parseState) {
+        case BeginningOfLine:
+            if (WTF::isASCIISpace(c)) {
+                emit(c);
+                break;
+            }
+
+            if (c == '#') {
+                m_parseState = InPreprocessorDirective;
+                emit(c);
+                break;
+            }
+
+            // Transition to normal state and re-handle character.
+            m_parseState = MiddleOfLine;
+            process(c);
+            break;
+
+        case MiddleOfLine:
+            if (c == '/' && peek(temp)) {
+                if (temp == '/') {
+                    m_parseState = InSingleLineComment;
+                    emit(' ');
+                    advance();
+                    break;
+                }
+
+                if (temp == '*') {
+                    m_parseState = InMultiLineComment;
+                    // Emit the comment start in case the user has
+                    // an unclosed comment and we want to later
+                    // signal an error.
+                    emit('/');
+                    emit('*');
+                    advance();
+                    break;
+                }
+            }
+
+            emit(c);
+            break;
+
+        case InPreprocessorDirective:
+            // No matter what the character is, just pass it
+            // through. Do not parse comments in this state. This
+            // might not be the right thing to do long term, but it
+            // should handle the #error preprocessor directive.
+            emit(c);
+            break;
+
+        case InSingleLineComment:
+            // The newline code at the top of this function takes care
+            // of resetting our state when we get out of the
+            // single-line comment. Swallow all other characters.
+            break;
+
+        case InMultiLineComment:
+            if (c == '*' && peek(temp) && temp == '/') {
+                emit('*');
+                emit('/');
+                m_parseState = MiddleOfLine;
+                advance();
+                break;
+            }
+
+            // Swallow all other characters. Unclear whether we may
+            // want or need to just emit a space per character to try
+            // to preserve column numbers for debugging purposes.
+            break;
+        }
+    }
 } // namespace anonymous
 
 class WebGLStateRestorer {
@@ -1574,6 +1758,14 @@ WebGLExtension* WebGLRenderingContext::getExtension(const String& name)
     if (isContextLost())
         return 0;
 
+    if (equalIgnoringCase(name, "OES_standard_derivatives")
+        && m_context->getExtensions()->supports("GL_OES_standard_derivatives")) {
+        if (!m_oesStandardDerivatives) {
+            m_context->getExtensions()->ensureEnabled("GL_OES_standard_derivatives");
+            m_oesStandardDerivatives = OESStandardDerivatives::create();
+        }
+        return m_oesStandardDerivatives.get();
+    }
     if (equalIgnoringCase(name, "OES_texture_float")
         && m_context->getExtensions()->supports("GL_OES_texture_float")) {
         if (!m_oesTextureFloat) {
@@ -1581,7 +1773,8 @@ WebGLExtension* WebGLRenderingContext::getExtension(const String& name)
             m_oesTextureFloat = OESTextureFloat::create();
         }
         return m_oesTextureFloat.get();
-    } else if (equalIgnoringCase(name, "WEBKIT_lose_context")) {
+    }
+    if (equalIgnoringCase(name, "WEBKIT_lose_context")) {
         if (!m_webkitLoseContext)
             m_webkitLoseContext = WebKitLoseContext::create(this);
         return m_webkitLoseContext.get();
@@ -1823,6 +2016,11 @@ WebGLGetInfo WebGLRenderingContext::getParameter(GC3Denum pname, ExceptionCode&
         return WebGLGetInfo("WebGL 1.0 (" + m_context->getString(GraphicsContext3D::VERSION) + ")");
     case GraphicsContext3D::VIEWPORT:
         return getWebGLIntArrayParameter(pname);
+    case Extensions3D::FRAGMENT_SHADER_DERIVATIVE_HINT_OES: // OES_standard_derivatives
+        if (m_oesStandardDerivatives)
+            return getUnsignedLongParameter(Extensions3D::FRAGMENT_SHADER_DERIVATIVE_HINT_OES);
+        m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
+        return WebGLGetInfo();
     default:
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return WebGLGetInfo();
@@ -1990,6 +2188,8 @@ Vector<String> WebGLRenderingContext::getSupportedExtensions()
     Vector<String> result;
     if (m_context->getExtensions()->supports("GL_OES_texture_float"))
         result.append("OES_texture_float");
+    if (m_context->getExtensions()->supports("GL_OES_standard_derivatives"))
+        result.append("OES_standard_derivatives");
     result.append("WEBKIT_lose_context");
     return result;
 }
@@ -2234,7 +2434,17 @@ void WebGLRenderingContext::hint(GC3Denum target, GC3Denum mode)
 {
     if (isContextLost())
         return;
-    if (target != GraphicsContext3D::GENERATE_MIPMAP_HINT) {
+    bool isValid = false;
+    switch (target) {
+    case GraphicsContext3D::GENERATE_MIPMAP_HINT:
+        isValid = true;
+        break;
+    case Extensions3D::FRAGMENT_SHADER_DERIVATIVE_HINT_OES: // OES_standard_derivatives
+        if (m_oesStandardDerivatives)
+            isValid = true;
+        break;
+    }
+    if (!isValid) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_ENUM);
         return;
     }
@@ -2547,9 +2757,10 @@ void WebGLRenderingContext::shaderSource(WebGLShader* shader, const String& stri
     UNUSED_PARAM(ec);
     if (isContextLost() || !validateWebGLObject(shader))
         return;
-    if (!validateString(string))
+    String stringWithoutComments = StripComments(string).result();
+    if (!validateString(stringWithoutComments))
         return;
-    m_context->shaderSource(objectOrZero(shader), string);
+    m_context->shaderSource(objectOrZero(shader), stringWithoutComments);
     cleanupAfterGraphicsCall(false);
 }
 
@@ -4352,11 +4563,16 @@ void WebGLRenderingContext::restoreStatesAfterVertexAttrib0Simulation()
 
 int WebGLRenderingContext::getNumberOfExtensions()
 {
-    return (m_webkitLoseContext ? 1 : 0) + (m_oesTextureFloat ? 1 : 0);
+    return (m_oesStandardDerivatives ? 1 : 0) + (m_webkitLoseContext ? 1 : 0) + (m_oesTextureFloat ? 1 : 0);
 }
 
 WebGLExtension* WebGLRenderingContext::getExtensionNumber(int i)
 {
+    if (m_oesStandardDerivatives) {
+        if (!i)
+            return m_oesStandardDerivatives.get();
+        --i;
+    }
     if (m_webkitLoseContext) {
         if (!i)
             return m_webkitLoseContext.get();
diff --git a/Source/WebCore/html/canvas/WebGLRenderingContext.h b/Source/WebCore/html/canvas/WebGLRenderingContext.h
index d9b738c..01b5438 100644
--- a/Source/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/Source/WebCore/html/canvas/WebGLRenderingContext.h
@@ -57,6 +57,7 @@ class HTMLVideoElement;
 class ImageBuffer;
 class ImageData;
 class IntSize;
+class OESStandardDerivatives;
 class OESTextureFloat;
 
 class WebGLRenderingContext : public CanvasRenderingContext {
@@ -452,6 +453,7 @@ public:
 
     // Enabled extension objects.
     RefPtr<OESTextureFloat> m_oesTextureFloat;
+    RefPtr<OESStandardDerivatives> m_oesStandardDerivatives;
     RefPtr<WebKitLoseContext> m_webkitLoseContext;
 
     // Helpers for getParameter and others
diff --git a/Source/WebCore/html/parser/CSSPreloadScanner.h b/Source/WebCore/html/parser/CSSPreloadScanner.h
index 7ac282f..fae95a1 100644
--- a/Source/WebCore/html/parser/CSSPreloadScanner.h
+++ b/Source/WebCore/html/parser/CSSPreloadScanner.h
@@ -35,7 +35,8 @@ namespace WebCore {
 class Document;
 class HTMLToken;
 
-class CSSPreloadScanner : public Noncopyable {
+class CSSPreloadScanner {
+    WTF_MAKE_NONCOPYABLE(CSSPreloadScanner);
 public:
     CSSPreloadScanner(Document*);
 
diff --git a/Source/WebCore/html/parser/HTMLConstructionSite.h b/Source/WebCore/html/parser/HTMLConstructionSite.h
index 8b09bf5..5a4a65d 100644
--- a/Source/WebCore/html/parser/HTMLConstructionSite.h
+++ b/Source/WebCore/html/parser/HTMLConstructionSite.h
@@ -40,7 +40,8 @@ class AtomicHTMLToken;
 class Document;
 class Element;
 
-class HTMLConstructionSite : public Noncopyable {
+class HTMLConstructionSite {
+    WTF_MAKE_NONCOPYABLE(HTMLConstructionSite);
 public:
     HTMLConstructionSite(Document*, FragmentScriptingPermission, bool isParsingFragment);
     ~HTMLConstructionSite();
@@ -89,7 +90,8 @@ public:
     HTMLFormElement* form() const { return m_form.get(); }
     PassRefPtr<HTMLFormElement> takeForm();
 
-    class RedirectToFosterParentGuard : public Noncopyable {
+    class RedirectToFosterParentGuard {
+        WTF_MAKE_NONCOPYABLE(RedirectToFosterParentGuard);
     public:
         RedirectToFosterParentGuard(HTMLConstructionSite& tree)
             : m_tree(tree)
diff --git a/Source/WebCore/html/parser/HTMLDocumentParser.h b/Source/WebCore/html/parser/HTMLDocumentParser.h
index 80ca727..f925269 100644
--- a/Source/WebCore/html/parser/HTMLDocumentParser.h
+++ b/Source/WebCore/html/parser/HTMLDocumentParser.h
@@ -50,6 +50,7 @@ class ScriptController;
 class ScriptSourceCode;
 
 class HTMLDocumentParser :  public ScriptableDocumentParser, HTMLScriptRunnerHost, CachedResourceClient {
+    WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassRefPtr<HTMLDocumentParser> create(HTMLDocument* document, bool reportErrors)
     {
diff --git a/Source/WebCore/html/parser/HTMLElementStack.h b/Source/WebCore/html/parser/HTMLElementStack.h
index 8a8e160..ad8b941 100644
--- a/Source/WebCore/html/parser/HTMLElementStack.h
+++ b/Source/WebCore/html/parser/HTMLElementStack.h
@@ -39,12 +39,14 @@ class QualifiedName;
 
 // NOTE: The HTML5 spec uses a backwards (grows downward) stack.  We're using
 // more standard (grows upwards) stack terminology here.
-class HTMLElementStack : public Noncopyable {
+class HTMLElementStack {
+    WTF_MAKE_NONCOPYABLE(HTMLElementStack); WTF_MAKE_FAST_ALLOCATED;
 public:
     HTMLElementStack();
     ~HTMLElementStack();
 
-    class ElementRecord : public Noncopyable {
+    class ElementRecord {
+        WTF_MAKE_NONCOPYABLE(ElementRecord);
     public:
         ~ElementRecord(); // Public for ~PassOwnPtr()
     
diff --git a/Source/WebCore/html/parser/HTMLFormattingElementList.h b/Source/WebCore/html/parser/HTMLFormattingElementList.h
index aca05bb..f75fa50 100644
--- a/Source/WebCore/html/parser/HTMLFormattingElementList.h
+++ b/Source/WebCore/html/parser/HTMLFormattingElementList.h
@@ -35,7 +35,8 @@ namespace WebCore {
 class Element;
 
 // This may end up merged into HTMLElementStack.
-class HTMLFormattingElementList : public Noncopyable {
+class HTMLFormattingElementList {
+    WTF_MAKE_NONCOPYABLE(HTMLFormattingElementList);
 public:
     HTMLFormattingElementList();
     ~HTMLFormattingElementList();
diff --git a/Source/WebCore/html/parser/HTMLInputStream.h b/Source/WebCore/html/parser/HTMLInputStream.h
index 1bfbaf9..d95ec31 100644
--- a/Source/WebCore/html/parser/HTMLInputStream.h
+++ b/Source/WebCore/html/parser/HTMLInputStream.h
@@ -47,7 +47,8 @@ namespace WebCore {
 // m_last is a pointer to the last of the afterInsertionPoint strings.
 // The network adds data at the end of the InputStream, which appends
 // them to the "last" string.
-class HTMLInputStream : public Noncopyable {
+class HTMLInputStream {
+    WTF_MAKE_NONCOPYABLE(HTMLInputStream);
 public:
     HTMLInputStream()
         : m_last(&m_first)
@@ -129,7 +130,8 @@ private:
     SegmentedString* m_last;
 };
 
-class InsertionPointRecord : public Noncopyable {
+class InsertionPointRecord {
+    WTF_MAKE_NONCOPYABLE(InsertionPointRecord);
 public:
     explicit InsertionPointRecord(HTMLInputStream& inputStream)
         : m_inputStream(&inputStream)
diff --git a/Source/WebCore/html/parser/HTMLMetaCharsetParser.h b/Source/WebCore/html/parser/HTMLMetaCharsetParser.h
index c3136f5..45fbaf7 100644
--- a/Source/WebCore/html/parser/HTMLMetaCharsetParser.h
+++ b/Source/WebCore/html/parser/HTMLMetaCharsetParser.h
@@ -36,7 +36,8 @@ namespace WebCore {
 class HTMLTokenizer;
 class TextCodec;
 
-class HTMLMetaCharsetParser : public Noncopyable {
+class HTMLMetaCharsetParser {
+    WTF_MAKE_NONCOPYABLE(HTMLMetaCharsetParser);
 public:
     static PassOwnPtr<HTMLMetaCharsetParser> create() { return adoptPtr(new HTMLMetaCharsetParser()); }
 
diff --git a/Source/WebCore/html/parser/HTMLParserScheduler.h b/Source/WebCore/html/parser/HTMLParserScheduler.h
index 3a20b2b..c415c62 100644
--- a/Source/WebCore/html/parser/HTMLParserScheduler.h
+++ b/Source/WebCore/html/parser/HTMLParserScheduler.h
@@ -28,14 +28,14 @@
 
 #include "Timer.h"
 #include <wtf/CurrentTime.h>
-#include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
 class HTMLDocumentParser;
 
-class HTMLParserScheduler :  public Noncopyable {
+class HTMLParserScheduler {
+    WTF_MAKE_NONCOPYABLE(HTMLParserScheduler); WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<HTMLParserScheduler> create(HTMLDocumentParser* parser)
     {
diff --git a/Source/WebCore/html/parser/HTMLPreloadScanner.h b/Source/WebCore/html/parser/HTMLPreloadScanner.h
index 94a90e6..bed77fe 100644
--- a/Source/WebCore/html/parser/HTMLPreloadScanner.h
+++ b/Source/WebCore/html/parser/HTMLPreloadScanner.h
@@ -30,7 +30,6 @@
 #include "CSSPreloadScanner.h"
 #include "HTMLToken.h"
 #include "SegmentedString.h"
-#include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
@@ -39,7 +38,8 @@ class HTMLToken;
 class HTMLTokenizer;
 class SegmentedString;
 
-class HTMLPreloadScanner : public Noncopyable {
+class HTMLPreloadScanner {
+    WTF_MAKE_NONCOPYABLE(HTMLPreloadScanner); WTF_MAKE_FAST_ALLOCATED;
 public:
     HTMLPreloadScanner(Document*);
 
diff --git a/Source/WebCore/html/parser/HTMLScriptRunner.h b/Source/WebCore/html/parser/HTMLScriptRunner.h
index 6cf74d8..986f7bd 100644
--- a/Source/WebCore/html/parser/HTMLScriptRunner.h
+++ b/Source/WebCore/html/parser/HTMLScriptRunner.h
@@ -29,7 +29,6 @@
 #include "PendingScript.h"
 #include <wtf/Deque.h>
 #include <wtf/text/TextPosition.h>
-#include <wtf/Noncopyable.h>
 #include <wtf/PassRefPtr.h>
 
 namespace WebCore {
@@ -42,7 +41,8 @@ class Frame;
 class HTMLScriptRunnerHost;
 class ScriptSourceCode;
 
-class HTMLScriptRunner : public Noncopyable {
+class HTMLScriptRunner {
+    WTF_MAKE_NONCOPYABLE(HTMLScriptRunner); WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<HTMLScriptRunner> create(Document* document, HTMLScriptRunnerHost* host)
     {
diff --git a/Source/WebCore/html/parser/HTMLToken.h b/Source/WebCore/html/parser/HTMLToken.h
index 42cddb8..1cbc151 100644
--- a/Source/WebCore/html/parser/HTMLToken.h
+++ b/Source/WebCore/html/parser/HTMLToken.h
@@ -27,13 +27,13 @@
 #define HTMLToken_h
 
 #include "NamedNodeMap.h"
-#include <wtf/Noncopyable.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
-class HTMLToken : public Noncopyable {
+class HTMLToken {
+    WTF_MAKE_NONCOPYABLE(HTMLToken); WTF_MAKE_FAST_ALLOCATED;
 public:
     enum Type {
         Uninitialized,
@@ -313,7 +313,8 @@ private:
     // want to end up with a cleaner interface between the two classes.
     friend class AtomicHTMLToken;
 
-    class DoctypeData : public Noncopyable {
+    class DoctypeData {
+        WTF_MAKE_NONCOPYABLE(DoctypeData);
     public:
         DoctypeData()
             : m_hasPublicIdentifier(false)
@@ -352,7 +353,8 @@ private:
 
 // FIXME: This class should eventually be named HTMLToken once we move the
 // exiting HTMLToken to be internal to the HTMLTokenizer.
-class AtomicHTMLToken : public Noncopyable {
+class AtomicHTMLToken {
+    WTF_MAKE_NONCOPYABLE(AtomicHTMLToken);
 public:
     AtomicHTMLToken(HTMLToken& token)
         : m_type(token.type())
diff --git a/Source/WebCore/html/parser/HTMLTokenizer.h b/Source/WebCore/html/parser/HTMLTokenizer.h
index f16b049..fa45cb2 100644
--- a/Source/WebCore/html/parser/HTMLTokenizer.h
+++ b/Source/WebCore/html/parser/HTMLTokenizer.h
@@ -39,7 +39,8 @@ class Element;
 class Frame;
 class HTMLToken;
 
-class HTMLTokenizer : public Noncopyable {
+class HTMLTokenizer {
+    WTF_MAKE_NONCOPYABLE(HTMLTokenizer); WTF_MAKE_FAST_ALLOCATED;
 public:
     enum State {
         DataState,
@@ -172,7 +173,8 @@ public:
 
 private:
     // http://www.whatwg.org/specs/web-apps/current-work/#preprocessing-the-input-stream
-    class InputStreamPreprocessor : public Noncopyable {
+    class InputStreamPreprocessor {
+        WTF_MAKE_NONCOPYABLE(InputStreamPreprocessor);
     public:
         InputStreamPreprocessor(HTMLTokenizer* tokenizer)
             : m_tokenizer(tokenizer)
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
index 02713e5..97cee13 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -241,7 +241,8 @@ HTMLFormElement* closestFormAncestor(Element* element)
 
 } // namespace
 
-class HTMLTreeBuilder::ExternalCharacterTokenBuffer : public Noncopyable {
+class HTMLTreeBuilder::ExternalCharacterTokenBuffer {
+    WTF_MAKE_NONCOPYABLE(ExternalCharacterTokenBuffer);
 public:
     explicit ExternalCharacterTokenBuffer(AtomicHTMLToken& token)
         : m_current(token.characters().data())
@@ -2342,7 +2343,8 @@ void HTMLTreeBuilder::reprocessEndTag(AtomicHTMLToken& token)
     processEndTag(token);
 }
 
-class HTMLTreeBuilder::FakeInsertionMode : public Noncopyable {
+class HTMLTreeBuilder::FakeInsertionMode {
+    WTF_MAKE_NONCOPYABLE(FakeInsertionMode);
 public:
     FakeInsertionMode(HTMLTreeBuilder* treeBuilder, InsertionMode mode)
         : m_treeBuilder(treeBuilder)
diff --git a/Source/WebCore/html/parser/HTMLTreeBuilder.h b/Source/WebCore/html/parser/HTMLTreeBuilder.h
index 17b77b7..309ac6f 100644
--- a/Source/WebCore/html/parser/HTMLTreeBuilder.h
+++ b/Source/WebCore/html/parser/HTMLTreeBuilder.h
@@ -51,7 +51,8 @@ class HTMLDocument;
 class Node;
 class HTMLDocumentParser;
 
-class HTMLTreeBuilder : public Noncopyable {
+class HTMLTreeBuilder {
+    WTF_MAKE_NONCOPYABLE(HTMLTreeBuilder); WTF_MAKE_FAST_ALLOCATED;
 public:
     static PassOwnPtr<HTMLTreeBuilder> create(HTMLDocumentParser* parser, HTMLDocument* document, bool reportErrors, bool usePreHTML5ParserQuirks)
     {
@@ -204,7 +205,8 @@ private:
     void processForeignContentUsingInBodyModeAndResetMode(AtomicHTMLToken& token);
     void resetForeignInsertionMode();
 
-    class FragmentParsingContext : public Noncopyable {
+    class FragmentParsingContext {
+        WTF_MAKE_NONCOPYABLE(FragmentParsingContext);
     public:
         FragmentParsingContext();
         FragmentParsingContext(DocumentFragment*, Element* contextElement, FragmentScriptingPermission);
diff --git a/Source/WebCore/html/parser/NestingLevelIncrementer.h b/Source/WebCore/html/parser/NestingLevelIncrementer.h
index c597876..8155635 100644
--- a/Source/WebCore/html/parser/NestingLevelIncrementer.h
+++ b/Source/WebCore/html/parser/NestingLevelIncrementer.h
@@ -28,7 +28,8 @@
 
 namespace WebCore {
 
-class NestingLevelIncrementer : public Noncopyable {
+class NestingLevelIncrementer {
+    WTF_MAKE_NONCOPYABLE(NestingLevelIncrementer);
 public:
     explicit NestingLevelIncrementer(unsigned& nestingLevel)
         : m_nestingLevel(&nestingLevel)
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.cpp b/Source/WebCore/html/shadow/SliderThumbElement.cpp
index d598da9..ad93261 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.cpp
+++ b/Source/WebCore/html/shadow/SliderThumbElement.cpp
@@ -35,9 +35,15 @@
 
 #include "Event.h"
 #include "Frame.h"
+#include "HTMLInputElement.h"
+#include "HTMLParserIdioms.h"
 #include "MouseEvent.h"
 #include "RenderSlider.h"
 #include "RenderTheme.h"
+#include "StepRange.h"
+#include <wtf/MathExtras.h>
+
+using namespace std;
 
 #if PLATFORM(ANDROID) && ENABLE(TOUCH_EVENTS)
 #include "TouchEvent.h"
@@ -52,7 +58,6 @@ public:
     virtual void layout();
 };
 
-
 RenderSliderThumb::RenderSliderThumb(Node* node)
     : RenderBlock(node)
 {
@@ -84,6 +89,70 @@ RenderObject* SliderThumbElement::createRenderer(RenderArena* arena, RenderStyle
     return new (arena) RenderSliderThumb(this);
 }
 
+void SliderThumbElement::dragFrom(const IntPoint& point)
+{
+    setPosition(point);
+    startDragging();
+}
+
+void SliderThumbElement::setPosition(const IntPoint& point)
+{
+    HTMLInputElement* input = static_cast<HTMLInputElement*>(shadowHost());
+    ASSERT(input);
+
+    if (!input->renderer() || !renderer())
+        return;
+
+    IntPoint offset = roundedIntPoint(input->renderer()->absoluteToLocal(point, false, true));
+    RenderStyle* sliderStyle = input->renderer()->style();
+    bool isVertical = sliderStyle->appearance() == SliderVerticalPart || sliderStyle->appearance() == MediaVolumeSliderPart;
+
+    int trackSize;
+    int position;
+    int currentPosition;
+    if (isVertical) {
+        trackSize = input->renderBox()->contentHeight() - renderBox()->height();
+        position = offset.y() - renderBox()->height() / 2;
+        currentPosition = renderBox()->y() - input->renderBox()->contentBoxRect().y();
+    } else {
+        trackSize = input->renderBox()->contentWidth() - renderBox()->width();
+        position = offset.x() - renderBox()->width() / 2;
+        currentPosition = renderBox()->x() - input->renderBox()->contentBoxRect().x();
+    }
+    position = max(0, min(position, trackSize));
+    if (position == currentPosition)
+        return;
+
+    StepRange range(input);
+    double fraction = static_cast<double>(position) / trackSize;
+    if (isVertical)
+        fraction = 1 - fraction;
+    double value = range.clampValue(range.valueFromProportion(fraction));
+
+    // FIXME: This is no longer being set from renderer. Consider updating the method name.
+    input->setValueFromRenderer(serializeForNumberType(value));
+    renderer()->setNeedsLayout(true);
+    input->dispatchFormControlChangeEvent();
+}
+
+void SliderThumbElement::startDragging()
+{
+    if (Frame* frame = document()->frame()) {
+        frame->eventHandler()->setCapturingMouseEventsNode(this);
+        m_inDragMode = true;
+    }
+}
+
+void SliderThumbElement::stopDragging()
+{
+    if (!m_inDragMode)
+        return;
+
+    if (Frame* frame = document()->frame())
+        frame->eventHandler()->setCapturingMouseEventsNode(0);
+    m_inDragMode = false;
+}
+
 void SliderThumbElement::defaultEventHandler(Event* event)
 {
     if (!event->isMouseEvent()
@@ -99,6 +168,7 @@ void SliderThumbElement::defaultEventHandler(Event* event)
     bool isLeftButton = mouseEvent->button() == LeftButton;
     const AtomicString& eventType = event->type();
 
+<<<<<<< HEAD
     if (eventType == eventNames().mousedownEvent && isLeftButton
 #if PLATFORM(ANDROID) && ENABLE(TOUCH_EVENTS)
         || eventType == eventNames().touchstartEvent
@@ -164,6 +234,18 @@ void SliderThumbElement::defaultEventHandler(Event* event)
                 return;
             }
         }
+=======
+    if (eventType == eventNames().mousedownEvent && isLeftButton) {
+        startDragging();
+        return;
+    } else if (eventType == eventNames().mouseupEvent && isLeftButton) {
+        stopDragging();
+        return;
+    } else if (eventType == eventNames().mousemoveEvent) {
+        if (m_inDragMode)
+            setPosition(mouseEvent->absoluteLocation());
+        return;
+>>>>>>> WebKit.org at r76408
     }
 
     HTMLDivElement::defaultEventHandler(event);
diff --git a/Source/WebCore/html/shadow/SliderThumbElement.h b/Source/WebCore/html/shadow/SliderThumbElement.h
index 7219186..1f1c869 100644
--- a/Source/WebCore/html/shadow/SliderThumbElement.h
+++ b/Source/WebCore/html/shadow/SliderThumbElement.h
@@ -50,6 +50,7 @@ public:
 
     bool inDragMode() const { return m_inDragMode; }
 
+    void dragFrom(const IntPoint&);
     virtual void defaultEventHandler(Event*);
     virtual void detach();
     virtual AtomicString shadowPseudoId() const;
@@ -57,6 +58,9 @@ public:
 private:
     SliderThumbElement(Document*);
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
+    void startDragging();
+    void stopDragging();
+    void setPosition(const IntPoint&);
 
     FloatPoint m_offsetToThumb;
     bool m_inDragMode;