Merge WebKit at r78450: Initial merge by git.

Change-Id: I6d3e5f1f868ec266a0aafdef66182ddc3f265dc1

47 files changed, 817 insertions, 820 deletions

diff --git a/Source/WebCore/page/Chrome.cpp b/Source/WebCore/page/Chrome.cpp
index d96b6c9..08bf1c3 100644
--- a/Source/WebCore/page/Chrome.cpp
+++ b/Source/WebCore/page/Chrome.cpp
@@ -330,6 +330,13 @@ bool Chrome::shouldInterruptJavaScript()
     return m_client->shouldInterruptJavaScript();
 }
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+void Chrome::registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title) 
+{
+    m_client->registerProtocolHandler(scheme, baseURL, url, title);
+}
+#endif
+
 IntRect Chrome::windowResizerRect() const
 {
     return m_client->windowResizerRect();
@@ -503,11 +510,21 @@ bool ChromeClient::paintCustomScrollCorner(GraphicsContext*, const FloatRect&)
     return false;
 }
 
+bool ChromeClient::paintCustomOverhangArea(GraphicsContext*, const IntRect&, const IntRect&, const IntRect&)
+{
+    return false;
+}
+
 bool Chrome::selectItemWritingDirectionIsNatural()
 {
     return m_client->selectItemWritingDirectionIsNatural();
 }
 
+bool Chrome::selectItemAlignmentFollowsMenuWritingDirection()
+{
+    return m_client->selectItemAlignmentFollowsMenuWritingDirection();
+}
+
 PassRefPtr<PopupMenu> Chrome::createPopupMenu(PopupMenuClient* client) const
 {
     return m_client->createPopupMenu(client);
diff --git a/Source/WebCore/page/Chrome.h b/Source/WebCore/page/Chrome.h
index 0afd807..4d16214 100644
--- a/Source/WebCore/page/Chrome.h
+++ b/Source/WebCore/page/Chrome.h
@@ -134,6 +134,10 @@ namespace WebCore {
         void setStatusbarText(Frame*, const String&);
         bool shouldInterruptJavaScript();
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+        void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title);
+#endif
+
         IntRect windowResizerRect() const;
 
         void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
@@ -163,6 +167,7 @@ namespace WebCore {
 #endif
 
         bool selectItemWritingDirectionIsNatural();
+        bool selectItemAlignmentFollowsMenuWritingDirection();
         PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const;
         PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const;
 
diff --git a/Source/WebCore/page/ChromeClient.h b/Source/WebCore/page/ChromeClient.h
index 98b56da..83f039f 100644
--- a/Source/WebCore/page/ChromeClient.h
+++ b/Source/WebCore/page/ChromeClient.h
@@ -26,7 +26,6 @@
 #include "Cursor.h"
 #include "FocusDirection.h"
 #include "GraphicsContext.h"
-#include "HTMLParserQuirks.h"
 #include "HostWindow.h"
 #include "PopupMenu.h"
 #include "PopupMenuClient.h"
@@ -53,7 +52,6 @@ namespace WebCore {
     class FloatRect;
     class Frame;
     class Geolocation;
-    class HTMLParserQuirks;
     class HitTestResult;
     class IntRect;
     class NavigationAction;
@@ -136,6 +134,10 @@ namespace WebCore {
         virtual bool shouldInterruptJavaScript() = 0;
         virtual bool tabsToLinks() const = 0;
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+        virtual void registerProtocolHandler(const String& scheme, const String& baseURL, const String& url, const String& title) = 0;
+#endif
+
         virtual IntRect windowResizerRect() const = 0;
 
         // Methods used by HostWindow.
@@ -211,6 +213,8 @@ namespace WebCore {
                                           float value, float proportion, ScrollbarControlPartMask);
         virtual bool paintCustomScrollCorner(GraphicsContext*, const FloatRect&);
 
+        virtual bool paintCustomOverhangArea(GraphicsContext*, const IntRect&, const IntRect&, const IntRect&);
+
         // FIXME: Remove once all ports are using client-based geolocation. https://bugs.webkit.org/show_bug.cgi?id=40373
         // For client-based geolocation, these two methods have moved to GeolocationClient. https://bugs.webkit.org/show_bug.cgi?id=50061
         // This can be either a synchronous or asynchronous call. The ChromeClient can display UI asking the user for permission
@@ -229,8 +233,6 @@ namespace WebCore {
         virtual void formDidFocus(const Node*) { };
         virtual void formDidBlur(const Node*) { };
 
-        virtual PassOwnPtr<HTMLParserQuirks> createHTMLParserQuirks() = 0;
-
 #if USE(ACCELERATED_COMPOSITING)
         // Pass 0 as the GraphicsLayer to detatch the root layer.
         virtual void attachRootGraphicsLayer(Frame*, GraphicsLayer*) = 0;
@@ -292,6 +294,7 @@ namespace WebCore {
 #endif
 
         virtual bool selectItemWritingDirectionIsNatural() = 0;
+        virtual bool selectItemAlignmentFollowsMenuWritingDirection() = 0;
         virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const = 0;
         virtual PassRefPtr<SearchPopupMenu> createSearchPopupMenu(PopupMenuClient*) const = 0;
 
@@ -301,9 +304,13 @@ namespace WebCore {
 
         virtual void postAccessibilityNotification(AccessibilityObject*, AXObjectCache::AXNotification) { }
 
+<<<<<<< HEAD
 #if ENABLE(ANDROID_INSTALLABLE_WEB_APPS)
         virtual void webAppCanBeInstalled() = 0;
 #endif
+=======
+        virtual void didCompleteRubberBandForMainFrame(const IntSize&) const { }
+>>>>>>> webkit.org at r78450
 
     protected:
         virtual ~ChromeClient() { }
diff --git a/Source/WebCore/page/Console.cpp b/Source/WebCore/page/Console.cpp
index 0c19421..a1b92e9 100644
--- a/Source/WebCore/page/Console.cpp
+++ b/Source/WebCore/page/Console.cpp
@@ -34,8 +34,8 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
+#include "InspectorConsoleInstrumentation.h"
 #include "InspectorController.h"
-#include "InspectorInstrumentation.h"
 #include "MemoryInfo.h"
 #include "Page.h"
 #include "PageGroup.h"
@@ -147,7 +147,7 @@ void Console::addMessage(MessageSource source, MessageType type, MessageLevel le
         page->chrome()->client()->addMessageToConsole(source, type, level, message, lineNumber, sourceURL);
 
     if (callStack)
-        InspectorInstrumentation::addMessageToConsole(page, source, type, level, message, 0, callStack.get());
+        InspectorInstrumentation::addMessageToConsole(page, source, type, level, message, 0, callStack);
     else
         InspectorInstrumentation::addMessageToConsole(page, source, type, level, message, lineNumber, sourceURL);
 
@@ -160,8 +160,11 @@ void Console::addMessage(MessageSource source, MessageType type, MessageLevel le
     printf(" %s\n", message.utf8().data());
 }
 
-void Console::addMessage(MessageType type, MessageLevel level, PassRefPtr<ScriptArguments> arguments,  PassRefPtr<ScriptCallStack> callStack, bool acceptNoArguments)
+void Console::addMessage(MessageType type, MessageLevel level, PassRefPtr<ScriptArguments> prpArguments,  PassRefPtr<ScriptCallStack> prpCallStack, bool acceptNoArguments)
 {
+    RefPtr<ScriptArguments> arguments = prpArguments;
+    RefPtr<ScriptCallStack> callStack = prpCallStack;
+
     Page* page = this->page();
     if (!page)
         return;
@@ -187,7 +190,7 @@ void Console::addMessage(MessageType type, MessageLevel level, PassRefPtr<Script
     if (arguments->getFirstArgumentAsString(message))
         page->chrome()->client()->addMessageToConsole(JSMessageSource, type, level, message, lastCaller.lineNumber(), lastCaller.sourceURL());
 
-    InspectorInstrumentation::addMessageToConsole(page, JSMessageSource, type, level, message, arguments.get(), callStack.get());
+    InspectorInstrumentation::addMessageToConsole(page, JSMessageSource, type, level, message, arguments, callStack);
 }
 
 void Console::debug(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
@@ -222,8 +225,9 @@ void Console::dirxml(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCal
     log(arguments, callStack);
 }
 
-void Console::trace(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
+void Console::trace(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> prpCallStack)
 {
+    RefPtr<ScriptCallStack> callStack = prpCallStack;
     addMessage(TraceMessageType, LogMessageLevel, arguments, callStack, true);
 
     if (!shouldPrintExceptions())
@@ -246,12 +250,12 @@ void Console::assertCondition(bool condition, PassRefPtr<ScriptArguments> argume
 
 void Console::count(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
 {
-    InspectorInstrumentation::consoleCount(page(), arguments.get(), callStack.get());
+    InspectorInstrumentation::consoleCount(page(), arguments, callStack);
 }
 
 void Console::markTimeline(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack>)
 {
-    InspectorInstrumentation::consoleMarkTimeline(page(), arguments.get());
+    InspectorInstrumentation::consoleMarkTimeline(page(), arguments);
 }
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -290,7 +294,7 @@ void Console::profileEnd(const String& title, ScriptState* state, PassRefPtr<Scr
         return;
 
     m_profiles.append(profile);
-    InspectorInstrumentation::addProfile(page, profile, callStack.get());
+    InspectorInstrumentation::addProfile(page, profile, callStack);
 }
 
 #endif
@@ -302,17 +306,17 @@ void Console::time(const String& title)
 
 void Console::timeEnd(const String& title, PassRefPtr<ScriptArguments>, PassRefPtr<ScriptCallStack> callStack)
 {
-    InspectorInstrumentation::stopConsoleTiming(page(), title, callStack.get());
+    InspectorInstrumentation::stopConsoleTiming(page(), title, callStack);
 }
 
 void Console::group(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
 {
-    InspectorInstrumentation::addMessageToConsole(page(), JSMessageSource, StartGroupMessageType, LogMessageLevel, String(), arguments.get(), callStack.get());
+    InspectorInstrumentation::addMessageToConsole(page(), JSMessageSource, StartGroupMessageType, LogMessageLevel, String(), arguments, callStack);
 }
 
 void Console::groupCollapsed(PassRefPtr<ScriptArguments> arguments, PassRefPtr<ScriptCallStack> callStack)
 {
-    InspectorInstrumentation::addMessageToConsole(page(), JSMessageSource, StartGroupCollapsedMessageType, LogMessageLevel, String(), arguments.get(), callStack.get());
+    InspectorInstrumentation::addMessageToConsole(page(), JSMessageSource, StartGroupCollapsedMessageType, LogMessageLevel, String(), arguments, callStack);
 }
 
 void Console::groupEnd()
diff --git a/Source/WebCore/page/ContentSecurityPolicy.cpp b/Source/WebCore/page/ContentSecurityPolicy.cpp
new file mode 100644
index 0000000..045e5aa
--- /dev/null
+++ b/Source/WebCore/page/ContentSecurityPolicy.cpp
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Google, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ContentSecurityPolicy.h"
+#include "Document.h"
+
+namespace WebCore {
+
+ContentSecurityPolicy::ContentSecurityPolicy()
+    : m_isEnabled(false)
+{
+}
+
+void ContentSecurityPolicy::didReceiveHeader(const String& header)
+{
+    m_isEnabled = true;
+    m_header = header;
+}
+
+bool ContentSecurityPolicy::canLoadExternalScriptFromSrc(const String&) const
+{
+    return !m_isEnabled;
+}
+
+}
diff --git a/Source/WebCore/page/ContentSecurityPolicy.h b/Source/WebCore/page/ContentSecurityPolicy.h
new file mode 100644
index 0000000..ef0d551
--- /dev/null
+++ b/Source/WebCore/page/ContentSecurityPolicy.h
@@ -0,0 +1,48 @@
+/*
+ * Copyright (C) 2011 Google, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ContentSecurityPolicy_h
+#define ContentSecurityPolicy_h
+
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class ContentSecurityPolicy {
+    WTF_MAKE_NONCOPYABLE(ContentSecurityPolicy);
+public:
+    ContentSecurityPolicy();
+
+    void didReceiveHeader(const String&);
+    bool canLoadExternalScriptFromSrc(const String& url) const;
+
+private:
+    bool m_isEnabled;
+    String m_header;
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/page/ContextMenuController.cpp b/Source/WebCore/page/ContextMenuController.cpp
index 0909f70..36ac89d 100644
--- a/Source/WebCore/page/ContextMenuController.cpp
+++ b/Source/WebCore/page/ContextMenuController.cpp
@@ -207,6 +207,11 @@ void ContextMenuController::contextMenuItemSelected(ContextMenuItem* item)
         // For now, call into the client. This is temporary!
         frame->editor()->copyImage(m_hitTestResult);
         break;
+#if PLATFORM(QT)
+    case ContextMenuItemTagCopyImageUrlToClipboard:
+        frame->editor()->copyURL(m_hitTestResult.absoluteImageURL(), m_hitTestResult.textContent());
+        break;
+#endif
     case ContextMenuItemTagOpenMediaInNewWindow:
         openNewWindow(m_hitTestResult.absoluteMediaURL(), frame);
         break;
@@ -642,6 +647,10 @@ void ContextMenuController::populate()
         contextMenuItemTagDownloadImageToDisk());
     ContextMenuItem CopyImageItem(ActionType, ContextMenuItemTagCopyImageToClipboard, 
         contextMenuItemTagCopyImageToClipboard());
+#if PLATFORM(QT)
+    ContextMenuItem CopyImageUrlItem(ActionType, ContextMenuItemTagCopyImageUrlToClipboard, 
+        contextMenuItemTagCopyImageUrlToClipboard());
+#endif
     ContextMenuItem OpenMediaInNewWindowItem(ActionType, ContextMenuItemTagOpenMediaInNewWindow, String());
     ContextMenuItem CopyMediaLinkItem(ActionType, ContextMenuItemTagCopyMediaLinkToClipboard, 
         String());
@@ -708,6 +717,10 @@ void ContextMenuController::populate()
                 appendItem(OpenLinkInNewWindowItem, m_contextMenu.get());
                 appendItem(DownloadFileItem, m_contextMenu.get());
             }
+#if PLATFORM(QT)
+            if (m_hitTestResult.isSelected()) 
+                appendItem(CopyItem, m_contextMenu.get());
+#endif
             appendItem(CopyLinkItem, m_contextMenu.get());
         }
 
@@ -720,6 +733,9 @@ void ContextMenuController::populate()
             appendItem(DownloadImageItem, m_contextMenu.get());
             if (imageURL.isLocalFile() || m_hitTestResult.image())
                 appendItem(CopyImageItem, m_contextMenu.get());
+#if PLATFORM(QT)
+            appendItem(CopyImageUrlItem, m_contextMenu.get());
+#endif
         }
 
         KURL mediaURL = m_hitTestResult.absoluteMediaURL();
@@ -1172,6 +1188,9 @@ void ContextMenuController::checkOrEnableIfNeeded(ContextMenuItem& item) const
         case ContextMenuItemTagOpenImageInNewWindow:
         case ContextMenuItemTagDownloadImageToDisk:
         case ContextMenuItemTagCopyImageToClipboard:
+#if PLATFORM(QT)
+        case ContextMenuItemTagCopyImageUrlToClipboard:
+#endif
             break;
         case ContextMenuItemTagOpenMediaInNewWindow:
             if (m_hitTestResult.mediaIsVideo())
diff --git a/Source/WebCore/page/Crypto.cpp b/Source/WebCore/page/Crypto.cpp
new file mode 100644
index 0000000..5621592
--- /dev/null
+++ b/Source/WebCore/page/Crypto.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Google, Inc. ("Google") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#include "config.h"
+#include "Crypto.h"
+
+#include "ExceptionCode.h"
+#include "Uint8Array.h"
+#include <wtf/CryptographicallyRandomNumber.h>
+
+namespace WebCore {
+
+namespace {
+
+bool isIntegerArray(ArrayBufferView* array)
+{
+    return array->isByteArray()
+        || array->isUnsignedByteArray()
+        || array->isShortArray()
+        || array->isUnsignedShortArray()
+        || array->isIntArray()
+        || array->isUnsignedIntArray();
+}
+
+}
+
+Crypto::Crypto()
+{
+}
+
+void Crypto::getRandomValues(ArrayBufferView* array, ExceptionCode& ec)
+{
+#if USE(OS_RANDOMNESS)
+    if (!array || !isIntegerArray(array)) {
+        ec = TYPE_MISMATCH_ERR;
+        return;
+    }
+    cryptographicallyRandomValues(array->baseAddress(), array->byteLength());
+#else
+    ASSERT_UNUSED(array, array);
+    ec = NOT_SUPPORTED_ERR;
+#endif
+}
+
+}
diff --git a/Source/WebCore/page/Crypto.h b/Source/WebCore/page/Crypto.h
new file mode 100644
index 0000000..bcccd7e
--- /dev/null
+++ b/Source/WebCore/page/Crypto.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Google, Inc. ("Google") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Crypto_h
+#define Crypto_h
+
+#include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class ArrayBufferView;
+
+typedef int ExceptionCode;
+
+class Crypto : public RefCounted<Crypto> {
+public:
+    static PassRefPtr<Crypto> create() { return adoptRef(new Crypto()); }
+
+    void getRandomValues(ArrayBufferView*, ExceptionCode&);
+
+private:
+    Crypto();
+};
+
+}
+
+#endif
diff --git a/Source/WebCore/page/Crypto.idl b/Source/WebCore/page/Crypto.idl
new file mode 100644
index 0000000..807b63f
--- /dev/null
+++ b/Source/WebCore/page/Crypto.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2011 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Googl, Inc. ("Google") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module window {
+
+    interface [
+        OmitConstructor
+    ] Crypto {
+        void getRandomValues(in ArrayBufferView array) raises(DOMException);
+    };
+
+}
diff --git a/Source/WebCore/page/DOMWindow.cpp b/Source/WebCore/page/DOMWindow.cpp
index 0860d65..c732a10 100644
--- a/Source/WebCore/page/DOMWindow.cpp
+++ b/Source/WebCore/page/DOMWindow.cpp
@@ -37,6 +37,7 @@
 #include "CSSStyleSelector.h"
 #include "Chrome.h"
 #include "Console.h"
+#include "Crypto.h"
 #include "DOMApplicationCache.h"
 #include "DOMSelection.h"
 #include "DOMSettableTokenList.h"
@@ -342,8 +343,8 @@ void DOMWindow::adjustWindowRect(const FloatRect& screen, FloatRect& window, con
     window.setHeight(min(max(100.0f, window.height()), screen.height()));
     
     // Constrain the window position to the screen.
-    window.setX(max(screen.x(), min(window.x(), screen.right() - window.width())));
-    window.setY(max(screen.y(), min(window.y(), screen.bottom() - window.height())));
+    window.setX(max(screen.x(), min(window.x(), screen.maxX() - window.width())));
+    window.setY(max(screen.y(), min(window.y(), screen.maxY() - window.height())));
 }
 
 // FIXME: We can remove this function once V8 showModalDialog is changed to use DOMWindow.
@@ -433,6 +434,8 @@ void DOMWindow::clear()
         m_history->disconnectFrame();
     m_history = 0;
 
+    m_crypto = 0;
+
     if (m_locationbar)
         m_locationbar->disconnectFrame();
     m_locationbar = 0;
@@ -530,6 +533,13 @@ History* DOMWindow::history() const
     return m_history.get();
 }
 
+Crypto* DOMWindow::crypto() const
+{
+    if (!m_crypto)
+        m_crypto = Crypto::create();
+    return m_crypto.get();
+}
+
 BarInfo* DOMWindow::locationbar() const
 {
     if (!m_locationbar)
@@ -964,33 +974,17 @@ String DOMWindow::prompt(const String& message, const String& defaultValue)
     return String();
 }
 
-static bool isSafeToConvertCharList(const String& string)
-{
-    for (unsigned i = 0; i < string.length(); i++) {
-        if (string[i] > 0xFF)
-            return false;
-    }
-
-    return true;
-}
-
 String DOMWindow::btoa(const String& stringToEncode, ExceptionCode& ec)
 {
     if (stringToEncode.isNull())
         return String();
 
-    if (!isSafeToConvertCharList(stringToEncode)) {
+    if (!stringToEncode.containsOnlyLatin1()) {
         ec = INVALID_CHARACTER_ERR;
         return String();
     }
 
-    Vector<char> in;
-    in.append(stringToEncode.characters(), stringToEncode.length());
-    Vector<char> out;
-
-    base64Encode(in, out);
-
-    return String(out.data(), out.size());
+    return base64Encode(stringToEncode.latin1());
 }
 
 String DOMWindow::atob(const String& encodedString, ExceptionCode& ec)
@@ -998,7 +992,7 @@ String DOMWindow::atob(const String& encodedString, ExceptionCode& ec)
     if (encodedString.isNull())
         return String();
 
-    if (!isSafeToConvertCharList(encodedString)) {
+    if (!encodedString.containsOnlyLatin1()) {
         ec = INVALID_CHARACTER_ERR;
         return String();
     }
@@ -1557,7 +1551,7 @@ void DOMWindow::dispatchLoadEvent()
         ownerElement->dispatchGenericEvent(ownerEvent.release());
     }
 
-    InspectorInstrumentation::mainResourceFiredLoadEvent(frame(), url());
+    InspectorInstrumentation::loadEventFired(frame(), url());
 }
 
 bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
@@ -1585,7 +1579,6 @@ void DOMWindow::dispatchTimedEvent(PassRefPtr<Event> event, Document* target, do
     *startTime = currentTime();
     dispatchEvent(event, target);
     *endTime = currentTime();
-    ASSERT(*endTime >= *startTime);
 }
 
 void DOMWindow::removeAllEventListeners()
diff --git a/Source/WebCore/page/DOMWindow.h b/Source/WebCore/page/DOMWindow.h
index f02a7ac..8318369 100644
--- a/Source/WebCore/page/DOMWindow.h
+++ b/Source/WebCore/page/DOMWindow.h
@@ -37,6 +37,7 @@ namespace WebCore {
     class CSSRuleList;
     class CSSStyleDeclaration;
     class Console;
+    class Crypto;
     class DOMApplicationCache;
     class DOMSelection;
     class DOMURL;
@@ -114,6 +115,7 @@ namespace WebCore {
 
         Screen* screen() const;
         History* history() const;
+        Crypto* crypto() const;
         BarInfo* locationbar() const;
         BarInfo* menubar() const;
         BarInfo* personalbar() const;
@@ -340,6 +342,7 @@ namespace WebCore {
         Screen* optionalScreen() const { return m_screen.get(); }
         DOMSelection* optionalSelection() const { return m_selection.get(); }
         History* optionalHistory() const { return m_history.get(); }
+        Crypto* optionalCrypto() const { return m_crypto.get(); }
         BarInfo* optionalLocationbar() const { return m_locationbar.get(); }
         BarInfo* optionalMenubar() const { return m_menubar.get(); }
         BarInfo* optionalPersonalbar() const { return m_personalbar.get(); }
@@ -444,6 +447,7 @@ namespace WebCore {
         mutable RefPtr<Screen> m_screen;
         mutable RefPtr<DOMSelection> m_selection;
         mutable RefPtr<History> m_history;
+        mutable RefPtr<Crypto>  m_crypto;
         mutable RefPtr<BarInfo> m_locationbar;
         mutable RefPtr<BarInfo> m_menubar;
         mutable RefPtr<BarInfo> m_personalbar;
diff --git a/Source/WebCore/page/DOMWindow.idl b/Source/WebCore/page/DOMWindow.idl
index a814558..b04a8a2 100644
--- a/Source/WebCore/page/DOMWindow.idl
+++ b/Source/WebCore/page/DOMWindow.idl
@@ -54,11 +54,11 @@ module window {
         attribute [Replaceable] BarInfo toolbar;
         attribute [Replaceable] Navigator navigator;
         attribute [Replaceable] Navigator clientInformation;
+        readonly attribute Crypto crypto;
         attribute [DoNotCheckDomainSecurity, JSCCustom, V8CustomSetter, V8DisallowShadowing, CPPCustom] Location location;
 
         attribute [Replaceable, CustomGetter, V8CustomSetter] Event event;
 
-        readonly attribute [Custom] Crypto crypto;
 
         DOMSelection getSelection();
 
@@ -493,28 +493,28 @@ module window {
         attribute CanvasGradientConstructor CanvasGradient;
         attribute CanvasRenderingContext2DConstructor CanvasRenderingContext2D;
         attribute ImageDataConstructor ImageData;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLActiveInfoConstructor WebGLActiveInfo;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLBufferConstructor WebGLBuffer;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLFramebufferConstructor WebGLFramebuffer;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLProgramConstructor WebGLProgram;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLRenderbufferConstructor WebGLRenderbuffer;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLRenderingContextConstructor WebGLRenderingContext;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLShaderConstructor WebGLShader;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLTextureConstructor WebGLTexture;
-        attribute [Conditional=3D_CANVAS,EnabledAtRuntime] WebGLUniformLocationConstructor WebGLUniformLocation;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLActiveInfoConstructor WebGLActiveInfo;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLBufferConstructor WebGLBuffer;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLFramebufferConstructor WebGLFramebuffer;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLProgramConstructor WebGLProgram;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLRenderbufferConstructor WebGLRenderbuffer;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLRenderingContextConstructor WebGLRenderingContext;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLShaderConstructor WebGLShader;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLTextureConstructor WebGLTexture;
+        attribute [Conditional=WEBGL,EnabledAtRuntime] WebGLUniformLocationConstructor WebGLUniformLocation;
         attribute TextMetricsConstructor TextMetrics;
 
         attribute DOMStringMapConstructor DOMStringMap;
 
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] ArrayBufferConstructor ArrayBuffer; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Int8ArrayConstructor Int8Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Uint8ArrayConstructor Uint8Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Int16ArrayConstructor Int16Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Uint16ArrayConstructor Uint16Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Int32ArrayConstructor Int32Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Uint32ArrayConstructor Uint32Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Float32ArrayConstructor Float32Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] DataViewConstructor DataView; // Usable with new operator
+        attribute [JSCCustomGetter] ArrayBufferConstructor ArrayBuffer; // Usable with new operator
+        attribute [JSCCustomGetter] Int8ArrayConstructor Int8Array; // Usable with new operator
+        attribute [JSCCustomGetter] Uint8ArrayConstructor Uint8Array; // Usable with new operator
+        attribute [JSCCustomGetter] Int16ArrayConstructor Int16Array; // Usable with new operator
+        attribute [JSCCustomGetter] Uint16ArrayConstructor Uint16Array; // Usable with new operator
+        attribute [JSCCustomGetter] Int32ArrayConstructor Int32Array; // Usable with new operator
+        attribute [JSCCustomGetter] Uint32ArrayConstructor Uint32Array; // Usable with new operator
+        attribute [JSCCustomGetter] Float32ArrayConstructor Float32Array; // Usable with new operator
+        attribute [JSCCustomGetter] DataViewConstructor DataView; // Usable with new operator
 
         attribute [JSCCustomGetter,Conditional=WEB_AUDIO,EnabledAtRuntime] AudioContextConstructor webkitAudioContext; // Usable with new operator
         attribute [Conditional=WEB_AUDIO] AudioPannerNodeConstructor webkitAudioPannerNode; // Needed for panning model constants
diff --git a/Source/WebCore/page/DragClient.h b/Source/WebCore/page/DragClient.h
index 4f343a0..8f73baa 100644
--- a/Source/WebCore/page/DragClient.h
+++ b/Source/WebCore/page/DragClient.h
@@ -62,7 +62,6 @@ namespace WebCore {
         virtual DragSourceAction dragSourceActionMaskForPoint(const IntPoint& windowPoint) = 0;
         
         virtual void startDrag(DragImageRef dragImage, const IntPoint& dragImageOrigin, const IntPoint& eventPos, Clipboard*, Frame*, bool linkDrag = false) = 0;
-        virtual DragImageRef createDragImageForLink(KURL&, const String& label, Frame*) = 0;
         
         virtual void dragControllerDestroyed() = 0;
 #if PLATFORM(MAC)
diff --git a/Source/WebCore/page/DragController.cpp b/Source/WebCore/page/DragController.cpp
index 7be708c..b258e9d 100644
--- a/Source/WebCore/page/DragController.cpp
+++ b/Source/WebCore/page/DragController.cpp
@@ -644,9 +644,9 @@ static IntPoint dragLocForDHTMLDrag(const IntPoint& mouseDraggedPoint, const Int
 static IntPoint dragLocForSelectionDrag(Frame* src)
 {
     IntRect draggingRect = enclosingIntRect(src->selection()->bounds());
-    int xpos = draggingRect.right();
+    int xpos = draggingRect.maxX();
     xpos = draggingRect.x() < xpos ? draggingRect.x() : xpos;
-    int ypos = draggingRect.bottom();
+    int ypos = draggingRect.maxY();
 #if PLATFORM(MAC)
     // Deal with flipped coordinates on Mac
     ypos = draggingRect.y() > ypos ? draggingRect.y() : ypos;
@@ -739,7 +739,7 @@ bool DragController::startDrag(Frame* src, Clipboard* clipboard, DragOperation s
 
         m_client->willPerformDragSourceAction(DragSourceActionLink, dragOrigin, clipboard);
         if (!dragImage) {
-            dragImage = m_client->createDragImageForLink(linkURL, dragSource.textContent(), src);
+            dragImage = createDragImageForLink(linkURL, dragSource.textContent(), src);
             IntSize size = dragImageSize(dragImage);
             m_dragOffset = IntPoint(-size.width() / 2, -LinkDragBorderInset);
             dragLoc = IntPoint(mouseDraggedPoint.x() + m_dragOffset.x(), mouseDraggedPoint.y() + m_dragOffset.y());
diff --git a/Source/WebCore/page/EditorClient.h b/Source/WebCore/page/EditorClient.h
index 71ba3dd..c805920 100644
--- a/Source/WebCore/page/EditorClient.h
+++ b/Source/WebCore/page/EditorClient.h
@@ -119,8 +119,6 @@ public:
     virtual bool shouldChangeSelectedRange(Range* fromRange, Range* toRange, EAffinity, bool stillSelecting) = 0;
     
     virtual bool shouldApplyStyle(CSSStyleDeclaration*, Range*) = 0;
-//  virtual bool shouldChangeTypingStyle(CSSStyleDeclaration* fromStyle, CSSStyleDeclaration* toStyle) = 0;
-//  virtual bool doCommandBySelector(SEL selector) = 0;
     virtual bool shouldMoveRangeAfterDelete(Range*, Range*) = 0;
 
     virtual void didBeginEditing() = 0;
@@ -129,9 +127,6 @@ public:
     virtual void didEndEditing() = 0;
     virtual void didWriteSelectionToPasteboard() = 0;
     virtual void didSetSelectionTypesForPasteboard() = 0;
-//  virtual void didChangeTypingStyle:(NSNotification *)notification = 0;
-//  virtual void didChangeSelection:(NSNotification *)notification = 0;
-//  virtual NSUndoManager* undoManager:(WebView *)webView = 0;
     
     virtual void registerCommandForUndo(PassRefPtr<EditCommand>) = 0;
     virtual void registerCommandForRedo(PassRefPtr<EditCommand>) = 0;
diff --git a/Source/WebCore/page/EventHandler.cpp b/Source/WebCore/page/EventHandler.cpp
index 8432c10..b173532 100644
--- a/Source/WebCore/page/EventHandler.cpp
+++ b/Source/WebCore/page/EventHandler.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
  *
  * Redistribution and use in source and binary forms, with or without
@@ -68,6 +68,7 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderView.h"
 #include "RenderWidget.h"
+#include "ScrollAnimator.h"
 #include "Scrollbar.h"
 #include "SelectionController.h"
 #include "Settings.h"
@@ -81,6 +82,10 @@
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 
+#if ENABLE(GESTURE_EVENTS)
+#include "PlatformGestureEvent.h"
+#endif
+
 #if ENABLE(SVG)
 #include "SVGDocument.h"
 #include "SVGElementInstance.h"
@@ -1439,7 +1444,7 @@ bool EventHandler::handleMouseDoubleClickEvent(const PlatformMouseEvent& mouseEv
     m_clickCount = mouseEvent.clickCount();
     bool swallowMouseUpEvent = dispatchMouseEvent(eventNames().mouseupEvent, mev.targetNode(), true, m_clickCount, mouseEvent, false);
 
-    bool swallowClickEvent = mouseEvent.button() == LeftButton && mev.targetNode() == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
+    bool swallowClickEvent = mouseEvent.button() != RightButton && mev.targetNode() == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
 
     if (m_lastScrollbarUnderMouse)
         swallowMouseUpEvent = m_lastScrollbarUnderMouse->mouseUp();
@@ -1460,6 +1465,9 @@ bool EventHandler::mouseMoved(const PlatformMouseEvent& event)
     if (!page)
         return result;
 
+    if (FrameView* frameView = m_frame->view())
+        frameView->scrollAnimator()->mouseMovedInContentArea();  
+
     hoveredNode.setToNonShadowAncestor();
     page->chrome()->mouseDidMoveOverElement(hoveredNode, event.modifierFlags());
     page->chrome()->setToolTip(hoveredNode);
@@ -1557,7 +1565,7 @@ bool EventHandler::handleMouseMoveEvent(const PlatformMouseEvent& mouseEvent, Hi
                 // effect on plugins (which matches Firefox).
                 bool overPluginElement = false;
                 if (mev.targetNode() && mev.targetNode()->isHTMLElement()) {
-                    HTMLElement* el = static_cast<HTMLElement*>(mev.targetNode());
+                    HTMLElement* el = toHTMLElement(mev.targetNode());
                     overPluginElement = el->hasTagName(appletTag) || el->hasTagName(objectTag) || el->hasTagName(embedTag);
                 }
                 if (!overPluginElement) {
@@ -1637,7 +1645,7 @@ bool EventHandler::handleMouseReleaseEvent(const PlatformMouseEvent& mouseEvent)
 
     bool swallowMouseUpEvent = dispatchMouseEvent(eventNames().mouseupEvent, mev.targetNode(), true, m_clickCount, mouseEvent, false);
 
-    bool swallowClickEvent = m_clickCount > 0 && mouseEvent.button() == LeftButton && mev.targetNode() == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
+    bool swallowClickEvent = m_clickCount > 0 && mouseEvent.button() != RightButton && mev.targetNode() == m_clickNode && dispatchMouseEvent(eventNames().clickEvent, mev.targetNode(), true, m_clickCount, mouseEvent, true);
 
     if (m_resizeLayer) {
         m_resizeLayer->setInResizeMode(false);
@@ -1881,6 +1889,23 @@ void EventHandler::updateMouseEventTargetNode(Node* targetNode, const PlatformMo
 
     // Fire mouseout/mouseover if the mouse has shifted to a different node.
     if (fireMouseOverOut) {
+        // FIXME: This code will only correctly handle transitions between frames with scrollbars,
+        // not transitions between overflow regions, or transitions between two frames
+        // that don't have scrollbars contained within a frame that does.
+        if (m_lastNodeUnderMouse && (!m_nodeUnderMouse || m_nodeUnderMouse->document() != m_frame->document())) {
+            if (Frame* frame = m_lastNodeUnderMouse->document()->frame()) {
+                if (FrameView* frameView = frame->view())
+                    frameView->scrollAnimator()->mouseExitedContentArea();
+            }
+        }
+        
+        if (m_nodeUnderMouse && (!m_lastNodeUnderMouse || m_lastNodeUnderMouse->document() != m_frame->document())) {
+            if (Frame* frame = m_nodeUnderMouse->document()->frame()) {
+                if (FrameView* frameView = frame->view())
+                    frameView->scrollAnimator()->mouseEnteredContentArea();
+            }
+        }
+        
         if (m_lastNodeUnderMouse && m_lastNodeUnderMouse->document() != m_frame->document()) {
             m_lastNodeUnderMouse = 0;
             m_lastScrollbarUnderMouse = 0;
@@ -2066,6 +2091,23 @@ void EventHandler::defaultWheelEventHandler(Node* startNode, WheelEvent* wheelEv
         m_previousWheelScrolledNode = stopNode;
 }
 
+#if ENABLE(GESTURE_EVENTS)
+bool EventHandler::handleGestureEvent(const PlatformGestureEvent& gestureEvent)
+{
+    // FIXME: This should hit test and go to the correct subframe rather than 
+    // always sending gestures to the main frame only. We should also ensure
+    // that if a frame gets a gesture begin gesture, it gets the corresponding
+    // end gesture as well.
+
+    FrameView* view = m_frame->view();
+    if (!view)
+        return false;
+
+    view->handleGestureEvent(gestureEvent);
+    return true;
+}
+#endif
+
 #if ENABLE(CONTEXT_MENUS)
 bool EventHandler::sendContextMenuEvent(const PlatformMouseEvent& event)
 {
@@ -2121,12 +2163,12 @@ bool EventHandler::sendContextMenuEventForKey()
         RefPtr<Range> selection = selectionController->toNormalizedRange();
         IntRect firstRect = m_frame->editor()->firstRectForRange(selection.get());
 
-        int x = rightAligned ? firstRect.right() : firstRect.x();
-        location = IntPoint(x, firstRect.bottom());
+        int x = rightAligned ? firstRect.maxX() : firstRect.x();
+        location = IntPoint(x, firstRect.maxY());
     } else if (focusedNode) {
         RenderBoxModelObject* box = focusedNode->renderBoxModelObject();
         IntRect clippedRect = box->absoluteClippedOverflowRect();
-        location = clippedRect.bottomLeft();
+        location = IntPoint(clippedRect.x(), clippedRect.maxY() - 1);
     } else {
         location = IntPoint(
             rightAligned ? view->contentsWidth() - kContextMenuMargin : kContextMenuMargin,
@@ -2171,6 +2213,15 @@ void EventHandler::scheduleHoverStateUpdate()
         m_hoverTimer.startOneShot(0);
 }
 
+void EventHandler::dispatchFakeMouseMoveEventSoon()
+{
+    if (m_mousePressed)
+        return;
+
+    if (!m_fakeMouseMoveEventTimer.isActive())
+        m_fakeMouseMoveEventTimer.startOneShot(fakeMouseMoveInterval);
+}
+
 void EventHandler::dispatchFakeMouseMoveEventSoonInQuad(const FloatQuad& quad)
 {
     FrameView* view = m_frame->view();
diff --git a/Source/WebCore/page/EventHandler.h b/Source/WebCore/page/EventHandler.h
index 77668f1..1e825c2 100644
--- a/Source/WebCore/page/EventHandler.h
+++ b/Source/WebCore/page/EventHandler.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2007, 2009, 2010, 2011 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -53,9 +53,9 @@ class EventTarget;
 class FloatPoint;
 class FloatQuad;
 class Frame;
+class HTMLFrameSetElement;
 class HitTestRequest;
 class HitTestResult;
-class HTMLFrameSetElement;
 class KeyboardEvent;
 class MouseEventWithHitTestResults;
 class Node;
@@ -65,13 +65,17 @@ class PlatformWheelEvent;
 class RenderLayer;
 class RenderObject;
 class RenderWidget;
-class Scrollbar;
 class SVGElementInstance;
+class Scrollbar;
 class TextEvent;
 class TouchEvent;
 class WheelEvent;
 class Widget;
-    
+
+#if ENABLE(GESTURE_EVENTS)
+class PlatformGestureEvent;
+#endif
+
 #if ENABLE(DRAG_SUPPORT)
 extern const int LinkDragHysteresis;
 extern const int ImageDragHysteresis;
@@ -104,6 +108,7 @@ public:
     RenderObject* autoscrollRenderer() const;
     void updateAutoscrollRenderer();
 
+    void dispatchFakeMouseMoveEventSoon();
     void dispatchFakeMouseMoveEventSoonInQuad(const FloatQuad&);
 
     HitTestResult hitTestResultAtPoint(const IntPoint&, bool allowShadowContent, bool ignoreClipping = false,
@@ -161,6 +166,10 @@ public:
     bool handleWheelEvent(PlatformWheelEvent&);
     void defaultWheelEventHandler(Node*, WheelEvent*);
 
+#if ENABLE(GESTURE_EVENTS)
+    bool handleGestureEvent(const PlatformGestureEvent&);
+#endif
+
 #if ENABLE(CONTEXT_MENUS)
     bool sendContextMenuEvent(const PlatformMouseEvent&);
     bool sendContextMenuEventForKey();
diff --git a/Source/WebCore/page/FocusController.cpp b/Source/WebCore/page/FocusController.cpp
index eda1005..679288f 100644
--- a/Source/WebCore/page/FocusController.cpp
+++ b/Source/WebCore/page/FocusController.cpp
@@ -50,6 +50,7 @@
 #include "RenderLayer.h"
 #include "RenderObject.h"
 #include "RenderWidget.h"
+#include "ScrollAnimator.h"
 #include "SelectionController.h"
 #include "Settings.h"
 #include "SpatialNavigation.h"
@@ -407,6 +408,11 @@ void FocusController::setActive(bool active)
             view->updateLayoutAndStyleIfNeededRecursive();
             view->updateControlTints();
         }
+        // FIXME: This should propogate to all ScrollableAreas.
+        if (!active)
+            view->scrollAnimator()->contentAreaDidHide();
+        else
+            view->scrollAnimator()->contentAreaDidShow();
     }
 
     focusedOrMainFrame()->selection()->pageActivationChanged();
diff --git a/Source/WebCore/page/Frame.cpp b/Source/WebCore/page/Frame.cpp
index 4c7c6b7..84df3d1 100644
--- a/Source/WebCore/page/Frame.cpp
+++ b/Source/WebCore/page/Frame.cpp
@@ -789,7 +789,7 @@ VisiblePosition Frame::visiblePositionForPoint(const IntPoint& framePoint)
         return VisiblePosition();
     VisiblePosition visiblePos = renderer->positionForPoint(result.localPoint());
     if (visiblePos.isNull())
-        visiblePos = VisiblePosition(Position(node, 0));
+        visiblePos = firstPositionInOrBeforeNode(node);
     return visiblePos;
 }
 
diff --git a/Source/WebCore/page/FrameView.cpp b/Source/WebCore/page/FrameView.cpp
index 7546270..f8aa068 100644
--- a/Source/WebCore/page/FrameView.cpp
+++ b/Source/WebCore/page/FrameView.cpp
@@ -56,6 +56,7 @@
 #include "RenderScrollbarPart.h"
 #include "RenderTheme.h"
 #include "RenderView.h"
+#include "ScrollAnimator.h"
 #include "Settings.h"
 #include "TextResourceDecoder.h"
 #include <wtf/CurrentTime.h>
@@ -443,7 +444,8 @@ void FrameView::setContentsSize(const IntSize& size)
     m_deferSetNeedsLayouts++;
 
     ScrollView::setContentsSize(size);
-
+    scrollAnimator()->contentsResized();
+    
     Page* page = frame() ? frame()->page() : 0;
     if (!page)
         return;
@@ -465,7 +467,7 @@ void FrameView::adjustViewSize()
 
     IntSize size = IntSize(root->docWidth(), root->docHeight());
 
-    ScrollView::setScrollOrigin(IntPoint(-root->docLeft(), -root->docTop()), size == contentsSize());
+    ScrollView::setScrollOrigin(IntPoint(-root->docLeft(), -root->docTop()), !m_frame->document()->printing(), size == contentsSize());
     
     setContentsSize(size);
 }
@@ -714,6 +716,7 @@ void FrameView::didMoveOnscreen()
     RenderView* view = m_frame->contentRenderer();
     if (view)
         view->didMoveOnscreen();
+    scrollAnimator()->contentAreaDidShow();
 }
 
 void FrameView::willMoveOffscreen()
@@ -721,6 +724,7 @@ void FrameView::willMoveOffscreen()
     RenderView* view = m_frame->contentRenderer();
     if (view)
         view->willMoveOffscreen();
+    scrollAnimator()->contentAreaDidHide();
 }
 
 RenderObject* FrameView::layoutRoot(bool onlyDuringLayout) const
@@ -733,6 +737,20 @@ void FrameView::layout(bool allowSubtree)
     if (m_inLayout)
         return;
 
+    bool inSubframeLayoutWithFrameFlattening = parent() && m_frame->settings() && m_frame->settings()->frameFlatteningEnabled();
+
+    if (inSubframeLayoutWithFrameFlattening) {
+        if (parent()->isFrameView()) {
+            FrameView* parentView =   static_cast<FrameView*>(parent());
+            if (!parentView->m_nestedLayoutCount) {
+                while (parentView->parent() && parentView->parent()->isFrameView())
+                    parentView = static_cast<FrameView*>(parentView->parent());
+                parentView->layout(allowSubtree);
+                return;
+            }
+        }
+    }
+
     m_layoutTimer.stop();
     m_delayedLayout = false;
     m_setNeedsLayoutWasDeferred = false;
@@ -765,7 +783,7 @@ void FrameView::layout(bool allowSubtree)
 
     m_layoutSchedulingEnabled = false;
 
-    if (!m_nestedLayoutCount && !m_inSynchronousPostLayout && m_hasPendingPostLayoutTasks) {
+    if (!m_nestedLayoutCount && !m_inSynchronousPostLayout && m_hasPendingPostLayoutTasks && !inSubframeLayoutWithFrameFlattening) {
         // This is a new top-level layout. If there are any remaining tasks from the previous
         // layout, finish them now.
         m_inSynchronousPostLayout = true;
@@ -908,9 +926,6 @@ void FrameView::layout(bool allowSubtree)
     }
     m_layoutRoot = 0;
 
-    m_frame->selection()->setCaretRectNeedsUpdate();
-    m_frame->selection()->updateAppearance();
-   
     m_layoutSchedulingEnabled = true;
 
     if (!subtree && !toRenderView(root)->printing())
@@ -953,14 +968,14 @@ void FrameView::layout(bool allowSubtree)
                              layoutHeight() < contentsHeight());
 
     if (!m_hasPendingPostLayoutTasks) {
-        if (!m_inSynchronousPostLayout) {
+        if (!m_inSynchronousPostLayout && !inSubframeLayoutWithFrameFlattening) {
             m_inSynchronousPostLayout = true;
             // Calls resumeScheduledEvents()
             performPostLayoutTasks();
             m_inSynchronousPostLayout = false;
         }
 
-        if (!m_hasPendingPostLayoutTasks && (needsLayout() || m_inSynchronousPostLayout)) {
+        if (!m_hasPendingPostLayoutTasks && (needsLayout() || m_inSynchronousPostLayout || inSubframeLayoutWithFrameFlattening)) {
             // If we need layout or are already in a synchronous call to postLayoutTasks(), 
             // defer widget updates and event dispatch until after we return. postLayoutTasks()
             // can make us need to update again, and we can get stuck in a nasty cycle unless
@@ -1119,6 +1134,7 @@ void FrameView::removeFixedObject()
         updateCanBlitOnScrollRecursively();
 }
 
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
 // When the screen size change, fixed positioned element should be updated.
 void FrameView::updatePositionedObjects()
@@ -1141,6 +1157,12 @@ void FrameView::updatePositionedObjects()
     }
 }
 #endif
+=======
+IntPoint FrameView::currentMousePosition() const
+{
+    return m_frame ? m_frame->eventHandler()->currentMousePosition() : IntPoint();
+}
+>>>>>>> webkit.org at r78450
 
 bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect)
 {
@@ -1165,8 +1187,8 @@ bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
             continue;
         IntRect updateRect = renderBox->layer()->repaintRectIncludingDescendants();
         updateRect = contentsToWindow(updateRect);
-
-        updateRect.intersect(rectToScroll);
+        if (clipsRepaints())
+            updateRect.intersect(rectToScroll);
         if (!updateRect.isEmpty()) {
             if (subRectToUpdate.size() >= fixedObjectThreshold) {
                 updateInvalidatedSubRect = false;
@@ -1188,7 +1210,8 @@ bool FrameView::scrollContentsFastPath(const IntSize& scrollDelta, const IntRect
             IntRect scrolledRect = updateRect;
             scrolledRect.move(scrollDelta);
             updateRect.unite(scrolledRect);
-            updateRect.intersect(rectToScroll);
+            if (clipsRepaints())
+                updateRect.intersect(rectToScroll);
             hostWindow()->invalidateContentsAndWindow(updateRect, false);
         }
         return true;
@@ -1462,6 +1485,12 @@ void FrameView::repaintContentRectangle(const IntRect& r, bool immediate)
     ScrollView::repaintContentRectangle(r, immediate);
 }
 
+void FrameView::contentsResized()
+{
+    scrollAnimator()->contentsResized();
+    setNeedsLayout();
+}
+
 void FrameView::visibleContentsResized()
 {
     // We check to make sure the view is attached to a frame() as this method can
@@ -1727,10 +1756,10 @@ void FrameView::unscheduleRelayout()
 }
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
-void FrameView::serviceScriptedAnimations()
+void FrameView::serviceScriptedAnimations(DOMTimeStamp time)
 {
     for (Frame* frame = m_frame.get(); frame; frame = frame->tree()->traverseNext())
-        frame->document()->serviceScriptedAnimations();
+        frame->document()->serviceScriptedAnimations(time);
 }
 #endif
 
@@ -1854,11 +1883,11 @@ void FrameView::updateWidget(RenderEmbeddedObject* object)
     // FIXME: This could turn into a real virtual dispatch if we defined
     // updateWidget(bool) on HTMLElement.
     if (ownerElement->hasTagName(objectTag) || ownerElement->hasTagName(embedTag))
-        static_cast<HTMLPlugInImageElement*>(ownerElement)->updateWidget(false);
+        static_cast<HTMLPlugInImageElement*>(ownerElement)->updateWidget(CreateAnyWidgetType);
     // FIXME: It is not clear that Media elements need or want this updateWidget() call.
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     else if (ownerElement->hasTagName(videoTag) || ownerElement->hasTagName(audioTag))
-        static_cast<HTMLMediaElement*>(ownerElement)->updateWidget(false);
+        static_cast<HTMLMediaElement*>(ownerElement)->updateWidget(CreateAnyWidgetType);
 #endif
     else
         ASSERT_NOT_REACHED();
@@ -1896,11 +1925,23 @@ bool FrameView::updateWidgets()
     
     return m_widgetUpdateSet->isEmpty();
 }
-    
+
+void FrameView::flushAnyPendingPostLayoutTasks()
+{
+    if (!m_hasPendingPostLayoutTasks)
+        return;
+
+    m_postLayoutTasksTimer.stop();
+    performPostLayoutTasks();
+}
+
 void FrameView::performPostLayoutTasks()
 {
     m_hasPendingPostLayoutTasks = false;
 
+    m_frame->selection()->setCaretRectNeedsUpdate();
+    m_frame->selection()->updateAppearance();
+
     if (m_firstLayoutCallbackPending) {
         m_firstLayoutCallbackPending = false;
         m_frame->loader()->didFirstLayout();
@@ -2063,6 +2104,14 @@ IntRect FrameView::windowResizerRect() const
     return page->chrome()->windowResizerRect();
 }
 
+void FrameView::didCompleteRubberBand(const IntSize& initialOverhang) const
+{
+    Page* page = m_frame->page();
+    if (page->mainFrame() != m_frame)
+        return;
+    return page->chrome()->client()->didCompleteRubberBandForMainFrame(initialOverhang);
+}
+
 #if ENABLE(DASHBOARD_SUPPORT)
 void FrameView::updateDashboardRegions()
 {
@@ -2169,7 +2218,7 @@ void FrameView::updateControlTints()
     // to define when controls get the tint and to call this function when that changes.
     
     // Optimize the common case where we bring a window to the front while it's still empty.
-    if (!m_frame || m_frame->loader()->url().isEmpty())
+    if (!m_frame || m_frame->document()->url().isEmpty())
         return;
 
     if ((m_frame->contentRenderer() && m_frame->contentRenderer()->theme()->supportsControlTints()) || hasCustomScrollbars())  {
@@ -2305,6 +2354,23 @@ void FrameView::setNodeToDraw(Node* node)
     m_nodeToDraw = node;
 }
 
+void FrameView::paintOverhangAreas(GraphicsContext* context, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect)
+{
+    if (context->paintingDisabled())
+        return;
+
+    if (m_frame->document()->printing())
+        return;
+
+    Page* page = m_frame->page();
+    if (page->mainFrame() == m_frame) {
+        if (page->chrome()->client()->paintCustomOverhangArea(context, horizontalOverhangArea, verticalOverhangArea, dirtyRect))
+            return;
+    }
+
+    return ScrollView::paintOverhangAreas(context, horizontalOverhangArea, verticalOverhangArea, dirtyRect);
+}
+
 void FrameView::updateLayoutAndStyleIfNeededRecursive()
 {
     // We have to crawl our entire tree looking for any FrameViews that need
@@ -2353,27 +2419,38 @@ void FrameView::forceLayoutForPagination(const FloatSize& pageSize, float maximu
     // the state of things before and after the layout
     RenderView *root = toRenderView(m_frame->document()->renderer());
     if (root) {
-        int pageW = ceilf(pageSize.width());
-        root->setWidth(pageW);
-        root->setPageLogicalHeight(pageSize.height());
+        float pageLogicalWidth = root->style()->isHorizontalWritingMode() ? pageSize.width() : pageSize.height();
+        float pageLogicalHeight = root->style()->isHorizontalWritingMode() ? pageSize.height() : pageSize.width();
+
+        int flooredPageLogicalWidth = static_cast<int>(pageLogicalWidth);
+        root->setLogicalWidth(flooredPageLogicalWidth);
+        root->setPageLogicalHeight(pageLogicalHeight);
         root->setNeedsLayoutAndPrefWidthsRecalc();
         forceLayout();
-
+        
         // If we don't fit in the given page width, we'll lay out again. If we don't fit in the
         // page width when shrunk, we will lay out at maximum shrink and clip extra content.
         // FIXME: We are assuming a shrink-to-fit printing implementation.  A cropping
         // implementation should not do this!
-        int docWidth = root->docWidth();
-        if (docWidth > pageSize.width()) {
-            pageW = std::min<int>(docWidth, ceilf(pageSize.width() * maximumShrinkFactor));
-            if (pageSize.height())
-                root->setPageLogicalHeight(pageW / pageSize.width() * pageSize.height());
-            root->setWidth(pageW);
+        int docLogicalWidth = root->style()->isHorizontalWritingMode() ? root->docWidth() : root->docHeight();
+        if (docLogicalWidth > pageLogicalWidth) {
+            flooredPageLogicalWidth = std::min<int>(docLogicalWidth, pageLogicalWidth * maximumShrinkFactor);
+            if (pageLogicalHeight)
+                root->setPageLogicalHeight(flooredPageLogicalWidth / pageSize.width() * pageSize.height());
+            root->setLogicalWidth(flooredPageLogicalWidth);
             root->setNeedsLayoutAndPrefWidthsRecalc();
             forceLayout();
-            int docHeight = root->docHeight();
             root->clearLayoutOverflow();
-            root->addLayoutOverflow(IntRect(0, 0, pageW, docHeight)); // This is how we clip in case we overflow again.
+            int docLogicalHeight = root->style()->isHorizontalWritingMode() ? root->docHeight() : root->docWidth();
+            int docLogicalTop = root->style()->isHorizontalWritingMode() ? root->docTop() : root->docLeft();
+            int docLogicalRight = root->style()->isHorizontalWritingMode() ? root->docRight() : root->docBottom();
+            int clippedLogicalLeft = 0;
+            if (!root->style()->isLeftToRightDirection())
+                clippedLogicalLeft = docLogicalRight - flooredPageLogicalWidth;
+            IntRect overflow(clippedLogicalLeft, docLogicalTop, flooredPageLogicalWidth, docLogicalHeight);
+            if (!root->style()->isHorizontalWritingMode())
+                overflow = overflow.transposedRect();
+            root->addLayoutOverflow(overflow); // This is how we clip in case we overflow again.
         }
     }
 
@@ -2388,7 +2465,7 @@ void FrameView::adjustPageHeightDeprecated(float *newBottom, float oldTop, float
         // Use a context with painting disabled.
         GraphicsContext context((PlatformGraphicsContext*)0);
         root->setTruncatedAt((int)floorf(oldBottom));
-        IntRect dirtyRect(0, (int)floorf(oldTop), root->rightLayoutOverflow(), (int)ceilf(oldBottom - oldTop));
+        IntRect dirtyRect(0, (int)floorf(oldTop), root->maxXLayoutOverflow(), (int)ceilf(oldBottom - oldTop));
         root->setPrintRect(dirtyRect);
         root->layer()->paint(&context, dirtyRect);
         *newBottom = root->bestTruncatedAt();
diff --git a/Source/WebCore/page/FrameView.h b/Source/WebCore/page/FrameView.h
index e61099e..6c0ead2 100644
--- a/Source/WebCore/page/FrameView.h
+++ b/Source/WebCore/page/FrameView.h
@@ -45,6 +45,7 @@ class RenderLayer;
 class RenderObject;
 class RenderEmbeddedObject;
 class RenderScrollbarPart;
+
 struct ScheduledEvent;
 
 template <typename T> class Timer;
@@ -101,7 +102,7 @@ public:
     bool needsFullRepaint() const { return m_doFullRepaint; }
 
 #if ENABLE(REQUEST_ANIMATION_FRAME)
-    void serviceScriptedAnimations();
+    void serviceScriptedAnimations(DOMTimeStamp);
 #endif
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -209,6 +210,8 @@ public:
     bool isPainting() const;
     void setNodeToDraw(Node*);
 
+    virtual void paintOverhangAreas(GraphicsContext*, const IntRect& horizontalOverhangArea, const IntRect& verticalOverhangArea, const IntRect& dirtyRect);
+
     static double currentPaintTimeStamp() { return sCurrentPaintTimeStamp; } // returns 0 if not painting
     
     void updateLayoutAndStyleIfNeededRecursive();
@@ -261,6 +264,11 @@ public:
     // On each repaint the delay increses by this amount
     static void setRepaintThrottlingDeferredRepaintDelayIncrementDuringLoading(double p);
 
+    virtual IntPoint currentMousePosition() const;
+
+    // FIXME: Remove this method once plugin loading is decoupled from layout.
+    void flushAnyPendingPostLayoutTasks();
+
 protected:
     virtual bool scrollContentsFastPath(const IntSize& scrollDelta, const IntRect& rectToScroll, const IntRect& clipRect);
     virtual void scrollContentsSlowPath(const IntRect& updateRect);
@@ -291,7 +299,7 @@ private:
     void performPostLayoutTasks();
 
     virtual void repaintContentRectangle(const IntRect&, bool immediate);
-    virtual void contentsResized() { setNeedsLayout(); }
+    virtual void contentsResized();
     virtual void visibleContentsResized();
 
     // Override ScrollView methods to do point conversion via renderers, in order to
@@ -305,8 +313,9 @@ private:
     virtual void invalidateScrollbarRect(Scrollbar*, const IntRect&);
     virtual bool isActive() const;
     virtual void getTickmarks(Vector<IntRect>&) const;
-
     virtual void scrollTo(const IntSize&);
+    virtual void didCompleteRubberBand(const IntSize&) const;
+    virtual bool scrollbarWillRenderIntoCompositingLayer() const { return hasCompositedContent() || isEnclosedInCompositingLayer(); }
 
     void deferredRepaintTimerFired(Timer<FrameView>*);
     void doDeferredRepaints();
diff --git a/Source/WebCore/page/Location.cpp b/Source/WebCore/page/Location.cpp
index be185f9..4835a83 100644
--- a/Source/WebCore/page/Location.cpp
+++ b/Source/WebCore/page/Location.cpp
@@ -51,7 +51,7 @@ inline const KURL& Location::url() const
 {
     ASSERT(m_frame);
 
-    const KURL& url = m_frame->loader()->url();
+    const KURL& url = m_frame->document()->url();
     if (!url.isValid())
         return blankURL(); // Use "about:blank" while the page is still loading (before we have a frame).
 
@@ -167,7 +167,7 @@ void Location::setProtocol(const String& protocol, DOMWindow* activeWindow, DOMW
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     if (!url.setProtocol(protocol)) {
         ec = SYNTAX_ERR;
         return;
@@ -179,7 +179,7 @@ void Location::setHost(const String& host, DOMWindow* activeWindow, DOMWindow* f
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     url.setHostAndPort(host);
     m_frame->domWindow()->setLocation(url.string(), activeWindow, firstWindow);
 }
@@ -188,7 +188,7 @@ void Location::setHostname(const String& hostname, DOMWindow* activeWindow, DOMW
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     url.setHost(hostname);
     m_frame->domWindow()->setLocation(url.string(), activeWindow, firstWindow);
 }
@@ -197,7 +197,7 @@ void Location::setPort(const String& portString, DOMWindow* activeWindow, DOMWin
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     int port = portString.toInt();
     if (port < 0 || port > 0xFFFF)
         url.removePort();
@@ -210,7 +210,7 @@ void Location::setPathname(const String& pathname, DOMWindow* activeWindow, DOMW
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     url.setPath(pathname);
     m_frame->domWindow()->setLocation(url.string(), activeWindow, firstWindow);
 }
@@ -219,7 +219,7 @@ void Location::setSearch(const String& search, DOMWindow* activeWindow, DOMWindo
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     url.setQuery(search);
     m_frame->domWindow()->setLocation(url.string(), activeWindow, firstWindow);
 }
@@ -228,7 +228,7 @@ void Location::setHash(const String& hash, DOMWindow* activeWindow, DOMWindow* f
 {
     if (!m_frame)
         return;
-    KURL url = m_frame->loader()->url();
+    KURL url = m_frame->document()->url();
     String oldFragmentIdentifier = url.fragmentIdentifier();
     String newFragmentIdentifier = hash;
     if (hash[0] == '#')
@@ -268,7 +268,7 @@ void Location::reload(DOMWindow* activeWindow)
         targetWindow->printErrorMessage(targetWindow->crossDomainAccessErrorMessage(activeWindow));
         return;
     }
-    if (protocolIsJavaScript(m_frame->loader()->url()))
+    if (protocolIsJavaScript(m_frame->document()->url()))
         return;
     m_frame->navigationScheduler()->scheduleRefresh();
 }
diff --git a/Source/WebCore/page/MemoryInfo.cpp b/Source/WebCore/page/MemoryInfo.cpp
index c2247b9..57dae2b 100644
--- a/Source/WebCore/page/MemoryInfo.cpp
+++ b/Source/WebCore/page/MemoryInfo.cpp
@@ -39,11 +39,12 @@ namespace WebCore {
 
 MemoryInfo::MemoryInfo(Frame* frame)
         : m_totalJSHeapSize(0),
-          m_usedJSHeapSize(0)
+          m_usedJSHeapSize(0),
+          m_jsHeapSizeLimit(0)
 {
     if (frame && frame->settings() && frame->settings()->memoryInfoEnabled()) {
 #if ENABLE(INSPECTOR)
-        ScriptGCEvent::getHeapSize(m_usedJSHeapSize, m_totalJSHeapSize);
+        ScriptGCEvent::getHeapSize(m_usedJSHeapSize, m_totalJSHeapSize, m_jsHeapSizeLimit);
 #endif
     }
 }
diff --git a/Source/WebCore/page/MemoryInfo.h b/Source/WebCore/page/MemoryInfo.h
index 615e952..27a7344 100644
--- a/Source/WebCore/page/MemoryInfo.h
+++ b/Source/WebCore/page/MemoryInfo.h
@@ -44,12 +44,14 @@ public:
 
     size_t totalJSHeapSize() const { return m_totalJSHeapSize; }
     size_t usedJSHeapSize() const { return m_usedJSHeapSize; }
+    size_t jsHeapSizeLimit() const { return m_jsHeapSizeLimit; }
 
 private:
     MemoryInfo(Frame*);
 
     size_t m_totalJSHeapSize;
     size_t m_usedJSHeapSize;
+    size_t m_jsHeapSizeLimit;
 };
 
 } // namespace WebCore
diff --git a/Source/WebCore/page/MemoryInfo.idl b/Source/WebCore/page/MemoryInfo.idl
index 59b0081..13965a5 100644
--- a/Source/WebCore/page/MemoryInfo.idl
+++ b/Source/WebCore/page/MemoryInfo.idl
@@ -34,6 +34,7 @@ module window {
 
         readonly attribute unsigned long totalJSHeapSize;
         readonly attribute unsigned long usedJSHeapSize;
+        readonly attribute [JSCCustomGetter] unsigned long jsHeapSizeLimit;
 
     };
 
diff --git a/Source/WebCore/page/Navigator.cpp b/Source/WebCore/page/Navigator.cpp
index 5390fc9..53563b4 100644
--- a/Source/WebCore/page/Navigator.cpp
+++ b/Source/WebCore/page/Navigator.cpp
@@ -27,10 +27,12 @@
 #include "CookieJar.h"
 #include "DOMMimeTypeArray.h"
 #include "DOMPluginArray.h"
+#include "ExceptionCode.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "Geolocation.h"
+#include "KURL.h"
 #include "Language.h"
 #include "Page.h"
 #include "PageGroup.h"
@@ -39,6 +41,7 @@
 #include "ScriptController.h"
 #include "Settings.h"
 #include "StorageNamespace.h"
+#include <wtf/StdLibExtras.h>
 
 #if PLATFORM(ANDROID)
 #include "ApplicationInstalledCallback.h"
@@ -209,4 +212,67 @@ void Navigator::getStorageUpdates()
 }
 #endif
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+static bool verifyCustomHandlerURL(const String& baseURL, const String& url, ExceptionCode& ec)
+{
+    // The specification requires that it is a SYNTAX_ERR if the "%s" token is
+    // not present.
+    static const char token[] = "%s";
+    int index = url.find(token);
+    if (-1 == index) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    // It is also a SYNTAX_ERR if the custom handler URL, as created by removing
+    // the "%s" token and prepending the base url, does not resolve.
+    String newURL = url;
+    newURL.remove(index, WTF_ARRAY_LENGTH(token) - 1);
+
+    KURL base(ParsedURLString, baseURL);
+    KURL kurl(base, newURL);
+
+    if (kurl.isEmpty() || !kurl.isValid()) {
+        ec = SYNTAX_ERR;
+        return false;
+    }
+
+    return true;
+}
+
+static bool verifyProtocolHandlerScheme(const String& scheme, ExceptionCode& ec)
+{
+    // It is a SECURITY_ERR for these schemes to be handled by a custom handler.
+    if (equalIgnoringCase(scheme, "http") || equalIgnoringCase(scheme, "https") || equalIgnoringCase(scheme, "file")) {
+        ec = SECURITY_ERR;
+        return false;
+    }
+    return true;
+}
+
+void Navigator::registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode& ec)
+{
+    if (!verifyProtocolHandlerScheme(scheme, ec))
+        return;
+
+    if (!m_frame)
+        return;
+
+    Document* document = m_frame->document();
+    if (!document)
+        return;
+
+    String baseURL = document->baseURL().baseAsString();
+
+    if (!verifyCustomHandlerURL(baseURL, url, ec))
+        return;
+
+    Page* page = m_frame->page();
+    if (!page)
+        return;
+
+    page->chrome()->registerProtocolHandler(scheme, baseURL, url, m_frame->displayStringModifiedByEncoding(title));
+}
+#endif
+
 } // namespace WebCore
diff --git a/Source/WebCore/page/Navigator.h b/Source/WebCore/page/Navigator.h
index e0801fe..f7dc543 100644
--- a/Source/WebCore/page/Navigator.h
+++ b/Source/WebCore/page/Navigator.h
@@ -42,6 +42,8 @@ class ApplicationInstalledCallback;
 class Connection;
 #endif
 
+typedef int ExceptionCode;
+
 class Navigator : public NavigatorBase, public RefCounted<Navigator> {
 public:
     static PassRefPtr<Navigator> create(Frame* frame) { return adoptRef(new Navigator(frame)); }
@@ -77,6 +79,10 @@ public:
     void getStorageUpdates();
 #endif
 
+#if ENABLE(REGISTER_PROTOCOL_HANDLER)
+    void registerProtocolHandler(const String& scheme, const String& url, const String& title, ExceptionCode&);
+#endif
+
 private:
     Navigator(Frame*);
     Frame* m_frame;
diff --git a/Source/WebCore/page/Navigator.idl b/Source/WebCore/page/Navigator.idl
index 5699d86..b92ef4a 100644
--- a/Source/WebCore/page/Navigator.idl
+++ b/Source/WebCore/page/Navigator.idl
@@ -57,6 +57,11 @@ module window {
 #if defined(ENABLE_DOM_STORAGE) && ENABLE_DOM_STORAGE
         void getStorageUpdates();
 #endif
+
+#if defined(ENABLE_REGISTER_PROTOCOL_HANDLER) && ENABLE_REGISTER_PROTOCOL_HANDLER
+        void registerProtocolHandler(in DOMString scheme, in DOMString url, in DOMString title)
+            raises(DomException);
+#endif
     };
 
 }
diff --git a/Source/WebCore/page/Page.cpp b/Source/WebCore/page/Page.cpp
index c4d5ca4..6ffea29 100644
--- a/Source/WebCore/page/Page.cpp
+++ b/Source/WebCore/page/Page.cpp
@@ -83,10 +83,6 @@
 #include "StorageNamespace.h"
 #endif
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-#include "ScriptDebugServer.h"
-#endif
-
 #if ENABLE(WML)
 #include "WMLPageState.h"
 #endif
@@ -198,10 +194,6 @@ Page::Page(const PageClients& pageClients)
         m_pluginHalter->setPluginAllowedRunTime(m_settings->pluginAllowedRunTime());
     }
 
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    ScriptDebugServer::shared().pageCreated(this);
-#endif
-
 #ifndef NDEBUG
     pageCounter.increment();
 #endif
@@ -365,7 +357,7 @@ void Page::goToItem(HistoryItem* item, FrameLoadType type)
 
 #if ENABLE(DATABASE)
         // If we're navigating the history via a fragment on the same document, then we do not want to stop databases.
-        const KURL& currentURL = m_mainFrame->loader()->url();
+        const KURL& currentURL = m_mainFrame->document()->url();
         const KURL& newURL = item->url();
     
         if (newURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(currentURL, newURL))
diff --git a/Source/WebCore/page/PrintContext.cpp b/Source/WebCore/page/PrintContext.cpp
index e82420d..da29f0e 100644
--- a/Source/WebCore/page/PrintContext.cpp
+++ b/Source/WebCore/page/PrintContext.cpp
@@ -55,16 +55,6 @@ PrintContext::~PrintContext()
         end();
 }
 
-size_t PrintContext::pageCount() const
-{
-    return m_pageRects.size();
-}
-
-const IntRect& PrintContext::pageRect(size_t pageNumber) const
-{
-    return m_pageRects[pageNumber];
-}
-
 void PrintContext::computePageRects(const FloatRect& printRect, float headerHeight, float footerHeight, float userScaleFactor, float& outPageHeight, bool allowHorizontalTiling)
 {
     m_pageRects.clear();
@@ -80,10 +70,20 @@ void PrintContext::computePageRects(const FloatRect& printRect, float headerHeig
 
     RenderView* view = toRenderView(m_frame->document()->renderer());
 
-    float ratio = printRect.height() / printRect.width();
+    bool isHorizontal = view->style()->isHorizontalWritingMode();
+
+    float pageWidth;
+    float pageHeight;
+    if (isHorizontal) {
+        float ratio = printRect.height() / printRect.width();
+        pageWidth = view->docWidth();
+        pageHeight = floorf(pageWidth * ratio);
+    } else {
+        float ratio = printRect.width() / printRect.height();
+        pageHeight = view->docHeight();
+        pageWidth = floorf(pageHeight * ratio);
+    }
 
-    float pageWidth  = view->docWidth();
-    float pageHeight = floorf(pageWidth * ratio);
     outPageHeight = pageHeight; // this is the height of the page adjusted by margins
     pageHeight -= headerHeight + footerHeight;
 
@@ -101,7 +101,7 @@ void PrintContext::computePageRectsWithPageSize(const FloatSize& pageSizeInPixel
     computePageRectsWithPageSizeInternal(pageSizeInPixels, allowHorizontalTiling);
 }
 
-void PrintContext::computePageRectsWithPageSizeInternal(const FloatSize& pageSizeInPixels, bool allowHorizontalTiling)
+void PrintContext::computePageRectsWithPageSizeInternal(const FloatSize& pageSizeInPixels, bool allowInlineDirectionTiling)
 {
     if (!m_frame->document() || !m_frame->view() || !m_frame->document()->renderer())
         return;
@@ -113,13 +113,60 @@ void PrintContext::computePageRectsWithPageSizeInternal(const FloatSize& pageSiz
     int pageWidth = pageSizeInPixels.width();
     int pageHeight = pageSizeInPixels.height();
 
-    unsigned pageCount = ceilf((float)docRect.height() / pageHeight);
+    bool isHorizontal = view->style()->isHorizontalWritingMode();
+
+    int docLogicalHeight = isHorizontal ? docRect.height() : docRect.width();
+    int pageLogicalHeight = isHorizontal ? pageHeight : pageWidth;
+    int pageLogicalWidth = isHorizontal ? pageWidth : pageHeight;
+
+    int inlineDirectionStart;
+    int inlineDirectionEnd;
+    int blockDirectionStart;
+    int blockDirectionEnd;
+    if (isHorizontal) {
+        if (view->style()->isFlippedBlocksWritingMode()) {
+            blockDirectionStart = docRect.maxY();
+            blockDirectionEnd = docRect.y();
+        } else {
+            blockDirectionStart = docRect.y();
+            blockDirectionEnd = docRect.maxY();
+        }
+        inlineDirectionStart = view->style()->isLeftToRightDirection() ? docRect.x() : docRect.maxX();
+        inlineDirectionEnd = view->style()->isLeftToRightDirection() ? docRect.maxX() : docRect.x();
+    } else {
+        if (view->style()->isFlippedBlocksWritingMode()) {
+            blockDirectionStart = docRect.maxX();
+            blockDirectionEnd = docRect.x();
+        } else {
+            blockDirectionStart = docRect.x();
+            blockDirectionEnd = docRect.maxX();
+        }
+        inlineDirectionStart = view->style()->isLeftToRightDirection() ? docRect.y() : docRect.maxY();
+        inlineDirectionEnd = view->style()->isLeftToRightDirection() ? docRect.maxY() : docRect.y();
+    }
+
+    unsigned pageCount = ceilf((float)docLogicalHeight / pageLogicalHeight);
     for (unsigned i = 0; i < pageCount; ++i) {
-        if (allowHorizontalTiling) {
-            for (int currentX = docRect.x(); currentX < docRect.right(); currentX += pageWidth)
-                m_pageRects.append(IntRect(currentX, docRect.y() + i * pageHeight, pageWidth, pageHeight));
-        } else
-            m_pageRects.append(IntRect(docRect.x(), docRect.y() + i * pageHeight, pageWidth, pageHeight));
+        int pageLogicalTop = blockDirectionEnd > blockDirectionStart ?
+                                blockDirectionStart + i * pageLogicalHeight : 
+                                blockDirectionStart - (i + 1) * pageLogicalHeight;
+        if (allowInlineDirectionTiling) {
+            for (int currentInlinePosition = inlineDirectionStart;
+                 inlineDirectionEnd > inlineDirectionStart ? currentInlinePosition < inlineDirectionEnd : currentInlinePosition > inlineDirectionEnd;
+                 currentInlinePosition += (inlineDirectionEnd > inlineDirectionStart ? pageLogicalWidth : -pageLogicalWidth)) {
+                int pageLogicalLeft = inlineDirectionEnd > inlineDirectionStart ? currentInlinePosition : currentInlinePosition - pageLogicalWidth;
+                IntRect pageRect(pageLogicalLeft, pageLogicalTop, pageLogicalWidth, pageLogicalHeight);
+                if (!isHorizontal)
+                    pageRect = pageRect.transposedRect();
+                m_pageRects.append(pageRect);
+            }
+        } else {
+            int pageLogicalLeft = inlineDirectionEnd > inlineDirectionStart ? inlineDirectionStart : inlineDirectionStart - pageLogicalWidth;
+            IntRect pageRect(pageLogicalLeft, pageLogicalTop, pageLogicalWidth, pageLogicalHeight);
+            if (!isHorizontal)
+                pageRect = pageRect.transposedRect();
+            m_pageRects.append(pageRect);
+        }
     }
 }
 
@@ -135,22 +182,27 @@ void PrintContext::begin(float width, float height)
     m_frame->setPrinting(true, FloatSize(minLayoutWidth, minLayoutHeight), printingMaximumShrinkFactor / printingMinimumShrinkFactor, Frame::AdjustViewSize);
 }
 
-float PrintContext::computeAutomaticScaleFactor(float availablePaperWidth)
+float PrintContext::computeAutomaticScaleFactor(const FloatSize& availablePaperSize)
 {
     if (!m_frame->view())
         return 1;
 
-    float viewWidth = m_frame->view()->contentsWidth();
-    if (viewWidth < 1)
+    bool useViewWidth = true;
+    if (m_frame->document() && m_frame->document()->renderView())
+        useViewWidth = m_frame->document()->renderView()->style()->isHorizontalWritingMode();
+
+    float viewLogicalWidth = useViewWidth ? m_frame->view()->contentsWidth() : m_frame->view()->contentsHeight();
+    if (viewLogicalWidth < 1)
         return 1;
 
     float maxShrinkToFitScaleFactor = 1 / printingMaximumShrinkFactor;
-    float shrinkToFitScaleFactor = availablePaperWidth / viewWidth;
+    float shrinkToFitScaleFactor = (useViewWidth ? availablePaperSize.width() : availablePaperSize.height()) / viewLogicalWidth;
     return max(maxShrinkToFitScaleFactor, shrinkToFitScaleFactor);
 }
 
 void PrintContext::spoolPage(GraphicsContext& ctx, int pageNumber, float width)
 {
+    // FIXME: Not correct for vertical text.
     IntRect pageRect = m_pageRects[pageNumber];
     float scale = width / pageRect.width();
 
@@ -164,9 +216,9 @@ void PrintContext::spoolPage(GraphicsContext& ctx, int pageNumber, float width)
 
 void PrintContext::spoolRect(GraphicsContext& ctx, const IntRect& rect)
 {
+    // FIXME: Not correct for vertical text.
     ctx.save();
-    ctx.scale(FloatSize(1, -1));
-    ctx.translate(0, -rect.height());
+    ctx.translate(-rect.x(), -rect.y());
     ctx.clip(rect);
     m_frame->view()->paintContents(&ctx, rect);
     ctx.restore();
@@ -212,7 +264,7 @@ int PrintContext::pageNumberForElement(Element* element, const FloatSize& pageSi
     size_t pageNumber = 0;
     for (; pageNumber < printContext.pageCount(); pageNumber++) {
         const IntRect& page = printContext.pageRect(pageNumber);
-        if (page.x() <= left && left < page.right() && page.y() <= top && top < page.bottom())
+        if (page.x() <= left && left < page.maxX() && page.y() <= top && top < page.maxY())
             return pageNumber;
     }
     return -1;
diff --git a/Source/WebCore/page/PrintContext.h b/Source/WebCore/page/PrintContext.h
index ce2554a..873937a 100644
--- a/Source/WebCore/page/PrintContext.h
+++ b/Source/WebCore/page/PrintContext.h
@@ -50,11 +50,11 @@ public:
     void computePageRectsWithPageSize(const FloatSize& pageSizeInPixels, bool allowHorizontalTiling);
 
     // These are only valid after page rects are computed.
-    size_t pageCount() const;
-    const IntRect& pageRect(size_t pageNumber) const;
+    size_t pageCount() const { return m_pageRects.size(); }
+    const IntRect& pageRect(size_t pageNumber) const { return m_pageRects[pageNumber]; }
     const Vector<IntRect>& pageRects() const { return m_pageRects; }
 
-    float computeAutomaticScaleFactor(float availablePaperWidth);
+    float computeAutomaticScaleFactor(const FloatSize& availablePaperSize);
 
     // Enter print mode, updating layout for new page size.
     // This function can be called multiple times to apply new print options without going back to screen mode.
diff --git a/Source/WebCore/page/SecurityOrigin.cpp b/Source/WebCore/page/SecurityOrigin.cpp
index 789fdf9..977e860 100644
--- a/Source/WebCore/page/SecurityOrigin.cpp
+++ b/Source/WebCore/page/SecurityOrigin.cpp
@@ -79,6 +79,18 @@ SecurityOrigin::SecurityOrigin(const KURL& url, SandboxFlags sandboxFlags)
     if (m_protocol == "about" || m_protocol == "javascript")
         m_protocol = "";
 
+#if ENABLE(FILE_SYSTEM)
+    if (m_protocol == "filesystem") {
+        KURL originURL(ParsedURLString, url.path());
+        if (originURL.isValid()) {
+            m_protocol = originURL.protocol().lower();
+            m_host = originURL.host().lower();
+            m_port = originURL.port();
+        } else
+            m_isUnique = true;
+    }
+#endif
+
     // For edge case URLs that were probably misparsed, make sure that the origin is unique.
     if (schemeRequiresAuthority(m_protocol) && m_host.isEmpty())
         m_isUnique = true;
@@ -178,6 +190,9 @@ bool SecurityOrigin::canAccess(const SecurityOrigin* other) const
     if (m_universalAccess)
         return true;
 
+    if (this == other)
+        return true;
+
     if (isUnique() || other->isUnique())
         return false;
 
@@ -310,11 +325,8 @@ bool SecurityOrigin::canDisplay(const KURL& url) const
 {
     String protocol = url.protocol().lower();
 
-#if ENABLE(BLOB)
-    // FIXME: We should generalize this check.
-    if (protocol == BlobURL::blobProtocol())
+    if (SchemeRegistry::canDisplayOnlyIfCanRequest(protocol))
         return canRequest(url);
-#endif
 
     if (SchemeRegistry::shouldTreatURLSchemeAsDisplayIsolated(protocol))
         return m_protocol == protocol || isAccessToURLWhiteListed(url);
diff --git a/Source/WebCore/page/Settings.cpp b/Source/WebCore/page/Settings.cpp
index a88ca6b..49180f5 100644
--- a/Source/WebCore/page/Settings.cpp
+++ b/Source/WebCore/page/Settings.cpp
@@ -168,6 +168,7 @@ Settings::Settings(Page* page)
     , m_showRepaintCounter(false)
     , m_experimentalNotificationsEnabled(false)
     , m_webGLEnabled(false)
+    , m_openGLMultisamplingEnabled(true)
     , m_webAudioEnabled(false)
     , m_acceleratedCanvas2dEnabled(false)
     , m_loadDeferringEnabled(true)
@@ -712,10 +713,12 @@ void Settings::setFrameFlatteningEnabled(bool frameFlatteningEnabled)
     m_frameFlatteningEnabled = frameFlatteningEnabled;
 }
 
+#if ENABLE(WEB_ARCHIVE)
 void Settings::setWebArchiveDebugModeEnabled(bool enabled)
 {
     m_webArchiveDebugModeEnabled = enabled;
 }
+#endif
 
 void Settings::setLocalFileContentSniffingEnabled(bool enabled)
 {
@@ -868,6 +871,11 @@ void Settings::setWebGLEnabled(bool enabled)
     m_webGLEnabled = enabled;
 }
 
+void Settings::setOpenGLMultisamplingEnabled(bool enabled)
+{
+    m_openGLMultisamplingEnabled = enabled;
+}
+
 void Settings::setAccelerated2dCanvasEnabled(bool enabled)
 {
     m_acceleratedCanvas2dEnabled = enabled;
diff --git a/Source/WebCore/page/Settings.h b/Source/WebCore/page/Settings.h
index 9f0982a..3b06834 100644
--- a/Source/WebCore/page/Settings.h
+++ b/Source/WebCore/page/Settings.h
@@ -302,9 +302,11 @@ namespace WebCore {
 
         void setNeedsSiteSpecificQuirks(bool);
         bool needsSiteSpecificQuirks() const { return m_needsSiteSpecificQuirks; }
-        
+
+#if ENABLE(WEB_ARCHIVE)
         void setWebArchiveDebugModeEnabled(bool);
         bool webArchiveDebugModeEnabled() const { return m_webArchiveDebugModeEnabled; }
+#endif
 
         void setLocalFileContentSniffingEnabled(bool);
         bool localFileContentSniffingEnabled() const { return m_localFileContentSniffingEnabled; }
@@ -386,6 +388,9 @@ namespace WebCore {
         void setWebGLEnabled(bool);
         bool webGLEnabled() const { return m_webGLEnabled; }
 
+        void setOpenGLMultisamplingEnabled(bool);
+        bool openGLMultisamplingEnabled() const { return m_openGLMultisamplingEnabled; }
+
         void setAccelerated2dCanvasEnabled(bool);
         bool accelerated2dCanvasEnabled() const { return m_acceleratedCanvas2dEnabled; }
 
@@ -548,6 +553,7 @@ namespace WebCore {
         bool m_showRepaintCounter : 1;
         bool m_experimentalNotificationsEnabled : 1;
         bool m_webGLEnabled : 1;
+        bool m_openGLMultisamplingEnabled : 1;
         bool m_webAudioEnabled : 1;
         bool m_acceleratedCanvas2dEnabled : 1;
         bool m_loadDeferringEnabled : 1;
diff --git a/Source/WebCore/page/SpatialNavigation.cpp b/Source/WebCore/page/SpatialNavigation.cpp
index 7d8ede3..34a2c97 100644
--- a/Source/WebCore/page/SpatialNavigation.cpp
+++ b/Source/WebCore/page/SpatialNavigation.cpp
@@ -127,7 +127,7 @@ static inline int middle(FocusDirection direction, const IntRect& rect)
 
 static inline int end(FocusDirection direction, const IntRect& rect)
 {
-    return isHorizontalMove(direction) ? rect.bottom() : rect.right();
+    return isHorizontalMove(direction) ? rect.maxY() : rect.maxX();
 }
 
 // This method checks if rects |a| and |b| are fully aligned either vertically or
@@ -144,11 +144,11 @@ static bool areRectsFullyAligned(FocusDirection direction, const IntRect& a, con
     switch (direction) {
     case FocusDirectionLeft:
         aStart = a.x();
-        bEnd = b.right();
+        bEnd = b.maxX();
         break;
     case FocusDirectionRight:
         aStart = b.x();
-        bEnd = a.right();
+        bEnd = a.maxX();
         break;
     case FocusDirectionUp:
         aStart = a.y();
@@ -245,13 +245,13 @@ static bool areRectsMoreThanFullScreenApart(FocusDirection direction, const IntR
 
     switch (direction) {
     case FocusDirectionLeft:
-        return curRect.x() - targetRect.right() > viewSize.width();
+        return curRect.x() - targetRect.maxX() > viewSize.width();
     case FocusDirectionRight:
-        return targetRect.x() - curRect.right() > viewSize.width();
+        return targetRect.x() - curRect.maxX() > viewSize.width();
     case FocusDirectionUp:
-        return curRect.y() - targetRect.bottom() > viewSize.height();
+        return curRect.y() - targetRect.maxY() > viewSize.height();
     case FocusDirectionDown:
-        return targetRect.y() - curRect.bottom() > viewSize.height();
+        return targetRect.y() - curRect.maxY() > viewSize.height();
     default:
         ASSERT_NOT_REACHED();
         return true;
@@ -261,26 +261,26 @@ static bool areRectsMoreThanFullScreenApart(FocusDirection direction, const IntR
 // Return true if rect |a| is below |b|. False otherwise.
 static inline bool below(const IntRect& a, const IntRect& b)
 {
-    return a.y() > b.bottom();
+    return a.y() > b.maxY();
 }
 
 // Return true if rect |a| is on the right of |b|. False otherwise.
 static inline bool rightOf(const IntRect& a, const IntRect& b)
 {
-    return a.x() > b.right();
+    return a.x() > b.maxX();
 }
 
 static bool isRectInDirection(FocusDirection direction, const IntRect& curRect, const IntRect& targetRect)
 {
     switch (direction) {
     case FocusDirectionLeft:
-        return targetRect.right() <= curRect.x();
+        return targetRect.maxX() <= curRect.x();
     case FocusDirectionRight:
-        return targetRect.x() >= curRect.right();
+        return targetRect.x() >= curRect.maxX();
     case FocusDirectionUp:
-        return targetRect.bottom() <= curRect.y();
+        return targetRect.maxY() <= curRect.y();
     case FocusDirectionDown:
-        return targetRect.y() >= curRect.bottom();
+        return targetRect.y() >= curRect.maxY();
     default:
         ASSERT_NOT_REACHED();
         return false;
@@ -544,18 +544,18 @@ void entryAndExitPointsForDirection(FocusDirection direction, const IntRect& sta
     switch (direction) {
     case FocusDirectionLeft:
         exitPoint.setX(startingRect.x());
-        entryPoint.setX(potentialRect.right());
+        entryPoint.setX(potentialRect.maxX());
         break;
     case FocusDirectionUp:
         exitPoint.setY(startingRect.y());
-        entryPoint.setY(potentialRect.bottom());
+        entryPoint.setY(potentialRect.maxY());
         break;
     case FocusDirectionRight:
-        exitPoint.setX(startingRect.right());
+        exitPoint.setX(startingRect.maxX());
         entryPoint.setX(potentialRect.x());
         break;
     case FocusDirectionDown:
-        exitPoint.setY(startingRect.bottom());
+        exitPoint.setY(startingRect.maxY());
         entryPoint.setY(potentialRect.y());
         break;
     default:
@@ -567,9 +567,9 @@ void entryAndExitPointsForDirection(FocusDirection direction, const IntRect& sta
     case FocusDirectionRight:
         if (below(startingRect, potentialRect)) {
             exitPoint.setY(startingRect.y());
-            entryPoint.setY(potentialRect.bottom());
+            entryPoint.setY(potentialRect.maxY());
         } else if (below(potentialRect, startingRect)) {
-            exitPoint.setY(startingRect.bottom());
+            exitPoint.setY(startingRect.maxY());
             entryPoint.setY(potentialRect.y());
         } else {
             exitPoint.setY(max(startingRect.y(), potentialRect.y()));
@@ -580,9 +580,9 @@ void entryAndExitPointsForDirection(FocusDirection direction, const IntRect& sta
     case FocusDirectionDown:
         if (rightOf(startingRect, potentialRect)) {
             exitPoint.setX(startingRect.x());
-            entryPoint.setX(potentialRect.right());
+            entryPoint.setX(potentialRect.maxX());
         } else if (rightOf(potentialRect, startingRect)) {
-            exitPoint.setX(startingRect.right());
+            exitPoint.setX(startingRect.maxX());
             entryPoint.setX(potentialRect.x());
         } else {
             exitPoint.setX(max(startingRect.x(), potentialRect.x()));
@@ -675,11 +675,11 @@ IntRect virtualRectForDirection(FocusDirection direction, const IntRect& startin
     IntRect virtualStartingRect = startingRect;
     switch (direction) {
     case FocusDirectionLeft:
-        virtualStartingRect.setX(virtualStartingRect.right() - width);
+        virtualStartingRect.setX(virtualStartingRect.maxX() - width);
         virtualStartingRect.setWidth(width);
         break;
     case FocusDirectionUp:
-        virtualStartingRect.setY(virtualStartingRect.bottom() - width);
+        virtualStartingRect.setY(virtualStartingRect.maxY() - width);
         virtualStartingRect.setHeight(width);
         break;
     case FocusDirectionRight:
@@ -701,7 +701,7 @@ IntRect virtualRectForAreaElementAndDirection(HTMLAreaElement* area, FocusDirect
     ASSERT(area->imageElement());
     // Area elements tend to overlap more than other focusable elements. We flatten the rect of the area elements
     // to minimize the effect of overlapping areas.
-    IntRect rect = virtualRectForDirection(direction, rectToAbsoluteCoordinates(area->document()->frame(), area->getRect(area->imageElement()->renderer())), 1);
+    IntRect rect = virtualRectForDirection(direction, rectToAbsoluteCoordinates(area->document()->frame(), area->computeRect(area->imageElement()->renderer())), 1);
     return rect;
 }
 
diff --git a/Source/WebCore/page/SuspendableTimer.cpp b/Source/WebCore/page/SuspendableTimer.cpp
index 23f00b0..2a4d2e5 100644
--- a/Source/WebCore/page/SuspendableTimer.cpp
+++ b/Source/WebCore/page/SuspendableTimer.cpp
@@ -36,6 +36,7 @@ SuspendableTimer::SuspendableTimer(ScriptExecutionContext* context)
     , m_nextFireInterval(0)
     , m_repeatInterval(0)
 #if !ASSERT_DISABLED
+    , m_active(false)
     , m_suspended(false)
 #endif
 {
@@ -61,9 +62,12 @@ void SuspendableTimer::suspend(ReasonForSuspension)
     ASSERT(!m_suspended);
     m_suspended = true;
 #endif
-    m_nextFireInterval = nextFireInterval();
-    m_repeatInterval = repeatInterval();
-    TimerBase::stop();
+    m_active = isActive();
+    if (m_active) {
+        m_nextFireInterval = nextFireInterval();
+        m_repeatInterval = repeatInterval();
+        TimerBase::stop();
+    }
 }
 
 void SuspendableTimer::resume()
@@ -72,7 +76,8 @@ void SuspendableTimer::resume()
     ASSERT(m_suspended);
     m_suspended = false;
 #endif
-    start(m_nextFireInterval, m_repeatInterval);
+    if (m_active)
+        start(m_nextFireInterval, m_repeatInterval);
 }
 
 bool SuspendableTimer::canSuspend() const
diff --git a/Source/WebCore/page/SuspendableTimer.h b/Source/WebCore/page/SuspendableTimer.h
index cc90b62..fa03d6e 100644
--- a/Source/WebCore/page/SuspendableTimer.h
+++ b/Source/WebCore/page/SuspendableTimer.h
@@ -34,7 +34,7 @@ namespace WebCore {
 
 class SuspendableTimer : public TimerBase, public ActiveDOMObject {
 public:
-    SuspendableTimer(ScriptExecutionContext*);
+    explicit SuspendableTimer(ScriptExecutionContext*);
     virtual ~SuspendableTimer();
 
     // ActiveDOMObject
@@ -49,6 +49,7 @@ private:
 
     double m_nextFireInterval;
     double m_repeatInterval;
+    bool m_active;
 #if !ASSERT_DISABLED
     bool m_suspended;
 #endif
diff --git a/Source/WebCore/page/WindowFeatures.cpp b/Source/WebCore/page/WindowFeatures.cpp
index a229ae1..7564152 100644
--- a/Source/WebCore/page/WindowFeatures.cpp
+++ b/Source/WebCore/page/WindowFeatures.cpp
@@ -186,9 +186,9 @@ WindowFeatures::WindowFeatures(const String& dialogFeaturesString, const FloatRe
     width = floatFeature(features, "dialogwidth", 100, screenAvailableRect.width(), 620); // default here came from frame size of dialog in MacIE
     height = floatFeature(features, "dialogheight", 100, screenAvailableRect.height(), 450); // default here came from frame size of dialog in MacIE
 
-    x = floatFeature(features, "dialogleft", screenAvailableRect.x(), screenAvailableRect.right() - width, -1);
+    x = floatFeature(features, "dialogleft", screenAvailableRect.x(), screenAvailableRect.maxX() - width, -1);
     xSet = x > 0;
-    y = floatFeature(features, "dialogtop", screenAvailableRect.y(), screenAvailableRect.bottom() - height, -1);
+    y = floatFeature(features, "dialogtop", screenAvailableRect.y(), screenAvailableRect.maxY() - height, -1);
     ySet = y > 0;
 
     if (boolFeature(features, "center", true)) {
diff --git a/Source/WebCore/page/XSSAuditor.cpp b/Source/WebCore/page/XSSAuditor.cpp
deleted file mode 100644
index 1b0e83f..0000000
--- a/Source/WebCore/page/XSSAuditor.cpp
+++ /dev/null
@@ -1,432 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Daniel Bates (dbates@intudata.com)
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "XSSAuditor.h"
-
-#include <wtf/StdLibExtras.h>
-#include <wtf/Vector.h>
-
-#include "Console.h"
-#include "DocumentLoader.h"
-#include "DOMWindow.h"
-#include "Frame.h"
-#include "HTMLEntityParser.h"
-#include "KURL.h"
-#include "ResourceResponseBase.h"
-#include "ScriptSourceCode.h"
-#include "Settings.h"
-#include "TextResourceDecoder.h"
-#include <wtf/text/CString.h>
-#include <wtf/text/StringConcatenate.h>
-
-namespace WebCore {
-
-static bool isNonCanonicalCharacter(UChar c)
-{
-    // We remove all non-ASCII characters, including non-printable ASCII characters.
-    //
-    // Note, we don't remove backslashes like PHP stripslashes(), which among other things converts "\\0" to the \0 character.
-    // Instead, we remove backslashes and zeros (since the string "\\0" =(remove backslashes)=> "0"). However, this has the 
-    // adverse effect that we remove any legitimate zeros from a string.
-    //
-    // For instance: new String("http://localhost:8000") => new String("http://localhost:8").
-    return (c == '\\' || c == '0' || c < ' ' || c >= 127);
-}
-
-static bool isIllegalURICharacter(UChar c)
-{
-    // The characters described in section 2.4.3 of RFC 2396 <http://www.faqs.org/rfcs/rfc2396.html> in addition to the 
-    // single quote character "'" are considered illegal URI characters. That is, the following characters cannot appear
-    // in a valid URI: ', ", <, >
-    //
-    // If the request does not contain these characters then we can assume that no inline scripts have been injected 
-    // into the response page, because it is impossible to write an inline script of the form <script>...</script>
-    // without "<", ">".
-    return (c == '\'' || c == '"' || c == '<' || c == '>');
-}
-
-String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(FormData* formData, const TextEncoding& encoding, bool decodeEntities, 
-                                                            bool decodeURLEscapeSequencesTwice)
-{
-    if (decodeEntities == m_decodeEntities && decodeURLEscapeSequencesTwice == m_decodeURLEscapeSequencesTwice 
-        && encoding == m_encoding && formData == m_formData)
-        return m_cachedCanonicalizedURL;
-    m_formData = formData;
-    return canonicalizeURL(formData->flattenToString(), encoding, decodeEntities, decodeURLEscapeSequencesTwice);
-}
-
-String XSSAuditor::CachingURLCanonicalizer::canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
-                                                            bool decodeURLEscapeSequencesTwice)
-{
-    if (decodeEntities == m_decodeEntities && decodeURLEscapeSequencesTwice == m_decodeURLEscapeSequencesTwice 
-        && encoding == m_encoding && url == m_inputURL)
-        return m_cachedCanonicalizedURL;
-
-    m_cachedCanonicalizedURL = canonicalize(decodeURL(url, encoding, decodeEntities, decodeURLEscapeSequencesTwice));
-    m_inputURL = url;
-    m_encoding = encoding;
-    m_decodeEntities = decodeEntities;
-    m_decodeURLEscapeSequencesTwice = decodeURLEscapeSequencesTwice;
-    ++m_generation;
-    return m_cachedCanonicalizedURL;
-}
-
-void XSSAuditor::CachingURLCanonicalizer::clear()
-{
-    m_formData.clear();
-    m_inputURL = String();
-}
-
-XSSAuditor::XSSAuditor(Frame* frame)
-    : m_frame(frame)
-    , m_generationOfSuffixTree(-1)
-{
-}
-
-XSSAuditor::~XSSAuditor()
-{
-}
-
-bool XSSAuditor::isEnabled() const
-{
-    Settings* settings = m_frame->settings();
-    return (settings && settings->xssAuditorEnabled());
-}
-
-bool XSSAuditor::canEvaluate(const String& code) const
-{
-    if (!isEnabled())
-        return true;
-
-    FindTask task;
-    task.string = code;
-    task.decodeEntities = false;
-    task.allowRequestIfNoIllegalURICharacters = true;
-
-    if (findInRequest(task)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-bool XSSAuditor::canEvaluateJavaScriptURL(const String& code) const
-{
-    if (!isEnabled())
-        return true;
-
-    FindTask task;
-    task.string = code;
-    task.decodeURLEscapeSequencesTwice = true;
-
-    if (findInRequest(task)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-bool XSSAuditor::canCreateInlineEventListener(const String&, const String& code) const
-{
-    if (!isEnabled())
-        return true;
-
-    FindTask task;
-    task.string = code;
-    task.allowRequestIfNoIllegalURICharacters = true;
-
-    if (findInRequest(task)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-bool XSSAuditor::canLoadExternalScriptFromSrc(const String& url) const
-{
-    if (!isEnabled())
-        return true;
-
-    if (isSameOriginResource(url))
-        return true;
-
-    FindTask task;
-    task.string = url;
-    task.allowRequestIfNoIllegalURICharacters = true;
-
-    if (findInRequest(task)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to execute a JavaScript script. Source code of script found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-bool XSSAuditor::canLoadObject(const String& url) const
-{
-    if (!isEnabled())
-        return true;
-
-    if (isSameOriginResource(url))
-        return true;
-
-    FindTask task;
-    task.string = url;
-    task.allowRequestIfNoIllegalURICharacters = true;
-
-    if (findInRequest(task)) {
-        String consoleMessage = makeString("Refused to load an object. URL found within request: \"", url, "\".\n");
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-bool XSSAuditor::canSetBaseElementURL(const String& url) const
-{
-    if (!isEnabled())
-        return true;
-
-    if (isSameOriginResource(url))
-        return true;
-
-    FindTask task;
-    task.string = url;
-    task.allowRequestIfNoIllegalURICharacters = true;
-
-    if (findInRequest(task)) {
-        DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to load from document base URL. URL found within request.\n"));
-        m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
-        return false;
-    }
-    return true;
-}
-
-String XSSAuditor::canonicalize(const String& string)
-{
-    String result = decodeHTMLEntities(string);
-    return result.removeCharacters(&isNonCanonicalCharacter);
-}
-
-String XSSAuditor::decodeURL(const String& string, const TextEncoding& encoding, bool decodeEntities, bool decodeURLEscapeSequencesTwice)
-{
-    String result;
-    String url = string;
-
-    url.replace('+', ' ');
-    result = decodeURLEscapeSequences(url);
-    CString utf8Url = result.utf8();
-    String decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
-    if (!decodedResult.isEmpty())
-        result = decodedResult;
-    if (decodeURLEscapeSequencesTwice) {
-        result = decodeURLEscapeSequences(result);
-        utf8Url = result.utf8();
-        decodedResult = encoding.decode(utf8Url.data(), utf8Url.length());
-        if (!decodedResult.isEmpty())
-            result = decodedResult;
-    }
-    if (decodeEntities)
-        result = decodeHTMLEntities(result);
-    return result;
-}
-
-String XSSAuditor::decodeHTMLEntities(const String& string, bool leaveUndecodableEntitiesUntouched)
-{
-    SegmentedString source(string);
-    SegmentedString sourceShadow;
-    Vector<UChar> result;
-    
-    while (!source.isEmpty()) {
-        UChar cc = *source;
-        source.advance();
-        
-        if (cc != '&') {
-            result.append(cc);
-            continue;
-        }
-        
-        if (leaveUndecodableEntitiesUntouched)
-            sourceShadow = source;
-        bool notEnoughCharacters = false;
-        Vector<UChar, 16> decodedEntity;
-        bool success = consumeHTMLEntity(source, decodedEntity, notEnoughCharacters);
-        // We ignore notEnoughCharacters because we might as well use this loop
-        // to copy the remaining characters into |result|.
-        if (!success || (!leaveUndecodableEntitiesUntouched && decodedEntity.size() == 1 && decodedEntity[0] == 0xFFFD)) {
-            result.append('&');
-            if (leaveUndecodableEntitiesUntouched)
-                source = sourceShadow;
-        } else {
-            Vector<UChar>::const_iterator iter = decodedEntity.begin();
-            for (; iter != decodedEntity.end(); ++iter)
-                result.append(*iter);
-        }
-    }
-    
-    return String::adopt(result);
-}
-
-bool XSSAuditor::isSameOriginResource(const String& url) const
-{
-    // If the resource is loaded from the same URL as the enclosing page, it's
-    // probably not an XSS attack, so we reduce false positives by allowing the
-    // request. If the resource has a query string, we're more suspicious,
-    // however, because that's pretty rare and the attacker might be able to
-    // trick a server-side script into doing something dangerous with the query
-    // string.
-    KURL resourceURL(m_frame->document()->url(), url);
-    return (m_frame->document()->url().host() == resourceURL.host() && resourceURL.query().isEmpty());
-}
-
-XSSProtectionDisposition XSSAuditor::xssProtection() const
-{
-    DEFINE_STATIC_LOCAL(String, XSSProtectionHeader, ("X-XSS-Protection"));
-
-    Frame* frame = m_frame;
-    if (frame->document()->url() == blankURL())
-        frame = m_frame->tree()->parent();
-
-    return parseXSSProtectionHeader(frame->loader()->documentLoader()->response().httpHeaderField(XSSProtectionHeader));
-}
-
-bool XSSAuditor::findInRequest(const FindTask& task) const
-{
-    bool result = false;
-    Frame* parentFrame = m_frame->tree()->parent();
-    Frame* blockFrame = parentFrame;
-    if (parentFrame && m_frame->document()->url() == blankURL())
-        result = findInRequest(parentFrame, task);
-    if (!result) {
-        result = findInRequest(m_frame, task);
-        blockFrame = m_frame;
-    }
-    if (!result)
-        return false;
-
-    switch (xssProtection()) {
-    case XSSProtectionDisabled:
-        return false;
-    case XSSProtectionEnabled:
-        break;
-    case XSSProtectionBlockEnabled:
-        if (blockFrame) {
-            blockFrame->loader()->stopAllLoaders();
-            blockFrame->navigationScheduler()->scheduleLocationChange(blockFrame->document()->securityOrigin(), blankURL(), String());
-        }
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-    }
-    return true;
-}
-
-bool XSSAuditor::findInRequest(Frame* frame, const FindTask& task) const
-{
-    ASSERT(frame->document());
-
-    if (!frame->document()->decoder()) {
-        // Note, JavaScript URLs do not have a charset.
-        return false;
-    }
-
-    if (task.string.isEmpty())
-        return false;
-
-    DocumentLoader *documentLoader = frame->loader()->documentLoader();
-    if (!documentLoader)
-        return false;
-
-    FormData* formDataObj = documentLoader->originalRequest().httpBody();
-    const bool hasFormData = formDataObj && !formDataObj->isEmpty();
-    String pageURL = frame->document()->url().string();
-
-    if (!hasFormData) {
-        // We clear out our form data caches, in case we're holding onto a bunch of memory.
-        m_formDataCache.clear();
-        m_formDataSuffixTree.clear();
-    }
-
-    String canonicalizedString;
-    if (!hasFormData && task.string.length() > 2 * pageURL.length()) {
-        // Q: Why do we bother to do this check at all?
-        // A: Canonicalizing large inline scripts can be expensive.  We want to
-        //    reduce the size of the string before we call canonicalize below,
-        //    since it could result in an unneeded allocation and memcpy.
-        //
-        // Q: Why do we multiply by two here?
-        // A: We attempt to detect reflected XSS even when the server
-        //    transforms the attacker's input with addSlashes.  The best the
-        //    attacker can do get the server to inflate his/her input by a
-        //    factor of two by sending " characters, which the server
-        //    transforms to \".
-        canonicalizedString = task.string.substring(0, 2 * pageURL.length());
-    } else
-        canonicalizedString = task.string;
-
-    if (frame->document()->url().protocolIsData())
-        return false;
-
-    canonicalizedString = canonicalize(canonicalizedString);
-    if (canonicalizedString.isEmpty())
-        return false;
-
-    if (!task.context.isEmpty())
-        canonicalizedString = task.context + canonicalizedString;
-
-    String decodedPageURL = m_pageURLCache.canonicalizeURL(pageURL, frame->document()->decoder()->encoding(), task.decodeEntities, task.decodeURLEscapeSequencesTwice);
-
-    if (task.allowRequestIfNoIllegalURICharacters && !hasFormData && decodedPageURL.find(&isIllegalURICharacter, 0) == notFound)
-        return false; // Injection is impossible because the request does not contain any illegal URI characters.
-
-    if (decodedPageURL.find(canonicalizedString, 0, false) != notFound)
-        return true; // We've found the string in the GET data.
-
-    if (hasFormData) {
-        String decodedFormData = m_formDataCache.canonicalizeURL(formDataObj, frame->document()->decoder()->encoding(), task.decodeEntities, task.decodeURLEscapeSequencesTwice);
-
-        if (m_generationOfSuffixTree != m_formDataCache.generation()) {
-            m_formDataSuffixTree = new SuffixTree<ASCIICodebook>(decodedFormData, 5);
-            m_generationOfSuffixTree = m_formDataCache.generation();
-        }
-
-        // Try a fast-reject via the suffixTree.
-        if (m_formDataSuffixTree && !m_formDataSuffixTree->mightContain(canonicalizedString))
-            return false;
-
-        if (decodedFormData.find(canonicalizedString, 0, false) != notFound)
-            return true; // We found the string in the POST data.
-    }
-
-    return false;
-}
-
-} // namespace WebCore
-
diff --git a/Source/WebCore/page/XSSAuditor.h b/Source/WebCore/page/XSSAuditor.h
deleted file mode 100644
index 5beed61..0000000
--- a/Source/WebCore/page/XSSAuditor.h
+++ /dev/null
@@ -1,181 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Daniel Bates (dbates@intudata.com)
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef XSSAuditor_h
-#define XSSAuditor_h
-
-#include "HTTPParsers.h"
-#include "PlatformString.h"
-#include "SuffixTree.h"
-#include "TextEncoding.h"
-
-namespace WebCore {
-
-    class FormData;
-    class Frame;
-    class ScriptSourceCode;
-
-    // The XSSAuditor class is used to prevent type 1 cross-site scripting
-    // vulnerabilities (also known as reflected vulnerabilities).
-    //
-    // More specifically, the XSSAuditor class decides whether the execution of
-    // a script is to be allowed or denied based on the content of any
-    // user-submitted data, including:
-    //
-    // * the URL.
-    // * the HTTP-POST data.
-    //
-    // If the source code of a script resembles any user-submitted data then it
-    // is denied execution.
-    //
-    // When you instantiate the XSSAuditor you must specify the Frame of the
-    // page that you wish to audit.
-    //
-    // Bindings
-    //
-    // An XSSAuditor is instantiated within the constructor of a
-    // ScriptController object and passed the Frame the script originated. The
-    // ScriptController calls back to the XSSAuditor to determine whether a
-    // JavaScript script is safe to execute before executing it. The following
-    // methods call into XSSAuditor:
-    //
-    // * ScriptController::evaluateInWorld - used to evaluate JavaScript scripts.
-    // * ScriptController::executeIfJavaScriptURL - used to evaluate JavaScript URLs.
-    // * ScriptEventListener::createAttributeEventListener - used to create JavaScript event handlers.
-    // * HTMLBaseElement::process - used to set the document base URL.
-    // * HTMLDocumentParser::shouldLoadExternalScriptFromSrc - used to load external JavaScript scripts.
-    // * SubframeLoader::requestObject - used to load <object>/<embed> elements.
-    //
-    class XSSAuditor {
-        WTF_MAKE_NONCOPYABLE(XSSAuditor); WTF_MAKE_FAST_ALLOCATED;
-    public:
-        XSSAuditor(Frame*);
-        ~XSSAuditor();
-
-        bool isEnabled() const;
-
-        // Determines whether the script should be allowed or denied execution
-        // based on the content of any user-submitted data.
-        bool canEvaluate(const String& code) const;
-
-        // Determines whether the JavaScript URL should be allowed or denied execution
-        // based on the content of any user-submitted data.
-        bool canEvaluateJavaScriptURL(const String& code) const;
-
-        // Determines whether the event listener should be created based on the
-        // content of any user-submitted data.
-        bool canCreateInlineEventListener(const String& functionName, const String& code) const;
-
-        // Determines whether the external script should be loaded based on the
-        // content of any user-submitted data.
-        bool canLoadExternalScriptFromSrc(const String& url) const;
-
-        // Determines whether object should be loaded based on the content of
-        // any user-submitted data.
-        //
-        // This method is called by SubframeLoader::requestObject.
-        bool canLoadObject(const String& url) const;
-
-        // Determines whether the base URL should be changed based on the content
-        // of any user-submitted data.
-        //
-        // This method is called by HTMLBaseElement::process.
-        bool canSetBaseElementURL(const String& url) const;
-
-    private:
-        class CachingURLCanonicalizer
-        {
-        public:
-            CachingURLCanonicalizer() : m_decodeEntities(false), m_decodeURLEscapeSequencesTwice(false), m_generation(0) { }
-            String canonicalizeURL(FormData*, const TextEncoding& encoding, bool decodeEntities, 
-                                   bool decodeURLEscapeSequencesTwice);
-            String canonicalizeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
-                                   bool decodeURLEscapeSequencesTwice);
-
-            void clear();
-
-            int generation() const { return m_generation; }
-
-        private:
-            // The parameters we were called with last.
-            String m_inputURL;
-            TextEncoding m_encoding;
-            bool m_decodeEntities;
-            bool m_decodeURLEscapeSequencesTwice;
-            RefPtr<FormData> m_formData;
-
-            // Incremented every time we see a new URL.
-            int m_generation;
-
-            // The cached result.
-            String m_cachedCanonicalizedURL;
-        };
-
-        struct FindTask {
-            FindTask()
-                : decodeEntities(true)
-                , allowRequestIfNoIllegalURICharacters(false)
-                , decodeURLEscapeSequencesTwice(false)
-            {
-            }
-
-            String context;
-            String string;
-            bool decodeEntities;
-            bool allowRequestIfNoIllegalURICharacters;
-            bool decodeURLEscapeSequencesTwice;
-        };
-
-        static String canonicalize(const String&);
-        static String decodeURL(const String& url, const TextEncoding& encoding, bool decodeEntities, 
-                                bool decodeURLEscapeSequencesTwice = false);
-        static String decodeHTMLEntities(const String&, bool leaveUndecodableEntitiesUntouched = true);
-
-        bool isSameOriginResource(const String& url) const;
-        bool findInRequest(const FindTask&) const;
-        bool findInRequest(Frame*, const FindTask&) const;
-
-        XSSProtectionDisposition xssProtection() const;
-
-        // The frame to audit.
-        Frame* m_frame;
-
-        // A state store to help us avoid canonicalizing the same URL repeated.
-        // When a page has form data, we need two caches: one to store the
-        // canonicalized URL and another to store the cannonicalized form
-        // data. If we only had one cache, we'd always generate a cache miss
-        // and load some pages extremely slowly.
-        // https://bugs.webkit.org/show_bug.cgi?id=35373
-        mutable CachingURLCanonicalizer m_pageURLCache;
-        mutable CachingURLCanonicalizer m_formDataCache;
-
-        mutable OwnPtr<SuffixTree<ASCIICodebook> > m_formDataSuffixTree;
-        mutable int m_generationOfSuffixTree;
-    };
-
-} // namespace WebCore
-
-#endif // XSSAuditor_h
diff --git a/Source/WebCore/page/animation/AnimationController.cpp b/Source/WebCore/page/animation/AnimationController.cpp
index e1281dd..dcdea03 100644
--- a/Source/WebCore/page/animation/AnimationController.cpp
+++ b/Source/WebCore/page/animation/AnimationController.cpp
@@ -145,16 +145,16 @@ void AnimationControllerPrivate::fireEventsAndUpdateStyle()
     bool updateStyle = !m_eventsToDispatch.isEmpty() || !m_nodeChangesToDispatch.isEmpty();
     
     // fire all the events
-    Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = m_eventsToDispatch.end();
-    for (Vector<EventToDispatch>::const_iterator it = m_eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
+    Vector<EventToDispatch> eventsToDispatch = m_eventsToDispatch;
+    m_eventsToDispatch.clear();
+    Vector<EventToDispatch>::const_iterator eventsToDispatchEnd = eventsToDispatch.end();
+    for (Vector<EventToDispatch>::const_iterator it = eventsToDispatch.begin(); it != eventsToDispatchEnd; ++it) {
         if (it->eventType == eventNames().webkitTransitionEndEvent)
             it->element->dispatchEvent(WebKitTransitionEvent::create(it->eventType, it->name, it->elapsedTime));
         else
             it->element->dispatchEvent(WebKitAnimationEvent::create(it->eventType, it->name, it->elapsedTime));
     }
     
-    m_eventsToDispatch.clear();
-    
     // call setChanged on all the elements
     Vector<RefPtr<Node> >::const_iterator nodeChangesToDispatchEnd = m_nodeChangesToDispatch.end();
     for (Vector<RefPtr<Node> >::const_iterator it = m_nodeChangesToDispatch.begin(); it != nodeChangesToDispatchEnd; ++it)
diff --git a/Source/WebCore/page/chromium/FrameChromium.cpp b/Source/WebCore/page/chromium/FrameChromium.cpp
index f6f47a6..e9dc2a3 100644
--- a/Source/WebCore/page/chromium/FrameChromium.cpp
+++ b/Source/WebCore/page/chromium/FrameChromium.cpp
@@ -85,7 +85,7 @@ DragImageRef Frame::nodeImage(Node* node)
     if (!buffer)
         return 0;
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
-    buffer->context()->clip(FloatRect(0, 0, paintingRect.right(), paintingRect.bottom()));
+    buffer->context()->clip(FloatRect(0, 0, paintingRect.maxX(), paintingRect.maxY()));
 
     m_view->paintContents(buffer->context(), paintingRect);
 
@@ -108,7 +108,7 @@ DragImageRef Frame::dragImageForSelection()
     if (!buffer)
         return 0;
     buffer->context()->translate(-paintingRect.x(), -paintingRect.y());
-    buffer->context()->clip(FloatRect(0, 0, paintingRect.right(), paintingRect.bottom()));
+    buffer->context()->clip(FloatRect(0, 0, paintingRect.maxX(), paintingRect.maxY()));
 
     m_view->paintContents(buffer->context(), paintingRect);
 
diff --git a/Source/WebCore/page/mac/WebCoreFrameView.h b/Source/WebCore/page/mac/WebCoreFrameView.h
index b76350d..93a0296 100644
--- a/Source/WebCore/page/mac/WebCoreFrameView.h
+++ b/Source/WebCore/page/mac/WebCoreFrameView.h
@@ -33,7 +33,7 @@ namespace WebCore {
 - (void)setScrollingModes:(WebCore::ScrollbarMode)hMode vertical:(WebCore::ScrollbarMode)vMode andLock:(BOOL)lock;
 - (void)scrollingModes:(WebCore::ScrollbarMode*)hMode vertical:(WebCore::ScrollbarMode*)vMode;
 - (void)setScrollBarsSuppressed:(BOOL)suppressed repaintOnUnsuppress:(BOOL)repaint;
-- (void)setScrollOrigin:(NSPoint)origin updatePosition:(BOOL)updatePosition;
+- (void)setScrollOrigin:(NSPoint)origin updatePositionAtAll:(BOOL)updatePositionAtAll immediately:(BOOL)updatePositionImmediately;
 - (NSPoint)scrollOrigin;
 @end
 
diff --git a/Source/WebCore/page/qt/FrameQt.cpp b/Source/WebCore/page/qt/FrameQt.cpp
index bb577e0..4d1dd1d 100644
--- a/Source/WebCore/page/qt/FrameQt.cpp
+++ b/Source/WebCore/page/qt/FrameQt.cpp
@@ -52,7 +52,7 @@ DragImageRef Frame::dragImageForSelection()
 
     GraphicsContext* context = buffer->context();
     context->translate(-paintingRect.x(), -paintingRect.y());
-    context->clip(FloatRect(0, 0, paintingRect.right(), paintingRect.bottom()));
+    context->clip(FloatRect(0, 0, paintingRect.maxX(), paintingRect.maxY()));
 
     PaintBehavior previousPaintBehavior = m_view->paintBehavior();
     m_view->setPaintBehavior(PaintBehaviorSelectionOnly);
diff --git a/Source/WebCore/page/wince/FrameWinCE.cpp b/Source/WebCore/page/wince/FrameWinCE.cpp
index 9eb487b..60e9aac 100644
--- a/Source/WebCore/page/wince/FrameWinCE.cpp
+++ b/Source/WebCore/page/wince/FrameWinCE.cpp
@@ -76,7 +76,7 @@ void computePageRectsForFrame(Frame* frame, const IntRect& printRect, float head
 
     float ratio = (float)printRect.height() / (float)printRect.width();
 
-    float pageWidth  = (float) root->rightLayoutOverflow();
+    float pageWidth  = (float) root->maxXLayoutOverflow();
     float pageHeight = pageWidth * ratio;
     outPageHeight = (int) pageHeight;   // this is the height of the page adjusted by margins
     pageHeight -= (headerHeight + footerHeight);
diff --git a/Source/WebCore/page/wx/DragControllerWx.cpp b/Source/WebCore/page/wx/DragControllerWx.cpp
index 4a4d064..5c19c47 100644
--- a/Source/WebCore/page/wx/DragControllerWx.cpp
+++ b/Source/WebCore/page/wx/DragControllerWx.cpp
@@ -52,7 +52,7 @@ bool DragController::isCopyKeyDown(DragData*)
 DragOperation DragController::dragOperation(DragData* dragData)
 {
     //FIXME: This logic is incomplete
-    if (dragData->containsURL())
+    if (dragData->containsURL(0))
         return DragOperationCopy;
         
     return DragOperationNone;